Privacy Notice
Last updated: 16 Ekim 2026
In short: We process your data only to run ticket purchases and sales, meet our legal obligations and prevent fraud. Sellers' identity and bank details are never shared with buyers.
1. Data controller
The data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the EU/EEA, the General Data Protection Regulation (“GDPR”) is [COMPANY NAME] Ltd (Biletloop), [Registered office address], London, United Kingdom.
2. Data we process
| Category | Examples | From whom |
|---|---|---|
| Identity | Full name | All members |
| Contact | Email, phone | All members |
| Financial | For sellers, IBAN, account holder and bank name; payment transaction records (we never store card details) | Sellers / buyers |
| Attendee details | Name and ID/passport number needed to transfer tickets; for some events date of birth and country of residence | Buyers |
| Security | IP address, session and log records, device information | All visitors |
| Documents | Proof of ticket ownership, delivered ticket files | Sellers |
3. Purposes and legal bases
- Running your membership and ticket transactions — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Review of seller applications and listings, and prevention of fraud and fake tickets — legitimate interest and legal obligation (KVKK Art. 5/2-f, 5/2-ç; GDPR Art. 6(1)(f), (c)).
- Invoicing, accounting and records required by Turkish Laws No. 5651 and 6563 — legal obligation.
- Protecting our rights in disputes — establishment, exercise or defence of legal claims.
- Promotions and newsletters — only with your consent, which you can withdraw at any time.
4. Who we share data with
- Sellers: only the attendee name and ID/passport number needed to transfer the ticket. Buyers' email and phone are never shared.
- Buyers: no personal data of sellers is shared.
- Official ticket suppliers: for automatically delivered tickets, the attendee details required by the organiser.
- Service providers: payment provider (Stripe), hosting, email/SMS providers — only as needed to provide the service.
- Authorities: courts and public bodies where legally required.
Some payment, supply and infrastructure providers are located outside Turkey and/or the EEA; such transfers are made in line with KVKK Art. 9 and, where applicable, with appropriate GDPR safeguards (e.g. standard contractual clauses).
5. Retention
Data is kept for the duration of your membership and afterwards for the statutory limitation and retention periods (10 years for commercial records), then deleted, destroyed or anonymised.
6. Your rights
You have the right to know whether your data is processed, to request information, rectification or erasure, to know the recipients, to object to automated decisions and to claim compensation (KVKK Art. 11). Users in the EU/EEA also have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and may lodge a complaint with their supervisory authority. Send requests to [email protected]; we reply within 30 days.
[COMPANY NAME] Ltd · Company no. [Company number] · [Registered office address], London, United Kingdom · [email protected]
In case of any discrepancy between language versions, the Turkish version prevails. This text is an informational draft and must be reviewed by a lawyer before publication.