KVKK

KVKK Clarification Text

Under the Law No. 6698 on the Protection of Personal Data

About This Clarification Text

This text has been prepared by BLACKFLAG Reklam Yapım Organizasyon Sanayi ve Ticaret Limited Şirketi – İstanbul Çocuk Festivali within the scope of Article 10 of the Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfillment of the Clarification Obligation.

1- Identity of the Data Controller

• Trade Name: BLACKFLAG Reklam Yapım Organizasyon Sanayi ve Ticaret Limited Şirketi – İstanbul Çocuk Festivali
• MERSIS No: 0524123773700001
• Registered Electronic Mail Address: [email protected]
• Address: Eğitim Mah. Abdibey Sk. Kent Plus A Blok No: 24 A İç Kapı No: 21 Kadıköy /İstanbul
• E-mail: [email protected]
• Telephone: 0530 821 12 42

2- Personal Data Processed and Purposes of Processing

Data Category	Purpose of Processing	Legal Basis
Identity Information First name, surname	Ticket sales, event registration, invoicing and communication	Establishment and performance of the contract (Art. 5/2-c), Legal obligation (Art. 5/2-ç)
Contact Information E-mail, telephone	Information, complaint and request management	Performance of the contract (Art. 5/2-c)
Transaction Security IP address, cookies, log records	Website security, analytics and keeping legally required logs	Expressly stipulated in laws (Art. 5/2-a), Legitimate interest (Art. 5/2-f)
Marketing Data Communication preferences, purchase history	Campaign and announcement communications	Explicit consent (Art. 5/1)
Visual/Aural Data Photographs, videos	Event archive, promotional and social media sharing	Explicit Consent of the Parent/Guardian for focused shots and children’s data (Art. 5/1); Legitimate interest for mass shots (Art. 5/2-f)

3- Transfer of Personal Data

Your personal data may be transferred to the following recipient groups:

• Payment infrastructure and ticketing providers: Only the necessary data for processing ticket payments and organization registrations — on the legal basis of performance of the contract
• Authorized public institutions and organizations: Within the scope of legal obligations, reporting and taxation — due to a legal obligation
• Cloud and software service providers: For the operation of the technical infrastructure, e-mail and web servers — within the scope of legitimate interest (If the servers are located abroad, the transfer is carried out pursuant to Article 9 of the KVKK).

4- Method of Collection of Personal Data

Your personal data is collected through the following means:

• Ticket purchases and registration forms through the website
• Communications conducted by telephone and e-mail
• Social media interactions
• Photography/video recordings conducted at the festival venue
• Through cookies and web analytics tools, by wholly or partially automated means or by non-automated means provided that they are part of a data recording system

5- Retention Periods

Data Type	Retention Period	Basis
Ticket and purchase records	10 years	Statute of limitations under the Turkish Commercial Code and Turkish Code of Obligations
Communication and customer service records	3 years	Completion of processes and commercial customs
Marketing communication data	Until consent is withdrawn	Explicit consent
Website log records	For the period prescribed by applicable legislation	Obligations under Law No. 5651
Photograph and video data	Until consent is withdrawn / Until the purpose ends	Explicit consent / Legitimate interest

6- Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to us as the data controller:

• Access to Information: To learn whether your personal data has been processed and, if it has been processed, to request information,
• Rectification: To request the correction of incomplete or inaccurate data,
• Deletion / Destruction: To request its deletion when the legal retention periods have expired or when the relevant conditions are met,
• Objection: To object to processing by automated systems and for marketing purposes,
• Transfer Information: To learn the third parties to whom your data has been transferred domestically or abroad,
• Compensation: To request compensation for damages arising from unlawful processing.

7- Application Procedure

You may apply to us through the following channels to exercise your rights. Your applications will be answered within no later than 30 days, depending on the nature of the request, in accordance with the procedures and conditions prescribed by applicable legislation.

• Application by E-mail: By writing to [email protected] from your e-mail address registered with our company (Subject: KVKK Application), or by using a secure electronic signature/mobile signature,
• Application via Registered Electronic Mail: By sending it to [email protected], signed with a secure electronic signature or mobile signature,
• Application by Mail / In Person: In writing, in person or through a notary, to Eğitim Mah. Abdibey Sk. Kent Plus A Blok No: 24 A İç Kapı No: 21 Kadıköy /İstanbul.

Note: The application must include the applicant’s first name and surname, signature, Turkish Republic identification number, residential address and subject of the request, as required by the Communiqué on the Procedures and Principles of Application to the Data Controller. Additional documents may be requested for identity verification.

8- Complaint to the Personal Data Protection Board If your application is rejected, the response provided is deemed insufficient, or no response is provided within the prescribed period, you may file a complaint with the Personal Data Protection Board (www.kvkk.gov.tr) within 30 days from the date you learn of the response and, in any event, within 60 days from the date of application.