Data Processing Agreement
An integral part of the innclude Business Agreement
Article 1. Parties, Subject Matter and Definitions
1.1. This agreement governs the mutual obligations relating to personal data processed through the Platform, between innclude Bilet Dağıtım ve Bilişim Teknolojileri A.Ş. ("innclude") and the business that holds an account in the innclude Business panel (the "Business").
1.2. The concepts used in this agreement bear the meanings given to them in Law No. 6698 on the Protection of Personal Data.
1.3. Participant data means data relating to persons who buy a ticket for an event or register their attendance. Guest data means data relating to persons the Business adds to its own lists. Team data means the employee, accreditation and door staff details the Business adds to the panel.
Article 2. Capacities
2.1. Which of the parties is the data controller and which is the data processor is determined separately for each processing activity:
| Processing | Data controller | Data processor | Explanation |
|---|---|---|---|
| Operation of the Platform, account, security and transaction logs | innclude | - | innclude determines the purpose and the means. |
| Ticket sales and collection of Participant data | innclude and the Business, separately in respect of their own purposes | - | innclude issues the ticket; the Business manages entry to the event and its own invoicing. |
| Processing after Participant data has been transferred to the Business | the Business | - | The Business is responsible for its own processing. |
| Guest, accreditation and team lists | the Business | innclude | The Business creates the list; innclude stores, transmits and verifies it. |
| Audience the Business transfers to the CRM from its own list | the Business | innclude | The data comes from the Business. |
| Guest data added by the Promoter | The party that adds the data | innclude | The Business is responsible for the authority of the Promoter it has invited. |
2.2. In processing activities where innclude is the data processor, it processes the data only on the Business's instructions and within the framework of this agreement.
Article 3. Obligations of the Business
3.1. Legal basis and privacy notice. The Business is obliged to secure the legal basis required for the collection of the data it adds to the panel and processes through the Platform, and to provide the data subjects with the required notice. innclude does not audit whether this obligation has been fulfilled.
3.2. Purpose limitation. The Business may use the personal data transferred to it or accessed in the panel only for the following purposes:
- Organising the event, managing entry and communicating with the Participant about the event.
- Recording ticket and attendance records in the accounts, and invoicing.
- Announcing its own events, to the extent that the data subject's explicit consent exists.
- Fulfilling obligations arising from legislation.
3.3. Prohibited uses. The Business may not:
- sell, rent, exchange or transfer this data to third parties;
- enrich it by combining it with another data set, or create profiles from it;
- use it to promote products and services other than its own events;
- transfer it to another platform, list or marketing tool;
- continue to store it for purposes unrelated to the event.
3.4. Team and authorisation. The Business keeps the permissions of the users it adds to the panel limited to their job description, removes the access of persons who leave without delay, and does not permit account sharing.
3.5. Notification. Where the Business detects a data breach or unauthorised access on its own side, it informs innclude without delay.
3.6. Promoter accounts. In respect of accounts of the Promoter type, this agreement applies to the extent of the personal data the Promoter adds to the Platform. The Promoter is the data controller in respect of the persons it adds itself and is subject to the obligations in 3.1 and 3.3. The Business that invites a Promoter is responsible for the invited person being authorised to add that data. The Promoter's own contact list is not visible to the Business and cannot be exported as a file.
3.7. A tool is provided; compliance is not warranted. The Platform's consent, opt-out, data rights request and communication functions provide the Business with a tool. Use of these functions does not mean that the Business has fulfilled its obligations arising from personal data protection and commercial electronic message legislation. The explanations and warnings on the screens do not take the place of legal advice. Details are set out in Article 3.6 of the innclude Business Agreement.
Article 4. Communication Rules
4.1. The Business determines the content of the SMS messages, e-mails and app notifications sent through the Platform. innclude provides the technical transmission.
4.2. Distinction between an event invitation and a commercial message:
| Type of message | What is required | Explanation |
|---|---|---|
| Event invitation and event information | Legal basis and privacy notice | An invitation the Business sends for its own event to a person on its own list. Every message includes the ability to opt out. |
| Marketing and campaign message | Prior explicit consent and a Message Management System record | Discounts, campaigns, general promotion. Cannot be sent without consent. |
| Transactional notification | No consent required | Ticket, entry code, change of time or place, cancellation information. |
4.3. The Business is responsible for obtaining and recording consent for commercial electronic messages and for giving effect to opt-out requests. The right to opt out is free of charge and must be available in every message.
4.4. The Business may not make a blanket declaration to the effect that "all have marketing consent" for the lists it uploads to the panel. The panel does not offer that option.
4.5. innclude may stop message deliveries that are the subject of a complaint or that are found to be contrary to legislation, and may suspend the account.
4.6. Message Management System. A service provider sending commercial electronic messages is required to register with the Message Management System (İYS), to upload its consent and opt-out records to that system, to query the system before sending, and to notify opt-out requests to the system within three business days. A Business that sends commercial electronic messages to its own list through the Platform is itself responsible for all of these obligations. innclude does not register with the Message Management System on the Business's behalf, does not upload consents, does not carry out queries and does not submit opt-out notifications; it provides only the technical transmission and complies with the opt-out records it holds in the panel.
4.7. Opt-out record. If an opt-out record exists for a person on the Platform, no message is sent to that person even if consent exists. Opt-outs may be held on a per-channel basis. The Business is not deemed to have generated consent by removing a person's opt-out record on its own decision; a consent switched off by the person can be switched on again only with that person's renewed consent.
4.8. Three-layer model. The Platform divides messages into three categories: no message at all is sent to a person with an opt-out record; messages in the nature of an invitation may be sent where there is no opt-out and each carries the ability to opt out; messages in the nature of marketing require explicit consent or the corporate recipient exception. The Business may not send a person who has opted out a message asking for consent either.
Article 5. Access to Data and Export
5.1. Which data the Business can see in the panel and which it can export as a file is as follows. The table reflects the product reality as at the effective date of this agreement and is updated when the product changes.
| List | Exported as a file? | What the file contains and what it does not |
|---|---|---|
| CRM contact list | No | Displayed in the panel and worked on one by one. The telephone number never appears in the list; it appears masked on the contact card. It cannot be downloaded as a file. |
| CRM breakdown reports | Yes | Aggregated counts and percentages only. Contact names, telephone numbers and e-mail addresses do not appear. |
| CRM customer (company) page statement | Yes, contains contact names | The first names and surnames of the contacts at the company, their tags, the needs note, the number of entries and the last visit. Telephone numbers and e-mail addresses do not appear. |
| Sales statement | Yes, contains buyer names | The buyer's first name and surname, the ticket type, the amount paid, the deductions, the tax, the net amount, the payment date and status. Telephone numbers and e-mail addresses do not appear. Complimentary lines also appear in the file. innclude may narrow the scope of the personal data in this file and may apply masking. |
| Accreditation list | Yes, masked | Full name, telephone number, role and organisation. After the event has ended, only the last two digits of the telephone number are visible and the mask is applied to the file as well. The Turkish identity number is not collected at any stage. |
| Guest list, from the brand screen | No | Displayed in the panel; cannot be downloaded as a file. |
| Guest list, from the Promoter workspace | Yes, per event | The file is produced by innclude's systems. Telephone numbers do not appear in the file. |
| Promoter period report | Yes | Counts and ratios only. Monetary amounts and telephone numbers do not appear. |
| Distribution (Promoter and code) lists | Yes | Sales counts per Promoter and per code. The settlement and condition columns do not enter the file until the settlement calculation goes live. |
| Event report | Yes | Aggregated counts only. If revenue lines are not visible on screen for that role, they do not enter the file either. |
| Door (entry) list | No | Displayed in the panel; cannot be downloaded as a file. |
| Ticket document, registration card, badge | Yes | Produced as a document relating to a single person. |
| Payment and invoice records | Yes | For accounting purposes. The Participant's card details never appear. |
| Import template | Yes, empty | Contains a header row and one sample row; it carries no real personal data. |
5.1.a. The Promoter's own contact list is not visible to the Business and cannot be exported as a file. The Business sees only the number of persons coming through the Promoter's own channels.
5.1.b. Visibility depends on the source. How much of a guest record is visible to the Business depends on the source of the record. Records added by hand by an authorised user, selected from a user search, pre-registered from the event page, or coming from a card displayed at the door are fully visible to the Business. In records added from a user's own contacts, the number is masked. In records coming from a Promoter's short link, personal data is visible on a restricted basis.
5.1.c. Personal data that enters a file is the Business's responsibility. The sales statement, the CRM customer page statement and the accreditation list contain personal data. From the moment the Business downloads these files, it acts as the data controller in its own systems in respect of the data in the file and is subject to the obligations in 5.4.
5.2. The fact that the contact list cannot be exported is part of innclude's service. The Business may not use screenshots, automated data collection tools, bots or bulk copying methods through the interface in order to circumvent this rule.
5.3. Where the Business needs a record at individual level because of an obligation arising from legislation, the request is submitted to innclude together with its reasons and innclude assesses the request.
5.4. Protection of exported data. The Business stores every file it takes from the panel securely in its own systems, limits access to authorised personnel, deletes it when the purpose has ceased to exist, and does not pass the file on to third parties. The prohibitions in 3.3 also apply to exported data. The accreditation list may be shared only with venue security.
5.5. The Business uploading its own list. The Business may upload its own contact list to the panel. The following rules apply to uploads:
- The uploaded audience is saved to its own segment and a segment name is mandatory. Uploaded records are not mixed into the main list.
- Marketing consent cannot be declared during upload. The uploaded audience is opened in the "invitation only" state. The panel does not offer, and will not offer, an option to the effect that "all have consent".
- For records added by hand and uploaded from a file, no consent arises, because the data subject has not filled in a form by his or her own hand. In order for marketing messages to be sent to these records, explicit consent must be obtained separately.
- Responsibility for the data in an uploaded list having been collected lawfully and for the data subjects having been given the required notice rests with the Business. innclude does not audit the source of an uploaded list.
- The Business chooses how duplicate records are to be handled (update, skip, save separately).
5.6. Request to export data. The Business may request a copy of the data for which it is the data controller in writing. innclude meets the request within a reasonable time and in a structured, commonly used format. This right does not override the rule in 5.2: the request is submitted with reasons and the scope provided is limited to the purpose of the request.
Article 6. Obligations of innclude
6.1. In processing activities where it acts as data processor, innclude processes the data only for the provision of the service and within the framework of this agreement.
6.2. innclude encrypts data in transit and at rest, keeps access role-based, retains access logs and imposes a confidentiality obligation on its personnel. Role-based access is enforced not only in the interface but also on the server side.
6.2.a. Roles and access to personal data. The access of the roles in the business panel to personal data is limited to their job description. The CRM screens are open only to the owner and administrator roles. Door staff access only entry scanning, the Promoter accesses only the records it has brought in itself, and monetary amounts are not shown to the Promoter. The Business is obliged to keep role assignments limited to the job description.
6.3. innclude accesses the Business's data only within the scope of technical support, security and legal obligations. Such access is logged.
6.4. Sub-processors. innclude uses sub-processors for the provision of the service. Agreements containing obligations equivalent to those in this agreement are concluded with sub-processors. The categories of sub-processor and their locations are:
| Category | Location | Data accessed |
|---|---|---|
| Cloud and server infrastructure | Shown in the current list | All hosted data |
| Payment institution, Turkish lira | Türkiye | Payment and invoice details |
| Payment institution, foreign currency | United States of America and Ireland | Payment and invoice details |
| SMS and instant message delivery | Türkiye and the global operator network | Telephone number, message content |
| E-mail delivery | Shown in the current list | E-mail address, message content |
| App notifications | United States of America | Device notification identifier, notification content |
| Error and crash logging | Germany | Error message, device and version details |
| Maps, place search and weather | United States of America and Europe | Venue search text, coordinates |
The current list is published at innclude.com. innclude updates the list when it changes a sub-processor or adds a new one; at the written request of the Business, the change is also notified separately.
6.5. innclude notifies a data breach occurring in its own systems to the Personal Data Protection Board within the period laid down in legislation and informs the Business without delay.
6.6. innclude does not use the Participant data it transfers to the Business without the Business's instruction, other than for the purposes for which it processes that data in its own capacity as data controller.
Article 7. Data Subject Requests
7.1. Where a data subject submits a request concerning his or her data to one of the parties, it is determined which party is the data controller and the request is directed to that party.
7.2. In processing activities where it is the data processor, innclude provides the Business with the technical support required; it does not conclude the request on its own.
7.3. The Business responds within the period laid down in legislation to requests for which it is the data controller. The panel contains a screen for these requests; the request types are access, deletion, rectification and objection, and the statutory period is thirty days.
7.4. The obligation arises because the Business sells tickets. The Business is the data controller because it sells tickets to its event and processes Participant data, not because it has purchased the CRM or a similar feature. For that reason the data rights requests screen is not tied to the package and does not close when the package changes.
7.5. Closing a request does not delete the data. Marking a request as "processed" in the panel does not have the effect of deleting or anonymising the personal data. In order for a deletion request to be fulfilled, the data must actually be removed from the Business's own systems and from its own lists on the Platform. innclude carries out deletions in the records for which it is the data controller in accordance with its own procedure.
7.6. A person's own application cannot be withdrawn. A request opened by a data subject through the app is that person's statutory application; the Business cannot cancel the request on the ground that it is a "mistaken record". Records opened by hand by the Business can be cancelled by stating the reasons.
Article 8. Transfer Abroad
8.1. Transfer abroad is carried out in the order set out in Article 9 of Law No. 6698: an adequacy decision; where there is none, a standard contract, binding corporate rules or the other appropriate safeguards listed in the Law; and where these are also absent, the exceptional circumstances set out in the Law.
8.2. Where the Business wishes to transfer abroad data for which it is responsible, it is obliged to comply with the same rules.
Article 9. Retention, Deletion and Termination of the Agreement
9.1. innclude retains data for the provision of the service and for the retention periods arising from legislation.
9.2. Event records are retained for as long as the event record remains in the system, because they constitute evidence in any claims relating to the event. In accreditation lists, the full telephone number is closed to the Business after the event has ended and continues to be retained at innclude only.
9.3. When the agreement terminates, the Business deletes or anonymises all personal data it has previously exported from the panel, if no legal basis requiring retention remains, and declares this in writing at innclude's request.
9.4. After the termination of the agreement, innclude holds data only within the framework of the retention obligations arising from legislation.
9.5. Retention periods.
| Data | Period | Basis |
|---|---|---|
| Business account and authorised user records | For as long as the account is open | Performance of the agreement |
| Corporate and billing details, invoices issued | Ten years | Tax and commercial legislation |
| Ticket, attendance and entry records | For as long as the event record remains in the system | Evidence in any claims |
| Guest and accreditation lists | For as long as the event record remains in the system; in accreditation, the full telephone number is closed to the Business at the end of the event | Data minimisation |
| Consent, opt-out and explicit consent records | The period required for proof after consent has been withdrawn | Burden of proof |
| Audit trail and access logs | The period laid down in legislation | Law No. 5651 and proof |
| After the brand account has been closed | Only records for which a statutory retention period is still running; the others are deleted or anonymised | Data minimisation |
9.6. Closing the brand account. Closing the brand account is a request and is carried out on the date determined; until that date the Business may cancel the request. Access is not restricted while the request is pending. The username is released when the closure is actually carried out.
9.7. Transfer of the account. A brand account may be transferred to another person only by its owner. Ownership passes not with the transfer request but with the acceptance of the other party. On transfer, the events, sales and guest lists also pass to the new owner. From the transfer onwards, the transferee becomes a party to the obligations in this agreement and assumes the capacity of data controller in respect of the personal data in the transferred lists.
9.8. Delivery of data to the Business. Before the agreement terminates, the Business may request a copy of its own data by the procedure in 5.6. innclude meets this request before the account is closed; once the closure has been completed, the obligation to deliver is limited to records for which a statutory retention period is still running.
Article 10. Audit
10.1. The Business may request information at reasonable intervals and on prior notice in order to verify that innclude complies with its obligations under this agreement. innclude meets such a request, save for trade secrets and the data of other customers.
10.2. Where there is a suspicion of misuse, innclude may ask the Business for an explanation regarding its use of data.
Article 11. Liability
11.1. Each party is liable for the processing activities for which it is the data controller and for loss arising from a breach of its own obligations.
11.2. Where an administrative fine is imposed on innclude or a claim for compensation is brought against it because of a use by the Business in breach of this agreement, the Business compensates innclude for the loss it suffers as a result.
11.3. This article does not limit the parties' liability arising from their intent or gross negligence.
Article 12. Effect
12.1. This agreement is an integral part of the innclude Business Agreement and is in force for as long as the business account remains open.
12.2. In the event of a conflict concerning personal data between this agreement and the Business Agreement, this agreement applies.