Organiser Agreement and Data Processing Annex

1. Parties and Definitions

1.1. Parties

This Organiser Agreement and Data Processing Annex (the "Agreement") has been concluded between the parties whose details are set out below:

On the one part, Loopcode Bilişim Yazılım Mühendislik Eğitim ve Danışmanlık A.Ş. (hereinafter referred to as "Loopcode" or the "Company"), which operates the event and community management and ticketing platform operating under the "Gathin" brand and through the gathin.com website:

• Registered address: Yavuz Sultan Selim Mah. Dr. Sadık Ahmet Cad. No:24 İç Kapı No:1, Fatih/İstanbul, Türkiye
• MERSIS No: 0609 0927 8100 0001
• Trade Registry No / Office: 189875-5 (Istanbul Trade Registry Office)
• Tax Office / VKN: Fatih Tax Office, VKN: 6090927810

On the other part, the natural or legal person who creates and manages events and/or communities on the Gathin platform and requests intermediation for ticket sales for them (the "Organiser").

Loopcode and the Organiser are referred to individually as a "Party" and jointly as the "Parties".

1.2. Definitions

Gathin / Platform: All of the event and community management and ticketing services operated by Loopcode and offered through the gathin.com domain name.

User: The natural person who registers with and/or uses the Platform.

Organiser: The User who creates and manages an Event or community on the Platform.

Event: An in-person or online organisation defined by the Organiser on the Platform, to be held on a specific date and/or at a specific place.

Ticket: A paid or free (RSVP) electronic registration granting the right to attend an Event.

Buyer: The User who purchases a paid Ticket.

Attendee Data: Personal data relating to persons who register for an Event, purchase a Ticket or create an RSVP, transferred to the Organiser within the scope of this Agreement.

Entitlement: The net amount to be transferred to the Organiser from the proceeds of paid Ticket sales after deduction of the commission/service fee determined in this Agreement and, if any, refunds, chargebacks, taxes and statutory deductions.

Commercial Message: An electronic message sent for the purpose of promoting or marketing goods or services or increasing the recognition of a business, within the scope of Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages.

İYS: The Message Management System.

KVKK: Law No. 6698 on the Protection of Personal Data and the relevant secondary legislation.

Community Rules: The content and conduct rules published on the Platform and binding on all Users and Organisers.

2. Status and Obligations of the Organiser

2.1. Status of the Organiser

The Organiser is the party staging the Event it creates. The Organiser is not the seller of the Ticket; for paid Tickets, seller capacity belongs to Loopcode pursuant to Section 4. The relationship between the Organiser and Loopcode is in the nature of a relationship between independent parties; this Agreement does not establish any partnership, ordinary partnership, joint venture, agency or employer-employee relationship between the Parties.

2.2. General obligations

The Organiser accepts and undertakes the following:

a) To hold the Event in accordance with the date, place, scope and conditions announced on the Platform.

b) To obtain, at its own responsibility and in its own name and account, all permits, licences, authorisations and notifications necessary for staging the Event (including administrative permits, copyright and performance rights, venue permissions, and health and safety requirements).

c) To ensure that all information on the Platform relating to the Event, the Ticket and itself is accurate, current, not misleading and compliant with the legislation.

d) To act in accordance with the legislation in force, public order, general morality and the Community Rules.

e) In the event of cancellation or postponement of the Event, or a change in its venue or scope, to notify the relevant Users and Loopcode without delay through the Platform.

f) To use the management authorisations granted to it only for its own Events and communities, and to protect the confidentiality of its access details.

Any legal, administrative and criminal liability arising from the Organiser's breach of these obligations belongs exclusively to the Organiser.

3. Creating Events and Tickets

3.1. Event and Ticket information

The Organiser itself defines and updates the title, description, date, location, capacity, Ticket types, price and sale conditions relating to Events and Tickets through the Platform. The accuracy, completeness and compliance with legislation of this information is the exclusive responsibility of the Organiser.

3.2. Price, currency and VAT

Ticket prices are determined by the Organiser and may be defined in TL/TRY (default), USD or EUR.

Value Added Tax (VAT) is applied at the rate in force (the general rate is 20%); certain events may be subject to a different or zero rate under the legislation. Only whether the price is displayed inclusive or exclusive of VAT is determined by the Organiser on an Event basis. The Organiser is exclusively responsible for:

a) The price display format (VAT inclusive / VAT exclusive) relating to the Event and the Ticket being compliant with the tax legislation in force,

b) Prices and tax information being reflected to Buyers accurately and clearly.

The Organiser is responsible for all consequences arising from incorrect, incomplete or non-compliant price and VAT information, and shall compensate the damages Loopcode may suffer for this reason pursuant to Section 9.

3.3. Free Tickets and RSVP

No amount is collected for free (RSVP) Tickets. By their nature, the provisions of this Agreement relating to the sales model, Entitlement and consumer transactions do not apply to such registrations; however, the provisions of Section 6 and ANNEX A relating to the processing of Attendee Data continue to apply.

4. Sales Model and Entitlement

4.1. Loopcode's capacity as merchant of record

For paid Tickets, Loopcode is the merchant of record for the Ticket. Accordingly, Loopcode:

a) Sells the Ticket to the Buyer in its own name, b) Collects the Ticket price, c) Issues the sales document (invoice/e-Archive invoice) required to be issued to the Buyer, d) Transfers the collected amount to the Organiser as Entitlement after the deductions set out in this Section have been made.

The Organiser accepts that the sale of paid Tickets is legally carried out by Loopcode for the purpose of providing access to the Event staged by the Organiser.

4.2. Payment infrastructure

Ticket prices are collected through the iyzico payment infrastructure with 3D Secure verification. Card details are transmitted to iyzico via Loopcode's payment infrastructure for the purpose of executing the payment and are not stored by Loopcode; the payment is processed through iyzico within the framework of the relevant legislation and card scheme rules. Details relating to the payment step and the sales relationship between the Buyer and Loopcode are set out in the Distance Sales Agreement and the Cancellation and Refund Terms.

4.3. Commission / service fee

In consideration of the sales, collection, documentation and platform services it provides, Loopcode is entitled to a commission on the paid Ticket sale price. The commission rate is determined according to the timing of the withdrawal (payout) request: 15% for withdrawals made within 45 days of receipt of the payment, and 12% for withdrawals made after 45 days. The applicable rate for each payment is displayed on a per-payment basis on the Organiser's Revenue page. This fee, together with payment institution costs, is deducted from the gross sale price in the Entitlement calculation and is not additionally passed on to the Buyer.

4.4. Calculation and payment of the Entitlement

Revenue obtained from paid Ticket sales is credited to the balance of the Organiser's relevant community. The Entitlement is calculated by deducting the following items from the paid Ticket sale prices for the relevant period:

a) The commission and payment infrastructure costs under Section 4.3, b) Refunds made pursuant to the Cancellation and Refund Terms and the Distance Sales Agreement, c) Amounts reclaimed due to chargebacks and disputes, d) Taxes and statutory deductions required under the relevant legislation.

In order to withdraw the amount in the community balance, the Organiser first registers the details of a bank account belonging to the community (IBAN and account holder); it then creates a withdrawal (payout) request through the Platform. Upon an approved withdrawal request, the net Entitlement is transferred to the community's registered bank account. The commission rate is applied according to the timing of the withdrawal request as set out in Section 4.3 (15% / 12% based on the 45-day threshold).

The Organiser is obliged to issue to Loopcode a document (such as an invoice) compliant with the tax legislation in force for the Entitlement amount it receives. The sales document (e-Archive) to be issued to the Buyer is issued by Loopcode in the capacity of merchant of record within the period prescribed by the relevant legislation (7 days) and sent to the Buyer's e-mail address.

4.5. Effect of refunds, cancellations and chargebacks on the Entitlement

In the event of cancellation or postponement of the Event, or refunds to which the Buyer is entitled, the refunded amounts are set off against the relevant Entitlement; if the Entitlement is insufficient, the Organiser shall pay the difference upon Loopcode's request. Tickets are as a rule non-refundable; a refund is made only (i) where the Event is cancelled or postponed by the Organiser and (ii) in cases where the legislation grants a right of withdrawal (not tied to a specific date/online). Approved refunds are made by Loopcode to the Buyer's card within 14 days at the latest. Refund processes are subject to the Cancellation and Refund Terms.

The Organiser accepts that, within the framework of Law No. 6502 on Consumer Protection and the Regulation on Distance Contracts, the right of withdrawal may fall within the exception under Article 15/1-(g) of the Regulation for entertainment, leisure and event services that must be performed on a specific date or during a specific period; and that, conversely, as the party staging the Event it is responsible for meeting refund claims that may arise in favour of the consumer in cases such as cancellation or material change of the Event.

4.6. Tax responsibility

The Organiser is exclusively responsible for fulfilling its own tax obligations (including declaration, payment and documentation) relating to the Event it stages and the Entitlement revenue it obtains. The obligations assumed by Loopcode in the capacity of merchant of record do not eliminate this responsibility of the Organiser.

5. Prohibited Events

The Organiser may not create or promote through the Platform Events, communities and content of the nature listed below by way of illustration and detailed in the Community Rules:

a) Activities contrary to the legislation in force, constituting a crime or inciting crime, b) Activities held without the necessary permits, licences or age restrictions and contrary to the legislation, c) Content and activities containing hate speech, violence, discrimination, harassment or attacks on personal rights, d) Events and ticketing that are misleading, fraudulent in nature or constitute unfair commercial practices, e) Content infringing the intellectual or industrial property rights of third parties, f) Other content and activities prohibited in the Community Rules.

Loopcode reserves the right to suspend, remove or halt Events, content or Ticket sales that it determines to be contrary to the Community Rules or the legislation, without prior notice where necessary. Liability that may arise towards third parties as a result of such measures belongs to the Organiser.

6. Sharing of Attendee Data and the KVKK

6.1. Sharing of data

Part of the Attendee Data collected within the scope of Ticket sales, RSVP or registration transactions relating to an Event is transferred to the Organiser for the purpose of managing the Event. Depending on the nature of the relevant transaction, the data that may be transferred may include data such as first name, last name, e-mail address, mobile telephone number and Event-specific form responses.

In paid Ticket sales, data such as identity number, billing address and, if any, tax number is additionally processed by Loopcode. This data is processed for the purpose of enabling Loopcode to fulfil its tax and legal obligations in the capacity of merchant of record; card details are transmitted to iyzico via Loopcode's payment infrastructure, are not stored by Loopcode and are not transferred to the Organiser.

6.2. KVKK status of the Parties

The Organiser is an independent data controller in respect of the Attendee Data transferred to it. Loopcode and the Organiser each act in the capacity of separate data controller in respect of their own processing activities and are separately responsible for their own processing activities. The roles of the Parties, security measures, sub-processors, breach notification and the principles relating to the return/destruction of data are set out in ANNEX A.

6.3. The Organiser's KVKK obligations

The Organiser accepts and undertakes that it will process the Attendee Data transferred to it only for the purpose of managing and staging the relevant Event, in accordance with the KVKK and the relevant legislation, and in this scope:

a) That it will fulfil the obligation to inform data subjects pursuant to Article 10 of the KVKK in respect of its own data processing activities,

b) That it will obtain explicit consent unless the processing activity is based on a processing condition provided for in Articles 5 and 6 of the KVKK,

c) That it will not use the data other than for the purpose of transfer, will not sell it and will not share it with unauthorised third parties,

d) That it will respond to data subjects' applications under Article 11 of the KVKK within the applicable periods,

e) That it will fulfil the obligation to register with the Data Controllers Registry (VERBİS) where necessary,

f) That it will not retain the data beyond the period required by the purpose and will destroy it in accordance with ANNEX A once the purpose ceases to exist.

Details relating to the processing of Attendee Data on the Platform side are set out in the Privacy Policy and the KVKK Privacy Notice.

6.4. Minimum age

The minimum age for use of the Platform is 16. The Organiser manages its Events and communities having regard to this age limit and applies any additional Event-specific age restrictions at its own responsibility.

7. Marketing Messages

7.1. Transactional and commercial messages

Transactional messages sent through the Platform, such as ticket/RSVP confirmation, pre-Event reminders and saved Event reminders, relate to the performance of the relevant service and do not qualify as Commercial Messages. Similarly, messages serving a service and informational purpose sent by the Organiser to the members of its own community — such as event information, invitations, updates and post-event forms — are based on the membership relationship and legitimate interest, offer an easy and free opt-out in every message, and do not qualify as Commercial Messages as they have no promotional/marketing purpose. By contrast, messages sent exclusively for promotional and marketing purposes (including campaign and offer announcements and promotional messages directed at communities not joined) qualify as Commercial Messages and require approval and İYS within the scope of Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages. Marketing messages of this nature are not currently sent through the Platform; these principles will apply once delivery is activated.

7.2. Commercial messages originating from the Organiser

In respect of Commercial Messages initiated by the Organiser or whose content is determined by the Organiser, the service provider within the meaning of Law No. 6563 is the Organiser. In this scope, the Organiser is exclusively responsible for:

a) Obtaining recipients' prior approval before sending a Commercial Message, b) Recording, managing and querying approvals and refusal notifications through İYS, c) Identifying itself in every Commercial Message and offering an easy, free opt-out (refusal) facility, d) Ceasing to send messages to recipients who exercise their right of refusal.

Loopcode provides only the technical infrastructure and delivery tool for sending these messages; the Organiser is responsible for the content of the messages and for approval and İYS obligations. Loopcode is not currently registered with İYS; before commercial electronic message delivery is initiated, İYS registration and the necessary approvals will be completed. The Organiser is responsible for administrative sanctions and damages arising from its breach of these obligations, and shall compensate the damages Loopcode may suffer for this reason pursuant to Section 9.

8. Intellectual Property

8.1. Rights relating to the Platform

The Gathin brand, the gathin.com domain name, the Platform software, design, interfaces, database structure and all intellectual and industrial property rights relating thereto belong to Loopcode or its licensors. This Agreement does not confer on the Organiser any transfer of rights other than the right to use the Platform within the scope of this Agreement.

8.2. Organiser content

The rights in the Event and community descriptions, images, announcements, forms and other content uploaded to or created on the Platform by the Organiser ("Organiser Content") remain with the Organiser. The Organiser grants Loopcode a worldwide, royalty-free and transferable licence of use for the purposes of operating the Platform, presenting and promoting the Event and Tickets and providing the related services.

8.3. The Organiser's undertakings

The Organiser undertakes that it holds the necessary rights and authorisations in respect of all content it uploads to the Platform, and that such content does not infringe the intellectual property, personality or other rights of third parties. The Organiser is responsible for claims of infringement brought by third parties, and Section 9 applies to such claims.

9. Liability and Indemnity

9.1. Limit of Loopcode's liability

Loopcode provides the Platform as is and to the extent available. Loopcode is not responsible for the content, staging, quality, cancellation or postponement of the Event; for Organiser Content; or for the Organiser's processing of Attendee Data. Without prejudice to the mandatory provisions of the legislation, Loopcode's liability is in any event limited to direct damages; it cannot be held liable for indirect damages, loss of profit or loss of data.

9.2. Indemnity

The Organiser accepts and undertakes to cover, upon Loopcode's first request, any and all claims, actions, administrative sanctions, damages and costs (including reasonable attorneys' fees) that Loopcode, its employees or business partners may be exposed to as a result of its breach of this Agreement, the Community Rules or the legislation, the staging of the Event, Organiser Content, the processing of Attendee Data or the sending of Commercial Messages.

9.3. Force majeure

Where obligations cannot be performed due to events developing outside the Parties' control and unpreventable (including natural disasters, epidemics, decisions of official authorities and interruptions to infrastructure and communications), the relevant Party shall not be deemed in default for the duration of the force majeure.

10. Term and Termination

10.1. Term

This Agreement enters into force on the date the Organiser accepts the Agreement through the Platform and remains in force until terminated by either Party.

10.2. Termination

Each Party may terminate the Agreement at any time, with effect in respect of future Events. Loopcode may terminate the Agreement immediately and/or suspend the Organiser's account, Events or Ticket sales if the Organiser acts in breach of this Agreement, the Community Rules or the legislation.

10.3. Consequences of termination

Loopcode's obligations arising from its capacity as merchant of record in respect of Tickets whose sale has been completed as at the date of termination, together with the Organiser's obligations to hold the relevant Event and in respect of accrued Entitlement, shall continue. Accrued Entitlement is settled within the framework of the deduction and set-off rules in this Agreement.

10.4. Fate of the data

In the event of termination, the return or destruction of Attendee Data is subject to the provisions of ANNEX A. The period relating to the retention of data held by Loopcode after account deletion is applied as within 30 days at the latest, subject to data required for legal obligations and potential disputes and to the mandatory retention periods prescribed by the legislation; the mandatory retention periods prescribed by the legislation are reserved.

10.5. Surviving provisions

The provisions on intellectual property, liability and indemnity, confidentiality, the KVKK, governing law and jurisdiction, and ANNEX A shall by their nature continue to apply after the termination of the Agreement.

11. Governing Law and Jurisdiction

This Agreement is governed by the laws of the Republic of Türkiye. The courts and enforcement offices of Istanbul have jurisdiction over disputes that may arise from the Agreement. In transactions in which one of the Parties holds the capacity of consumer, the Consumer Arbitration Committees and the Consumer Courts have jurisdiction within the monetary limits announced.

12. Notices and Contact

Notices between the Parties are made through the Platform or via the contact channels specified in this Agreement. For notices addressed to Loopcode:

• Support: info@loopcode.co
• KVKK / legal: info@loopcode.co
• Telephone: 0 (530) 468 28 68

Abuse and complaint notifications are submitted via info@loopcode.co.

---

ANNEX A. Principles of Data Processing and Sharing

This Annex is an integral part of this Agreement and governs the principles relating to the sharing and processing of Attendee Data between the Parties. In the event of a conflict between this Annex and the text of the Agreement in relation to Attendee Data, this Annex shall apply.

A.1. Roles of the Parties

Loopcode and the Organiser are independent (separate) data controllers in respect of Attendee Data as regards their own processing activities. Each Party is separately responsible for the processing activity it carries out by the purposes and means it determines, for data security and for its KVKK obligations towards data subjects. This Annex does not establish joint data controllership between the Parties.

A.2. Subject matter, purpose and duration of processing

• Subject matter: Attendee Data collected within the scope of Event registrations, Ticket sales and RSVP transactions.
• Data categories: Identity and contact data (first name, last name, e-mail, mobile telephone), identity number, billing address and, if any, tax number processed on the Loopcode side in paid transactions, and Event-specific form data.
• Categories of data subjects: Buyers, attendees and Users creating an RSVP.
• Purpose: Management and staging of the Event, ticketing, fulfilment of merchant of record obligations and transactional communication.
• Duration: Data is processed for the period required by the purpose of processing and for the mandatory retention periods provided for in the legislation; at the end of the period it is destroyed pursuant to A.6.

A.3. Security measures

Pursuant to Article 12 of the KVKK, each Party takes the necessary technical and administrative measures to ensure an appropriate level of security, in order to prevent the unlawful processing of and unlawful access to the Attendee Data it processes and to ensure its safekeeping. As a minimum, these measures cover the limitation of access rights, the application of appropriate protection methods at the transfer and storage stages, subjecting personnel to confidentiality obligations, and the monitoring of security incidents.

A.4. Sub-processors

The Parties may use sub-processors (data processors) in their processing activities. The principal service providers used on the Loopcode side are as follows:

• Hosting provider: DigitalOcean, LLC
• Server/hosting location (country): Germany (DigitalOcean Frankfurt data centre)
• E-mail/SMS delivery provider: Mailgun (e-mail only; no SMS is sent)
• Video meeting/room provider for online Events: Memeet (memeet.lodos.io; a service within Lodos)
• Payment infrastructure: iyzico (card data is transmitted to iyzico via Loopcode's payment infrastructure and is not stored by Loopcode)

Google Analytics and Google Maps are used for analytics and map services, and Google OAuth for authentication. On the marketing site, cookie preferences are obtained through an accept/reject banner managed by the consent cookie named "lodos-togather-consent". Each Party is responsible for entering into KVKK-compliant contracts with the sub-processors it uses and for the acts of those sub-processors. Where transfer abroad is involved, the transfer is carried out within the framework of Article 9 of the KVKK.

A.5. Data breach notification

Where a breach occurs in relation to Attendee Data processed by a Party (including the unlawful acquisition of data), that Party shall:

a) Take the necessary measures to detect the breach as soon as possible and to limit its effects,

b) Notify the Personal Data Protection Board and, where necessary, the data subjects, pursuant to the KVKK and Board regulations,

c) Where the breach may also affect the other Party's data processing activity, inform the other Party without delay and ensure the necessary coordination.

A.6. Return and destruction of data

Upon termination of this Agreement or where the purpose of processing ceases to exist, each Party shall delete, destroy or anonymise the Attendee Data it processes in accordance with the KVKK and the relevant regulations and with its own retention and destruction policy, subject to the mandatory retention periods provided for in the legislation. The period relating to the retention of data held by Loopcode after account deletion is applied as within 30 days at the latest, subject to data required for legal obligations and potential disputes and to the mandatory retention periods prescribed by the legislation. Upon request, the destruction shall be confirmed in writing.