Gizlilik Politikası

Article 1. Purpose and Scope

1.1. This Privacy Policy explains, for us as innclude Bilet Dağıtım ve Bilişim Teknolojileri A.Ş., the purposes for which we process your personal data, who we share it with, how long we keep it and which rights you have in this regard.

1.2. The Policy applies to the innclude.com website, the innclude mobile applications, the ticketing infrastructure, the organiser panel, the notification systems and innclude's other digital channels.

1.3. This Policy is an annex to the Terms of Use. The details of cookie use are set out in the Cookie Policy, and the notices specific to particular processing operations are set out in the Personal Data Protection Notice. The three texts are read together.

1.4. The current version of the Policy is always published at innclude.com.

Article 2. Definitions and Parties

2.1. The concepts used in this text:

2.2. Who is responsible for which data varies depending on the processing:

Article 3. The Data We Collect

3.1. When you grant access to your contacts, the name and first telephone number of the people in your contacts are uploaded to our servers and matched against users registered with innclude. Numbers shorter than seven digits are not uploaded. The upload is refreshed when we detect that your contacts have changed. As a result of the matching, you see only which people are on innclude. innclude does not share the telephone numbers of the people in your contacts with other users and does not use them for marketing purposes.

3.2. If you want the record of your contacts deleted, you can request this by writing to info@innclude.com; the request is fulfilled within thirty days at the latest. When you delete your account, the record of your contacts is deleted as well.

3.3. When you grant location permission, your location is recorded while the application is open in the foreground and at most once every thirty minutes or upon movements of one hundred metres. No location is obtained while the application is closed or in the background.

3.4. The card number, expiry date and security code are transmitted through our servers to the payment institution in order for the payment to be taken. innclude does not record or store this information and does not give it to third parties; from a card stored by the payment institution, only the card brand and the last four digits are returned to innclude.

3.5. If you search for a venue while creating an event, the search text you type and your device's location are transmitted to the map service provider. When the weather for an event is displayed, the coordinates of the event are transmitted to the weather provider. Both are listed in Article 7.

3.6. You can buy a ticket as a guest, without opening an account. In that case your first name, surname, telephone and e-mail details are processed only for the purposes of issuing and delivering the ticket and verifying it at admission.

3.7. When you enter information for more than one attendee, you accept that you are sharing those persons' information with their knowledge.

Article 4. Processing Purposes and Legal Bases

We process each item of data for a specific purpose and on a legal basis that fits that purpose.

Article 5. Processing Subject to Explicit Consent and Device Permissions

5.1. The following operations are carried out only with your consent:

• Processing of location data.
• Matching the numbers in your contacts against innclude users.
• Camera and photo access.
• Measurement of use and measurement of promotional displays.
• Sending campaign and promotional messages.

5.2. Withholding these permissions does not prevent the core operation of the service; only the relevant feature does not work. You can withdraw the permissions at any time from your device settings. The privacy section inside the application shows the current status of the permissions and directs you to the device settings.

5.2.a. Withdrawing a device permission does not automatically delete a record of your contacts that was uploaded earlier. If you want it deleted, use the route set out in 3.2.

5.3. Withdrawing your consent does not affect past processing; it takes effect for the future.

5.4. Operations such as opening your account, issuing your ticket and taking the payment are necessary for the performance of the contract. No separate consent is obtained for these and they are not stopped by the withdrawal of consent.

Article 6. Notifications and Commercial Electronic Messages

6.1. Notifications sent in order for the service to function are not subject to consent. The delivery of the ticket and the entry code, payment and refund information, a change in the time or place of an event, a security warning and an announcement of a change to the contracts fall within that scope.

6.2. Campaign, discount and promotional messages are sent only where you have given prior consent. The record of consent is kept together with the date and the channel on which the consent was obtained and may be withdrawn at any time, free of charge.

6.3. You can withdraw your consent by the following routes: by switching off the "Campaigns and offers" preference in the notification settings in the application, by using the opt-out link in the messages, by writing to info@innclude.com, or through the Message Management System (İYS). Your opt-out request is processed within three business days at the latest.

6.4. For messages sent by the brands organising events on the basis of their own lists, the party that obtains consent and is obliged to process opt-out requests is that brand. For those messages innclude only provides the delivery infrastructure. The rules applying to the brand are set out in the Data Processing Agreement.

Article 7. Sharing of Data

7.1. We do not sell or rent your personal data and do not transfer it to third parties for marketing purposes.

7.2. Your data is shared only with the following parties, limited to the purpose:

7.3. Contracts are concluded with service providers governing the processing of data solely for the specified purpose and the security of that data.

7.4. The countries in which the providers listed in 7.2 are located and the data they access are shown in the table in Article 8.4. The current version of this text is published at innclude.com; the text is updated when the list changes.

7.5. innclude does not use an advertising network. No advertising is displayed in the application, no advertising identifier is processed and no tracking for advertising purposes is carried out.

7.6. The records of the party organising the event. The brand organising an event for which you have bought a ticket or registered attendance adds you to its own attendee records and can see which of its events you have attended. That record is for the running and reporting of the event and is not subject to marketing consent. For the brand to be able to send you campaign messages, your separate consent is required; withholding your consent does not prevent the record being kept, it only prevents messages being sent. As regards those records, the data controller is the brand concerned and the brand's obligations are set out in the Data Processing Agreement.

Article 8. Transfer Abroad

8.1. Some of the infrastructure and service providers we use may be located abroad. In that case your personal data is transferred abroad.

8.2. The transfer is carried out in the order set out in Article 9 of Law No. 6698:

1. where there is an adequacy decision concerning the country, sector or organisation to which the transfer will be made, on the basis of that decision,
2. where there is no adequacy decision, by providing a standard contract, binding corporate rules or one of the other appropriate safeguards listed in the Law between the parties,
3. where none of these is possible, only in the exceptional situations listed in the Law and provided that it is incidental.

8.3. The data transferred is limited to what is necessary for the provision of the service.

8.4. Transfer abroad currently takes place in respect of the following services:

The location of the cloud and e-mail providers is shown in the current list referred to in 7.4. If those providers are located abroad, the transfer is carried out in the order set out in 8.2.

8.5. Payments made in Turkish lira are taken through a payment institution resident in Türkiye; no transfer abroad is made for those payments.

8.6. When this table changes, the text is updated and the current version is published at innclude.com.

Article 9. Retention Periods

9.1. When the period expires, the data is deleted, destroyed or anonymised.

9.2. If you close your account, records for which a statutory retention period is still running continue to be kept for that period and can be accessed only for the purpose of that retention. Invoice and accounting records fall within that scope.

9.3. When you make an account deletion request, the account is permanently deleted after thirty days. If you log in within those thirty days, your account is restored. Once the period has expired the operation cannot be reversed; your profile, your username, your images, your contacts record, your following relationships and your event history are deleted, and the innPoint balance you have accumulated is reset to zero. Your invoice records continue to be kept in accordance with Article 9.2.

9.4. Instead of deleting your account you can freeze it. No data is deleted in a frozen account; your profile and your events become invisible to others, and they are restored when you log in.

Article 10. Data Security

10.1. Technical and administrative measures are applied to protect personal data against unauthorised access, loss and unlawful processing. Those measures include the encryption of data in transit and at rest, authorisation and access controls, the keeping of access logs, backups and the confidentiality obligation of personnel.

10.2. The same level of protective practices is required of our service providers.

10.3. For the security of your account, we recommend that you do not share verification codes with anyone and that you notify us in the event of anything suspicious.

Article 11. Data Breach

11.1. Where personal data is unlawfully obtained by others, the situation is notified to the Personal Data Protection Board as soon as possible from the moment it becomes known.

11.2. The persons affected by the breach are notified as soon as reasonably possible and by an appropriate method. The notification states the nature of the breach, the types of data affected, the likely consequences and the measures taken.

11.3. The necessary technical and administrative steps are taken to reduce the effect of the breach and to prevent its recurrence.

Article 12. Exercising Your Rights

12.1. Under Article 11 of Law No. 6698 you may request the following:

• To learn whether personal data is being processed and, if it is, to request information about it.
• To learn the purpose of the processing and whether the data is used in accordance with that purpose.
• To know the third parties to whom the data is transferred, in Türkiye or abroad.
• To request the correction of data that has been processed incompletely or inaccurately.
• To request the deletion or destruction of the data where the conditions are met.
• To request that correction, deletion and destruction operations be notified to the third parties to whom the data has been transferred.
• To object to an adverse outcome arising from an analysis carried out exclusively by automated systems.
• To request compensation for damage in the event that you suffer loss as a result of unlawful processing.

12.2. If you are a user falling within the scope of the EU General Data Protection Regulation, you additionally have the rights to data portability and to restriction of processing.

12.2.a. You can request a copy of your data from the Settings › Download my data section in the application. The copy is sent to your registered e-mail address; for this reason an e-mail address must be registered in your account for the request to be made. If you do not have a registered e-mail address, you can submit the same request by the route set out in 12.3. By either route, the request is met within thirty days at the latest.

12.2.b. You can delete or freeze your account from within the application. The consequences of deletion and freezing are set out in Articles 9.3 and 9.4. If your account holds authorisations with other brands, has a pending transfer request or has a published event, the deletion is not completed until those are concluded; the application shows which obstacle exists.

12.3. You can submit requests for correction, deletion, objection and other applications to info@innclude.com or in writing to our company address. Applications are concluded within thirty days at the latest in accordance with Article 13 of Law No. 6698. If the operation entails an additional cost, the fee in the tariff set by the Board may be charged.

12.4. We may request additional information in order to verify your identity. Requests that are technically impossible, that infringe the rights of others or that are contrary to legislation are refused together with the reasons.

Article 13. Cookies

13.1. innclude uses cookies and similar technologies in order to keep your session open, to remember your preferences, to measure use and, to the extent you permit, for promotional purposes.

13.2. Cookies other than strictly necessary cookies run only with your consent. You can change your preferences from the cookie settings panel on the website and from the privacy settings inside the application.

13.3. Cookie types, durations and providers are explained in detail in the Cookie Policy.

Article 14. Children's Data

14.1. innclude's services are for persons who have reached the age of eighteen. Persons under the age of eighteen cannot open an account or use the services.

14.2. Where it is established that data belonging to a person under the age of eighteen is being processed, the account is closed and the data is deleted without delay, except where legislation makes retention mandatory.

14.3. If you become aware of such a situation, you can report it to info@innclude.com.

14.4. innclude does not verify age at registration. The age condition rests on the user's declaration; no identity or age confirmation is carried out. This does not remove the rule set out in 14.1 and 14.2.

Article 15. Changes

15.1. This Policy may be updated. The current version is published at innclude.com together with the version number and the effective date.

15.2. Where a substantial change is made to the processing purposes, to the parties to whom data is transferred or to the retention periods, you are informed by in-app notification, e-mail or SMS before the change takes effect.

Article 16. Data Controller and Contact