1. Data controller
Under Personal Data Protection Law No. 6698 of Türkiye (KVKK), the data controller is Biletini.
2. Data processed and why
Identity and contact data (name, surname, phone, email): creating an account, verifying tickets, and handling orders and refunds.
Transaction data (orders, payment references, ticket details): performing the sales contract and meeting accounting and statutory retention obligations.
Usage data (in-app activity): improving the service and detecting fraud and bot activity.
Data processed on explicit consent (marketing permission): campaign and recommendation notifications. The service can be used without giving this permission, and it can be withdrawn at any time.
3. Transfers
Payment data is transferred to a licensed payment institution in order to carry out the transaction. Card details are not stored on the platform.
Ticket and attendance details are shared with the relevant organiser for entry control at the event. This sharing is limited to that event.
Data may be shared with competent public authorities where there is a lawful request.
4. Retention
Order and invoice data is retained for ten years as required by tax legislation.
When marketing permission is withdrawn, processing of the relevant data for marketing purposes stops immediately.
On an account deletion request, data not covered by a statutory retention obligation is deleted; data that is covered is destroyed at the end of the retention period.
5. Your rights
Under Article 11 of the Law you have the right to access your data, to request its correction or deletion, to object to its processing, and to receive it in a portable format.
You can use Account Details > Download my data in the app, or write to the support team. Requests are concluded within thirty days at the latest.