Personal Data Notice (KVKK)

This notice is provided under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, to inform you about personal data processed through the istanbulcardshow.com website and online store.

Details concerning ticket purchases and the mobile app are in the Privacy Policy.

Last updated: October 26, 2026

1. Data controller

Your personal data is processed by Croone Organizasyon ve Ticaret Limited Şirketi as the data controller. Address: Fenerbahçe Mah. Iğrıp Sk. No:13 Mükellef Teknoloji 34726 Kadıköy / İstanbul. E-mail: [email protected]. Phone: +90 543 953 13 58.

MERSIS No: 0215069516600001
Trade Registry No: 1087351
Address: Fenerbahçe Mah. Iğrıp Sk. No:13 Mükellef Teknoloji 34726 Kadıköy / İstanbul
Tax Number: 2150695166
Tax Office: Göztepe
Phone: +90 543 953 13 58
E-mail: [email protected]

2. Personal data processed

The following categories of personal data may be processed when you use the store and website:

Identity: first and last name;
Contact: e-mail address, phone number and, for shipped orders, delivery address (address, city, postal code);
Customer transaction: order code, order contents, amount, shipping fee, delivery method, return and withdrawal requests, support correspondence;
Transaction security: time of the transaction and of consent (including consent to the Pre-Contract Information Form and Distance Sales Agreement), cookie and session data, error logs. Your IP address is passed only to the payment institution for fraud prevention and is not stored in our order record;
Financial: payment outcome and payment reference. Card details such as card number, expiry date and security code are neither seen nor stored by the Seller; they are processed by the payment institution.

3. Purposes of processing

Your personal data is processed for the following purposes:

receiving and confirming your order and forming and performing the contract;
taking and verifying payment through the payment institution;
delivering the product by carrier or by hand at the show venue;
sending order confirmation, shipping and invoice information by e-mail; issuing invoices and accounting;
handling cancellation, return, withdrawal and defective product requests and complaints, and customer support;
ensuring information security, preventing fraud, meeting legal obligations and establishing, exercising or defending rights in disputes.

4. Legal bases

Your personal data is processed on the following legal bases in Article 5(2) of KVKK:

it is directly related to the formation or performance of a contract (Art. 5/2-c) — order, payment and delivery;
it is expressly provided for by law (Art. 5/2-a) and is necessary for the controller to meet its legal obligations (Art. 5/2-ç) — Law No. 6502, the Turkish Commercial Code, the Tax Procedure Law and related legislation;
processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e);
provided that it does not harm your fundamental rights and freedoms, processing is necessary for the legitimate interests of the controller (Art. 5/2-f) — information security and fraud prevention.

Sending commercial electronic messages requires your separate and explicit consent under Law No. 6563; placing an order does not imply that consent.

5. Transfers of personal data

Your personal data may be transferred, for the purposes above and in compliance with Articles 8 and 9 of KVKK, to the following groups of recipients:

the carrier: name, phone number and delivery address, for delivery;
the payment institution and bank: information needed to take and verify payment;
the e-mail infrastructure provider: delivery of order confirmation and notification e-mails;
the accountant / service providers used for invoicing and accounting;
competent public authorities and judicial bodies where required by law.

The e-mail infrastructure service is obtained from a service provider established abroad. Your e-mail address and the information in e-mail content may therefore be transferred abroad; such transfers are made in line with the conditions in Article 9 of KVKK.

6. Method of collection

Your personal data is collected electronically, wholly or partly by automated means, through the order and payment forms on the website, the contact form and e-mail correspondence.

Your personal data is kept for the period provided by the relevant legislation or required by the purpose of processing (up to ten years for commercial records and documents under the Turkish Commercial Code); after that it is deleted, destroyed or anonymised.

7. Your rights under KVKK

Under Article 11 of KVKK you may apply to the data controller to exercise the following rights:

to learn whether your personal data is processed,
to request information if it has been processed,
to learn the purpose of processing and whether it is used accordingly,
to know the third parties to whom data is transferred in Türkiye or abroad,
to request correction if it is incomplete or inaccurate,
to request deletion or destruction under Article 7 of KVKK,
to request that corrections, deletions and destruction be notified to third parties to whom data was transferred,
to object to a result against you produced solely by automated analysis of the data processed,
to claim compensation if you suffer damage because of unlawful processing.

8. How to apply

You may send requests about your rights, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller, in writing to Fenerbahçe Mah. Iğrıp Sk. No:13 Mükellef Teknoloji 34726 Kadıköy / İstanbul or by e-mail to [email protected]. Additional information or documents may be requested to verify your identity.

Your applications are concluded free of charge within thirty days at the latest, depending on the nature of the request; if the process requires a separate cost, the fee in the tariff set by the Board may be charged. If you find the reply insufficient or receive no reply in time, your right to complain to the Personal Data Protection Board is reserved.