Privacy and Cookie Policy
1. Data Controller
This Privacy and Cookie Policy concerns the website operated by BLACKFLAG Reklam Yapım Organizasyon Sanayi ve Ticaret Limited Şirketi (the “Company”) and the data processing activities carried out within the scope of the Istanbul Children’s Festival organized by the Company. Our Company acts as the data controller under the Personal Data Protection Law No. 6698 (the “PDPL”).
Company Title: BLACKFLAG Reklam Yapım Organizasyon Sanayi ve Ticaret Limited Şirketi
Address: Eğitim Mah. Abdibey Sk. Kent Plus A Blok No: 24 A İç Kapı No: 21 Kadıköy / İstanbul
E-mail: [email protected]
Telephone: 0530 821 12 42
2. Your Personal Data Processed
When you visit our website, purchase a ticket, or enter the festival grounds, the following personal data is processed:
Identity and Contact Information: First name, last name, e-mail address, telephone number.
Customer Transaction and Payment Information: Ticket purchase history, order and reservation information. (Your credit/debit card information is never recorded or stored by our Company).
Participating Child Information: The age/age group information of the participating child shared by the parent/legal guardian for the purposes of accurate event and workshop planning.
Visual and Audio Recordings: Photographs and video recordings taken at the festival grounds for the promotion and archiving of the organization and social media activities, either as general crowd footage or within the framework of event rules.
Transaction Security and Technical Data: IP address, cookie records, browser type, website access and exit logs, and usage statistics.
3. Purposes and Legal Grounds for Processing Personal Data
Your personal data is processed for the purposes set out below, based on the legal grounds specified in Article 5 of Law No. 6698:
Establishment or Performance of the Contract (PDPL Art. 5/2-c): For carrying out festival ticket sales and reservation transactions, verifying ticket ownership, managing billing processes, and officially notifying participants of any possible changes to the event schedule.
Explicitly Prescribed by Law and Fulfillment of a Legal Obligation (PDPL Art. 5/2-a, ç): For fulfilling information retention, reporting, and taxation obligations arising from the Tax Procedure Law, the Turkish Commercial Code, the Law on the Regulation of Electronic Commerce, and other relevant legislation.
Legitimate Interest of the Data Controller (PDPL Art. 5/2-f): For establishing general order and ensuring the safety of life and property at the festival grounds; promoting and marketing the festival and conducting corporate archiving activities through social media, the website, television, radio, and printed materials (posters, billboards, catalogs, etc.) within the scope of our Company’s commercial activities; ensuring the information security of the website and improving the user experience.
Existence of Explicit Consent (PDPL Art. 5/1): If participants provide their consent, for sending commercial electronic messages regarding our Company’s future events, sponsorship collaborations, campaigns, and advertising activities.
4. Transfer of Personal Data
Your personal data is shared with the following third parties in accordance with Articles 8 and 9 of the PDPL, solely to the extent limited to achieving the purposes stated above:
Payment Service Providers: Relevant financial transaction data is transferred to licensed payment institutions compliant with PCI-DSS in order to securely complete ticket purchases. Credit or debit card information belonging to participants is never recorded or stored by our Company.
Authorized Public Institutions and Organizations: To authorized official authorities and law enforcement agencies for fulfilling notification obligations arising from legislation or in accordance with the lawful requests of administrative/judicial authorities.
Service Providers and Business Partners: For operating the technical infrastructure of the website, managing the database, conducting analytical performance measurements (such as Google Analytics), and carrying out digital marketing/advertising activities; data may be transferred, under data security measures, to our cloud computing, software, and cookie provider business partners whose servers are located domestically or abroad and from whom data security commitments have been obtained.
5. Cookies Policy
Our website uses cookies to ensure site functionality, measure performance, and improve the user experience. The types of cookies and their purposes are as follows:
Cookie Type
Purpose
Retention Period
Necessary Cookies
Required for the operation of the website and session security.
During the Session
Analytical Cookies
Analysis of visitor statistics and site traffic.
Up to 2 Years
Marketing Cookies
Displaying targeted advertisements based on users’ interests (with consent).
Up to 1 Year
You can completely or partially disable cookies by changing your internet browser settings; however, in this case, some functions of the website and the ticketing infrastructure may not operate fully.
6. Data Security
Your personal data is protected through SSL/TLS encryption protocols, secure server infrastructures, cybersecurity software, and administrative access restrictions. All necessary technical and administrative measures are taken against unauthorized access, disclosure, alteration, or destruction. In the event of a possible data breach, our Company will notify the Personal Data Protection Board and you without delay in accordance with the applicable legislation.
7. Your Rights Under the PDPL
Under Article 11 of the PDPL, you have the right to learn whether your personal data is being processed, to request information if it has been processed, to learn whether it is being used in accordance with the purpose of processing, to learn the third parties to whom it has been transferred domestically or abroad, to request correction if it has been processed incompletely or incorrectly, and to request the deletion or destruction of the data.
Applications you submit to exercise your rights under the Law must be made in writing or via secure electronic signature, mobile signature, or your e-mail address previously notified to our Company and registered in our systems, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Our Company reserves the right to request identity verification and additional information/documents in order to determine whether the applicant is the data subject. Requests duly submitted will be finalized within no later than 30 (thirty) days, depending on their nature.
8. Policy Amendments and Effectiveness
This Privacy and Cookie Policy enters into force as of the moment it is published on the website. The Company reserves the right to update this policy from time to time in line with changes in legislation or operational requirements. The current policy is always accessible on the website.
