Privacy Policy

Organizer

The event is organized by Croone Organizasyon ve Ticaret Limited Şirketi (the “Company”).

• MERSIS No: 0215069516600001
• Trade Registry No: 1087351
• Address: Fenerbahçe Mah. Iğrıp Sk. No:13 Mükellef Teknoloji 34726 Kadıköy / İstanbul
• Tax Number: 2150695166
• Tax Office: Göztepe
• Phone: +90 543 953 13 58
• E-mail: [email protected]

1. Personal Data Collected

During ticket purchase, event registration, or contact forms, the following personal data may be collected:

• Full name
• Email address
• Phone number
• City and country (optional)
• Purchase and attendance history

2. Purposes of Processing

• Create and confirm your event registration
• Prepare attendee lists
• Provide event-related updates
• Conduct post-event surveys and satisfaction studies
• Share information about products and services offered by our sponsors

3. Sharing with Third Parties

Participant name, surname, email, and phone may be shared only with official sponsors for the following purposes within the scope of the event and for a limited time:

• Surveys and research activities
• Promotional and campaign communications
• Post-event feedback requests

Buying Tickets, Customer Records and Marketing

When you buy a ticket through our site, your name, email and phone (buyer and attendees) are shared with Kommunity, our ticketing partner, to issue tickets. Payment is collected on the payment provider's page used for the event; card details never reach our servers. A Kommunity account is created automatically for the buyer's email address.

Details on the data we collect, why we process it, and how marketing opt-ins work when you buy a ticket:

• Data collected: buyer name, e-mail, phone; attendee name and e-mail; date of birth (required, to verify age-restricted tickets and for age-group segmentation and analysis of our audience), gender and interests (optional, used for segmentation and analysis and, only for buyers who explicitly opt in to marketing, to personalize communication sent to them); invoice details (name/company, country, city, district, address, postal code, tax office); order and attendance history. National ID and tax number are shared with Kommunity only to issue the invoice — we do not store them. Date of birth, gender and interests are never sent to Kommunity.
• Purposes: issuing tickets (performance of a contract); keeping a customer record and statistical analysis to plan our events (legitimate interest) — this includes age-group, gender and interest segmentation and analysis at an individual (per-customer) level, for example in our customer records, filters and CSV exports, not only in aggregate; if the buyer gives explicit consent, sending marketing messages about our events and campaigns by e-mail and/or SMS, which may be personalized using the buyer's own demographic and interest information.
• Transfers: Kommunity (issuing tickets and invoices), the event's payment provider.
• Marketing consent: optional, not required to buy. You can withdraw it at any time using the "unsubscribe" link in any message, or by writing to [email protected]. Withdrawing stops future messages from that date onward.
• Attendee data and marketing consent: when you buy tickets for other people, their details (name, e-mail, date of birth, gender, interests) are entered by you, not by them. Marketing consent is never attributed to an attendee — only the buyer can grant or withdraw marketing consent, and only for the buyer's own profile.

Marketing consent is recorded separately per channel (e-mail/SMS), together with the text and version you were shown, the date, your IP address and how it was given, so we can demonstrate it if required.

Retention: order and invoice records are kept for the periods required by applicable law (up to 10 years). Customer records are anonymized 3 years after your last purchase or attendance. Consent records are kept for 3 years after withdrawal, for evidentiary purposes.

Online store orders

When you place an order in the store, the following data is processed:

• first and last name, e-mail address, phone number;
• for shipped orders, delivery address (address, city, postal code);
• order contents, amount, delivery method and order status;
• The time of the order and the time you accepted the legal documents. Your IP address is passed only to the payment institution for fraud prevention; it is not stored in our order record.

Your payment card details (card number, expiry date, security code) are not stored or processed by us; payment is taken by the contracted payment institution / bank with 3D Secure verification. We receive only the payment outcome and payment reference.

This data is processed to take the order, verify the payment outcome, deliver the product, issue the invoice, handle returns and withdrawals, communicate with customers and meet legal obligations.

The data is shared only with the carrier for delivery, with the payment institution / bank for payment, with the e-mail infrastructure provider for order e-mails, and with competent authorities where legally required.

Order and invoice records are kept for the period required by the legislation on commercial books and records (up to ten years under the Turkish Commercial Code).

Personal Data Notice (KVKK)

Istanbul Card Show Mobile App

This section applies to the Istanbul Card Show mobile app (the “App”) downloaded from the App Store or Google Play. The App is provided by Croone Organizasyon ve Ticaret Limited Şirketi. The other sections of this policy also apply to the App; this section complements them.

Account details

When you create an account, we process your email address, your name (taken from your ticket; you can change it), your password (kept only as an encrypted hash) and your session keys. Legal basis: performance of a contract (providing your App account).

Push notification records

Only if you allow notifications, a notification record (token) of your device is stored and notifications are delivered through Apple’s and Google’s notification services and our notification infrastructure provider. You can use the App without notifications. The record is deleted when you sign out, delete your account or when it becomes invalid.

Camera

The camera is used only if you allow it, to scan QR codes and to take photos for Moments. QR codes are decoded on your device; camera images are not stored or sent to us for scanning. A photo you take for Moments is sent to us only if you choose to share it.

Moments posts

The photo and caption you share in Moments are processed and stored for moderation. Every share is reviewed before it is shown anywhere. In the App you see only your own shares; approved content may be shown on the large screens at the event venue together with your short name (for example “Ayşe Nur Y.”). The camera and your photo library are used only when you choose to share a photo. Sharing your content on the Organizer’s social media accounts is based only on a separate, optional permission (explicit consent) that is recorded together with the time it was given; you can withdraw it at any time by deleting the share. Embedded information such as location (EXIF) is removed from the photos you share and the original file is not kept. If you allow notifications, you may receive push notifications about your shares. Your Moments content is deleted when you delete the share or your account, and in any case 90 days after the event ends.

Sponsor QR scans

In Sponsor Challenge, which sponsor campaign QR code you scanned, when you scanned it and the points you earned are recorded against your account. This information is shared with sponsors only as aggregate (numerical) reports, not per person.

Prize draws and the screen at the event venue

Your entry to a draw is calculated from your ticket and entrance (check-in) records, from your Sponsor Challenge points or from a separate list of participants announced by the Organizer. At the moment of the draw, the list of participants is recorded in a way that cannot be changed. During the draw, the winner’s first name and the initial of the surname (e.g. Mert Y.) are shown on the screen at the event venue and in the App, and participant names on the draw wheel may appear in the same short form; the name used is the name on the ticket in ticket-based draws, the name on the account in Sponsor Challenge draws and the name on the list in draws that use a separate list. The full name is kept only in the Organizer’s records. For the details, see the draw rules in the Terms of Use.

Terms of Use

Advertising and tracking

The App does not track you for advertising and your personal data is not sold.

Retention periods

Your account details are kept until you delete your account. Your notification record is kept until you sign out, delete your account or it becomes invalid. Your in-app notifications are kept until you delete your account, for at most 12 months; notification delivery records are kept for at most 30 days. Your Moments posts are kept until you delete them or your account, and in any case are deleted 90 days after the event ends. If an account is blocked from sharing in Moments, the blocked email address and the reason are kept for the same period to prevent abuse, even if the account is deleted. Sponsor scan records are anonymized 1 year after the campaign ends. The participant list and winner record of a draw are kept for 3 years from the draw. The periods in the “Buying Tickets, Customer Records and Marketing” section above apply to ticket, order and consent records.

Deleting your account

You can delete your account in the App or by email. Which data is deleted and which is kept is explained on the Account Deletion page.

Account Deletion

4. Your Rights Under KVKK

• Learn whether your personal data is processed
• Request information if your data has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know third parties to whom data is transferred domestically or abroad
• Request correction if data is incomplete or inaccurate
• Request deletion or destruction under KVKK Article 7
• Request notification of these actions to third parties
• Object to results against you arising from automated processing; seek compensation for unlawful processing

5. Data Retention

Your data is retained for the purposes above and legal retention periods; afterward, it is deleted, destroyed, or anonymized.

6. Security

Necessary technical and organizational measures are taken to protect confidentiality and integrity. Only authorized personnel have access.

For your KVKK rights or questions, contact us at [email protected]