Privacy Notice
Last updated: 16 Ekim 2026
In short: We process your data only to run ticket purchases and sales, meet our legal obligations and prevent fraud. Sellers' identity and bank details are never shared with buyers.
1. Data controller
The data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the EU/EEA, the General Data Protection Regulation (“GDPR”) is [ŞİRKET UNVANI] A.Ş. (Biletloop), [Açık adres], İstanbul.
2. Data we process
| Category | Examples | From whom |
|---|---|---|
| Identity | Full name; for sellers, ID/passport number and an image of the ID document | All members / sellers |
| Contact | Email, phone | All members |
| Financial | IBAN, account holder; payment transaction records (we never store card details) | Sellers / buyers |
| Attendee details | Name and ID/passport number needed to transfer tickets; for some events date of birth and country of residence | Buyers |
| Security | IP address, session and log records, device information | All visitors |
| Documents | Proof of ticket ownership, delivered ticket files | Sellers |
3. Purposes and legal bases
- Running your membership and ticket transactions — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Seller verification and prevention of fraud and fake tickets — legitimate interest and legal obligation (KVKK Art. 5/2-f, 5/2-ç; GDPR Art. 6(1)(f), (c)).
- Invoicing, accounting and records required by Turkish Laws No. 5651 and 6563 — legal obligation.
- Protecting our rights in disputes — establishment, exercise or defence of legal claims.
- Promotions and newsletters — only with your consent, which you can withdraw at any time.
4. Who we share data with
- Sellers: only the attendee name and ID/passport number needed to transfer the ticket. Buyers' email and phone are never shared.
- Buyers: no personal data of sellers is shared.
- Official ticket suppliers: for automatically delivered tickets, the attendee details required by the organiser.
- Service providers: payment provider (Stripe), hosting, email/SMS providers — only as needed to provide the service.
- Authorities: courts and public bodies where legally required.
Some payment, supply and infrastructure providers are located outside Turkey and/or the EEA; such transfers are made in line with KVKK Art. 9 and, where applicable, with appropriate GDPR safeguards (e.g. standard contractual clauses).
5. Retention
Data is kept for the duration of your membership and afterwards for the statutory limitation and retention periods (10 years for commercial records), then deleted, destroyed or anonymised. Images of seller ID documents are kept for no more than 2 years after verification.
6. Your rights
You have the right to know whether your data is processed, to request information, rectification or erasure, to know the recipients, to object to automated decisions and to claim compensation (KVKK Art. 11). Users in the EU/EEA also have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and may lodge a complaint with their supervisory authority. Send requests to [email protected]; we reply within 30 days.
[ŞİRKET UNVANI] A.Ş. · [Açık adres], İstanbul · MERSİS: [MERSİS NO] · [email protected]
In case of any discrepancy between language versions, the Turkish version prevails. This text is an informational draft and must be reviewed by a lawyer before publication.