Business Data Protection Notice
Prepared under Article 10 of Law No. 6698 on the Protection of Personal Data.
1. Data Controller
| Legal name | innclude Bilet Dağıtım ve Bilişim Teknolojileri A.Ş. |
|---|---|
| Address | Fenerbahçe Mah. İğrip Sok. No: 13/1, 34726 Kadıköy / İstanbul |
| MERSİS | 0478121800000001 |
| Tax office and number | Göztepe Vergi Dairesi, 4781218000 |
| [email protected] |
2. Who This Notice Covers
This notice covers the authorised users, team members, door attendants, persons added to accreditation lists and promoters of businesses that hold an account on the innclude Business panel. A separate privacy notice applies to individual users who purchase tickets.
3. Data Processed
| Category | Data |
|---|---|
| Identity and contact | Name, surname, telephone, email, function and title |
| Business information | Legal name, tax office and number, address, details of the authorised person, signature circular and similar documents |
| Finance | Bank account details, settlement and invoice records |
| Account and authorisation | Username, role and authorisation records, panel activity history |
| Transaction security | IP address, device information, session and access logs |
4. Purposes and Legal Grounds
| Purpose | Legal ground | Data |
|---|---|---|
| Opening the Business account and granting authorisations | Formation and performance of the contract | Identity, contact, account |
| Provision of the service and support | Performance of the contract | Account, contact |
| Settlement payments and invoicing | Legal obligation; performance of the contract | Finance, business information |
| Tax filings and withholdings | Legal obligation | Business information, finance |
| Security and prevention of misuse | Legitimate interest | Transaction security, account |
| Establishment and protection of rights | Establishment and protection of a right | All relevant data |
5. Transfers
| To whom | Why |
|---|---|
| Banks and payment institutions | Settlement payments and collection |
| Competent public authorities | Tax filings and requests arising from legislation |
| Accountants, auditors and legal advisers | Accounting, audit and legal proceedings |
| Cloud, SMS, instant messaging, email and notification infrastructure providers | Operation of the system and delivery of messages |
| Error and crash reporting provider | Detection and resolution of panel errors |
5.1. innclude, as an intermediary service provider, reports information concerning the Business and its sales to the competent authority within the scope of the notification obligations arising from legislation.
5.2. Transfers abroad are made in the order set out in Article 9 of Law No. 6698 on the Protection of Personal Data.
5.3. Transfers abroad currently take place for the following services: error and crash reporting (Germany), panel notifications (United States of America), maps and place search (United States of America), and package payments collected in foreign currency (United States of America and Ireland). The categories of sub-processors, their locations and the data they access are set out in the table in Article 6.4 of the Data Processing Agreement, and the current list is published at innclude.com.
5.4. No transfer abroad is made for package payments made in Turkish lira.
6. Retention Periods
| Data | Period | Basis |
|---|---|---|
| Account and authorisation records | For as long as the account remains open | Performance of the contract |
| Contract, invoice and accounting records | Ten years | Tax and commercial legislation |
| Settlement and payment records | Ten years | Same |
| Accreditation and team lists | For as long as the event record remains in the system | Evidence for potential claims |
| Access and transaction logs | The period prescribed by legislation | Law No. 5651 |
| Consent and contract version records | The period required for evidentiary purposes after the account is closed | Burden of proof |
| Support and objection correspondence | A reasonable period following closure of the request | Legitimate interest |
| After the account is closed | Only records for which a statutory retention period is still running; the rest are deleted or anonymised | Data minimisation |
7. Rights of the Data Subject
Under Article 11 of Law No. 6698 on the Protection of Personal Data, the data subject has the right to learn whether their personal data is being processed, to request information, to learn the purpose of the processing, to know the third parties to whom the data is transferred, to request its correction, erasure or destruction, to request that these operations be notified to the parties to whom the data was transferred, to object to an adverse outcome arising from analysis carried out through automated systems, and to claim compensation for damage suffered as a result of unlawful processing.
7.1. Requests may be submitted to [email protected] or in writing to the company address. A request must contain information identifying the applicant together with the subject of the request. Requests are concluded within thirty days at the latest.
8. Security
Data is encrypted in transit and at rest; access is role-based and is logged. Personnel are bound by a confidentiality obligation.
9. Third Parties Added to Lists
9.1. For the data of persons added to the panel as team members, accreditation entries or guests, the data controller is the party that added the record: the Business itself or the Promoter invited by the Business. Responsibility for records added by the Promoter rests with the Promoter; the Business is responsible for ensuring that the Promoter it invited is authorised to add those records. innclude processes this data for the purposes of transmission, verification and storage.
9.2. Persons added to a list shall direct requests concerning how their data is processed to the party that added the record in the first instance. innclude forwards requests it receives to the relevant Business and provides technical support.
9.3. After an event has ended, only the last two digits of telephone numbers on accreditation lists are visible to the Business. The full number is retained by innclude for obligations arising from legislation and is not disclosed to the Business.
10. Changes
This notice may be updated. The current version is published at innclude.com.