Privacy Policy (KVKK Disclosure Text)

1. Identity of the Data Controller

Pursuant to the Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the following data controller:

This Privacy Policy (hereinafter "Policy") applies to the BAILATIX website operating under the domain www.bailatix.com and all associated sub-pages.

2. General Information

This Policy explains how personal data provided when registering on the BAILATIX platform, during the ticket purchase process, or during any interaction with BAILATIX is processed.

Browsing the website does not require sharing personal data. However, certain services may require the provision of some personal information.

Filling out any form or sharing data during the ticket purchase process signifies that this Policy and the Terms and Conditions of Use have been read and accepted.

Your data is used only for permitted purposes; it is not used to send unauthorized emails or share with third parties without your consent.

3. Collection and Processing of Personal Data

3.1 Methods and Categories of Collection

Your personal data is collected through various channels. The following describes these channels and the types of data collected.

3.2 Information Provided by the User

You share personal data with us in the following circumstances:

1. When purchasing tickets or services through the website
2. When creating a personal account and interacting through platform forms
3. When submitting requests via forms, email, or other communication channels
4. When creating a Business Account and publishing an event
5. When using our search engine

At the time of data collection, you will be informed about the purpose of processing, recipients, and how to exercise your rights.

The data you provide includes:

For ticket purchases or service agreements:

First name, last name, email address, phone number, gender, and other information requested by the organizer. Transaction information (products purchased, quantity, price, date and time, etc.) is also processed. BAILATIX does not have direct access to credit or debit card information; payment is processed through third-party payment service providers.

For creating a personal account:

Email address and password. Optionally, first name, last name, date of birth, gender, province, city, and profile photo may be added in the profile section. If a purchase was made without prior account creation, a user profile may be created automatically; to delete this profile, an email can be sent to info@bailatix.com.

For filling out contact forms or contacting us:

Name, email address, and additional information related to the request.

For creating a Business Account or publishing an event:

Company/trade name, tax number or national ID number, billing address, bank account details (for payment), event details, and promotional materials.

For using the search engine:

Location information may be processed if permission is granted through the browser.

During website usage:

IP address, browser type, operating system, access date and time, referring site URL, and site usage data are collected via cookies. Please refer to our Cookie Policy for more information.

3.3 Purposes and Legal Bases for Processing

Your personal data is processed for the following purposes and legal bases as stipulated in Articles 5 and 6 of the KVKK:

Ticket purchase or service agreement:

Processed for managing service acquisition, establishing and executing the contractual relationship, and facilitating event reservations and ticket sales.

Legal basis: Establishment and performance of a contract (KVKK Art. 5/2-c)

Creating a personal account:

Processed for account management, enabling platform use, providing access to the personal area, and maintaining the relationship with BAILATIX.

Legal basis: Establishment and performance of a contract (KVKK Art. 5/2-c)

Creating a Business Account or publishing an event:

Processed for promoting the created page and providing users access to event, venue, or organizer information.

Legal basis: Establishment and performance of a contract (KVKK Art. 5/2-c)

Filling out contact forms or contacting us:

Processed for responding to and managing questions, information requests, suggestions, and complaints.

Legal basis: Explicit consent of the data subject (KVKK Art. 5/1)

Using the search engine:

Processed for providing more relevant search results based on geographic location.

Legal basis: Explicit consent of the data subject (KVKK Art. 5/1)

Additional purposes applicable in all cases:

• Fulfillment of legal obligations: Processed to comply with obligations arising from applicable legislation, including the Law No. 5549 on Prevention of Laundering Proceeds of Crime. Legal basis: Expressly stipulated by law (KVKK Art. 5/2-a)
• Commercial communication and marketing: Commercial communications regarding BAILATIX products and services may be sent; market research, surveys, and statistical studies may be conducted. Legal basis: Explicit consent of the data subject (KVKK Art. 5/1)
• Service development and improvement: Aggregated data on user interactions with the platform is used to evaluate and improve service quality. Legal basis: Legitimate interest of the data controller (KVKK Art. 5/2-f)
• Security, fraud prevention, and prevention of service abuse: Data may be monitored to detect and prevent fraud, unauthorized access, spam, and behaviors contrary to the Terms of Use. Legal basis: Legitimate interest of the data controller (KVKK Art. 5/2-f)

3.4 Third-Party Data

When purchasing a ticket on behalf of another person, it is declared and warranted that the relevant persons have been informed about this Policy and have consented to their data being processed by BAILATIX.

3.5 Updating Personal Data

The User is obliged to notify BAILATIX of any changes in the personal data provided. The User is always responsible for the accuracy and currency of the data.

BAILATIX has implemented the necessary technical and administrative security measures to protect personal data.

3.6 Retention Periods

Your personal data is processed for the duration of managing your request, while your user account remains active, and for the duration of the contract or commercial relationship between you and BAILATIX, within the principles of purpose limitation and data minimization.

The following criteria are considered when determining retention periods:

• Legal obligations regarding data retention
• Duration of the contractual relationship and management of liabilities arising therefrom
• Submission of a deletion request by the data subject

Personal data whose retention period has expired is destroyed or anonymized.

4. Parties to Whom Personal Data is Transferred

Your personal data may be shared with the following parties:

Public institutions and organizations:

Notifications may be made to competent administrative or judicial authorities where there is a legal obligation. In such cases, the personal data you have provided will be transmitted to the relevant authorities.

Service providers and business partners:

Data may be shared with service providers acting as data processors on behalf of BAILATIX (web hosting, marketing agencies, consulting firms, etc.). These providers are bound by a confidentiality agreement and may only use the data within the scope of the contract.

Event organizers:

Personal data may be shared with organizers for the organization and execution of the event, for communicating necessary information to attendees (e.g., event changes), and for fulfilling legal obligations.

Subject to the User's explicit consent, event organizers may send commercial communications regarding their future events. Organizer information will be clearly stated during the purchase process, and withdrawal of consent will be made easy.

Corporate transactions:

In corporate transactions such as mergers, acquisitions, or asset sales, user data may be transferred to the successor company; prior notice will be given.

Aggregated or anonymous data:

Aggregated data that cannot be associated with an identifiable natural person may be used and shared for any purpose.

4.1 Information Transferred to Payment Service Providers

All payment transactions are carried out through payment service providers complying with industry security standards. BAILATIX cannot directly access your payment information.

Payments are processed through the member merchant (virtual POS) infrastructure BAILATIX holds with its contracted bank or licensed payment institution. Your card details are never transmitted to or stored on BAILATIX servers. That institution's data processing practices are set out in its own privacy policy.

The ticket price is collected by BAILATIX on behalf of the selling organizer, in its capacity as that organizer's commercial agent. Your order and payment data is therefore shared with the bank or payment institution for the purpose of executing the payment, and with the selling organizer for the purpose of performing the order. The legal basis is article 5/2-(c) of the KVKK — processing directly related to the conclusion and performance of a contract.

In addition, under the continuous reporting obligation imposed on intermediary service providers by the Tax Procedure Law and the declaration obligation for income and corporate tax withholding, transaction data is reported to the Revenue Administration. The legal basis is article 5/2-(a) of the KVKK — processing expressly provided for by law.

5. International Transfer of Personal Data

Some of our service providers may be located outside of Turkey. Pursuant to Article 9 of the KVKK, the transfer of personal data abroad requires either the explicit consent of the data subject, or the Personal Data Protection Board having declared that the recipient country provides adequate protection.

In the absence of adequate protection, data controllers in Turkey and in the relevant foreign country must commit in writing to providing adequate protection and obtain the approval of the Board.

Your name, e-mail address, phone number, order and usage data may be transferred abroad in the context of cloud infrastructure, e-mail delivery, analytics and customer support tools. Under article 9 of the KVKK such transfers are carried out on the basis of appropriate safeguards (standard contracts, undertakings, binding corporate rules); your explicit consent is not requested for them.

For the processing activities that do rest on explicit consent, see the KVKK Explicit Consent Text .

6. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether it is being used for its intended purpose
• To know the third parties to whom your personal data is transferred, domestically or abroad
• To request correction of your personal data if it is incomplete or incorrectly processed
• To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK
• To request that correction, deletion, or destruction operations be notified to third parties to whom personal data has been transferred
• To object to a result that arises to your detriment through the analysis of processed data exclusively by automated systems
• To request compensation for damages in the event that you suffer damage due to unlawful processing of your personal data

6.1 How to Exercise Your Rights

You may submit applications to exercise your rights through the following channels:

• By sending a written and signed application to: —
• By email: info@bailatix.com
• By registered e-mail (KEP) or secure electronic signature: —
• See the Data Subject Application Form for the full application procedure.

Your applications will be responded to as soon as possible and in any case within the 30-day period stipulated by the KVKK. Additional documents may be requested when identity verification is required.

6.2 Right of Access

To learn whether your personal data is being processed and, if so, what data is being processed and for what purpose, you may contact info@bailatix.com.

6.3 Right to Rectification

You may request the correction of incorrect or incomplete personal data. In your application, you must state which data needs to be corrected and provide the correct information, attaching supporting documents if necessary.

6.4 Right to Object

You have the right to object to the processing of your personal data in the following circumstances:

• Where processing is based on legitimate interests (including profiling)
• Where processing is carried out for direct marketing purposes

6.5 Right to Deletion and Destruction

You may request the deletion or destruction of your personal data when the following conditions are met:

• The purpose for which your personal data was processed has ceased to exist
• The explicit consent on which processing was based has been withdrawn and there is no other legal basis
• Processing was carried out on the basis of legitimate interest or public interest and no valid reason justifying processing remains
• Your data is being used for direct marketing purposes
• Personal data has been processed unlawfully

This right is not absolute; processing may continue for purposes such as fulfilling legal obligations, public interest, or establishing, exercising, or defending legal claims.

6.6 Right to Restriction of Processing

You may request restriction of processing of your personal data in the following circumstances:

• If you contest the accuracy of your data, for the period necessary to verify accuracy
• If you object to processing based on legitimate interest or public interest, during the evaluation of these grounds
• Where processing is unlawful but you request restriction rather than deletion
• When you no longer need the data but require it for the establishment, exercise, or defense of legal claims

6.7 Right to Data Portability

Where processing is carried out by automated means and is based on consent or a contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller.

7. How We Protect Your Personal Data

BAILATIX has implemented the necessary technical and administrative security measures within the scope of Article 12 of the KVKK to ensure the security and confidentiality of your personal data. These measures are regularly updated and reviewed.

Commercial transactions are carried out in a secure server environment using SSL (Secure Socket Layer) protocol.

The following are ensured for a secure e-commerce transaction:

• Authentication: Verification of the identity of the communicating party
• Integrity: Immutability of communication content
• Confidentiality: Inaccessibility of communication content to unauthorized parties

8. How to Protect Yourself

We recommend our users take the following precautions:

• Do not share your username or password with others.
• Do not write your password in easily accessible places (computer, notebook, etc.).
• Close your browser session after accessing secure areas or entering a username/password.
• Use strong and unique passwords.

9. Commercial Communications

BAILATIX sends the User a transactional email confirming the ticket purchase and containing the tickets for each purchase transaction. The User may also be contacted regarding changes or updates related to the event.

Commercial communications regarding BAILATIX or its business partners' products and services may only be sent subject to the User's explicit consent given by checking the relevant box or through an appropriate form.

The User may withdraw their consent to commercial communications at any time by:

• Sending an email to info@bailatix.com
• Using the unsubscribe link in every commercial email
• Updating communication preferences under My Account
• Recording a rejection through the Message Management System (İYS)

10. Links to Third-Party Websites

The User will be clearly informed when links are provided to websites not operated or controlled by BAILATIX. BAILATIX is not responsible for the content of these sites or their personal data collection and usage practices.

It is recommended that you carefully review the privacy policies of the relevant sites.

11. Cookies

BAILATIX uses cookies to ensure the functionality of the website, analyze usage habits, and improve the user experience. For detailed information about the use of cookies and how to manage your preferences, please review our Cookie Policy.

12. Protection of Minors

The services provided through the website are intended solely for persons who are 18 years of age or older, and minors should refrain from providing personal data on the platform.

If it is determined that a minor has provided personal data without parental or legal guardian consent, such data will be deleted as soon as possible.

13. Changes to the Privacy Policy

BAILATIX reserves the right to update this Policy at any time in accordance with applicable legislation. Changes that significantly affect the processing of your personal data will be announced through the website or by direct notification.

It is recommended that you review the current version of the Policy at regular intervals.

14. Applicable Legislation

This Policy has been prepared in accordance with applicable Turkish legislation, including in particular the following:

• Law No. 6698 on the Protection of Personal Data (KVKK)
• Regulation on Deletion, Destruction or Anonymization of Personal Data
• Communiqué on Procedures and Principles for Application to the Data Controller
• Law No. 6563 on the Regulation of Electronic Commerce
• Law No. 6502 on Consumer Protection