Privacy Policy

1. Data Controller

This Privacy Policy explains our practices concerning personal data processed within the scope of the event and community management and ticketing services offered through the Gathin platform (web: gathin.com).

Pursuant to Law No. 6698 on the Protection of Personal Data (the "KVKK"), the data controller is Loopcode Bilişim Yazılım Mühendislik Eğitim ve Danışmanlık A.Ş. ("Loopcode" or the "Company"), which operates the Gathin platform and acts in the capacity of merchant of record for paid tickets.

The identity and contact details of the data controller are as follows:

• Trade name: Loopcode Bilişim Yazılım Mühendislik Eğitim ve Danışmanlık A.Ş.
• Registered address: Yavuz Sultan Selim Mah. Dr. Sadık Ahmet Cad. No:24 İç Kapı No:1, Fatih/İstanbul, Türkiye
• MERSIS No: 0609 0927 8100 0001
• Trade Registry No / Office: 189875-5 (Istanbul Trade Registry Office)
• Tax Office and Tax Identification No (VKN): Fatih Tax Office, VKN: 6090927810
• KVKK / legal contact e-mail: info@loopcode.co

In this Policy, "User" means the natural person using Gathin; "Organiser" means the User staging the event; "Buyer" means the User purchasing the ticket; and "Event" and "Ticket" mean the service managed and sold through the platform and the related right of attendance. The Organiser is the party staging the event; it is not the seller of the ticket. For paid tickets, the party that sells the ticket in its own name, issues the document to the Buyer and collects the price is Loopcode.

2. Personal Data Processed

Depending on the nature of the service and the User's interaction with the platform, Loopcode processes the following categories of personal data.

2.1. Account and Registration Data

First name, last name, e-mail address and password. The password is stored in irreversibly hashed form; it is not kept in plain text.

2.2. Profile Data

Biography, first name, last name, telephone number, avatar (profile image), social media links, country and username information provided by the User at their option.

2.3. Data Collected at the Payment Step

During the purchase of a paid ticket, the following are collected from the Buyer: first and last name, e-mail address, mobile telephone number, identity number for paid tickets, billing address and, if any, tax number. This data is necessary in order to issue valid documentation and to fulfil fiscal legislation obligations.

Card details (card number, expiry date, security code) are transmitted to iyzico via Loopcode's payment infrastructure for the purpose of executing the payment transaction; they are not recorded or stored by Loopcode. Transmission takes place over an encrypted connection (TLS), and payment is carried out through the iyzico infrastructure with 3D Secure verification. Loopcode has access to data such as the transaction reference and status information relating to the payment result.

Amounts are collected by default in Turkish Lira (TL/TRY); they may also be collected in US Dollars (USD) and Euros (EUR). VAT is applied at the rate in force (the general rate is 20%); certain events may be subject to a different or zero rate under the legislation. Whether the price is displayed inclusive or exclusive of VAT may be determined by the Organiser.

2.4. User-Generated Content (UGC)

Photographs uploaded to community photo galleries, likes and the tagging of other users in photographs; forum messages, Organiser announcements, form responses, event and community descriptions and content shared on user profiles. Such content may contain personal data about other users (for example, visual data or identity information by way of tagging). Where content uploaded or shared by the User contains personal data belonging to third parties, the User is responsible for informing those persons and obtaining the necessary consents.

2.5. Communication and Marketing Data

The contact details required in order to send transactional messages (ticket/RSVP confirmation, the reminder sent 24 hours before an event, saved event reminders), together with records relating to the User's communication and notification preferences. Communication preferences are managed within the platform. Marketing messages are not currently sent by telephone/SMS; when commercial electronic messages begin to be sent, these will be carried out subject to the User's explicit consent and through the Message Management System (İYS). Loopcode Bilişim Yazılım Mühendislik Eğitim ve Danışmanlık A.Ş. sends marketing and promotional emails about its own products Lodos.io, Lodos Nova, Gathin and Yeşilçam Studios (newsletters, new feature and campaign announcements, event and community promotions) only if you have consented to marketing communications; you can withdraw your consent at any time. Even without consent, emails required for the service are sent: password reset and verification codes, tickets you have bought and information about those events (reminders, date and venue changes), purchase confirmations and invoices, subscription and payment notices, security and account notices, and notices of changes to our terms. You can unsubscribe from all of our emails in one step using the link at the bottom of every email; once you do, no emails other than password reset emails will be sent to you.

2.6. Usage and Transaction Records (Logs)

Technical records generated automatically during use of the platform: IP address, date-time stamp, device and browser information, session information, and records of pages clicked and transactions performed.

2.7. Cookie Data

Data collected through cookies for the operation of the platform and for optional analytical purposes. For details, see section 9 of this Policy and the Cookie Policy.

2.8. Visitor and Session Analytics Data

Separately from Google Analytics, the Platform operates its own first-party visitor and session analytics. This analytics, which also covers visitors who are not logged in, consists of two layers.

a) Data processed independently of cookie consent (legitimate interest, Article 5/2-f of the KVKK; Article 6(1)(f) GDPR):

• Session identifier (togather_analytics_session_id, session storage / sessionStorage): deleted when the browser tab is closed,
• Page views (address of the pages visited), session duration, online status and time data,
• The IP address and browser identifier (user-agent) in the session record, and the country derived from them,
• Device information: device and platform type, browser type, language and app version,
• Entry source: utm parameters, the ref parameter and only the domain name of the referring site; these are recorded only in the first record of a session,
• Interface interactions: for example which feature was used or that a button was clicked. These records do not contain free text, search content, names, email addresses or payment details; for searches, only numeric information such as character length is kept.

b) Data processed subject to cookie consent (explicit consent):

• Persistent device identifier (gathin_aid, local storage / localStorage): used to recognise a visitor returning from the same device. It is created only when "accept" is chosen in the cookie consent banner and is deleted when consent is withdrawn.

Linking to the account. When the User logs in, the analytics records of that session (including the persistent device identifier, if consent was given) are linked to the User's account.

Share links. The ?ref= value in share links carries the public profile username of the person who shared the link; visits and sign-ups arriving through that link are attributed to the person who shared it, in order to measure the effect of shares and invitations.

Organisers are provided only with aggregate traffic statistics relating to their own Event and community pages (number of unique visitors/sessions, device distribution and timeline); the analytics transferred to Organisers does not include IP addresses, browser identifiers (user-agent) or device identifiers, and no individual visitor identity is shared. The retention and de-identification of analytics data are explained in Section 6.

2.9. Error Monitoring Data

To keep the platform working and to find and fix faults, some technical information is recorded automatically when an error occurs:

• the type and technical details of the error,
• the address of the page where it happened (with secret link codes and credentials masked),
• your browser and operating system,
• the app version,
• the technical steps just before the error,
• your user number, if you are signed in.

Your name, email address, phone number and payment details are not included. A note you send through the report form on an error page is stored with that record. This data is kept on an error-monitoring server operated by Loopcode in DigitalOcean's Amsterdam (Netherlands) data centre and is not passed to any other error-monitoring service. Error monitoring does not use cookies. Error records are kept for at most 90 days and technical error logs for at most 30 days, then deleted automatically. The legal basis is our legitimate interest in providing a secure, working service (Article 5/2-f of the KVKK; Article 6(1)(f) GDPR).

3. Purposes of Processing Personal Data

Personal data is processed for the following purposes:

• Creating the User account, authentication and account management (including sign-in with Google OAuth),
• Providing event and community management services and carrying out RSVP and attendance transactions,
• Executing the sale transaction for paid tickets, collecting the price, issuing documentation to the Buyer and managing the transfer of the price to the Organiser,
• Sending transactional messages relating to ticket, RSVP and event reminders,
• Carrying out commercial electronic messaging and marketing communication subject to explicit consent,
• Operating user content features such as community photo galleries, forums, forms and announcements,
• Ensuring the security of the platform and preventing misuse and fraud,
• Detecting and fixing errors on the platform,
• Improving the product by measuring feature usage,
• Measuring the effect of shares and invitations,
• Measuring and improving service quality; operating first-party visitor and session analytics, providing Organisers with aggregate traffic statistics relating to their own pages, and carrying out optional (Google Analytics) analytical activities,
• Fulfilling fiscal, commercial and legal obligations and meeting obligations to provide information and documents to authorised institutions and organisations,
• Assessing requests and complaints and carrying out support processes.

4. Legal Grounds for Processing

Personal data is processed on the basis of the following legal grounds set out in Articles 5 and 6 of the KVKK.

Without requiring explicit consent, pursuant to Article 5/2 of the KVKK:

• Expressly provided for by law (Art. 5/2-a): identity number, billing address and documentation data collected within the scope of fiscal legislation and retention obligations,
• Establishment or performance of a contract (Art. 5/2-c): account creation, ticket sales, RSVP and attendance transactions and the sending of transactional messages,
• Compliance with a legal obligation (Art. 5/2-ç): issuing documentation, keeping fiscal records and providing information to authorised institutions,
• Where data processing is mandatory for the establishment, exercise or protection of a right (Art. 5/2-e),
• Legitimate interests of the data controller (Art. 5/2-f): ensuring platform security, preventing misuse, error monitoring, operating first-party visitor and session analytics (Section 2.8/a) and improving the service.

On the basis of explicit consent, pursuant to Article 5/1 of the KVKK:

• Sending commercial electronic messages, using analytical cookies for marketing purposes and processing optionally provided profile data for these purposes,
• Creating and using the persistent device identifier (gathin_aid) (cookie consent; see Section 2.8/b).

Pursuant to Article 6 of the KVKK:

• Where photographs and similar content uploaded within the scope of user content contain special categories of personal data, such data is processed on the basis of the explicit consent of the data subject.

In processing based on explicit consent, the User may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent up to the moment of withdrawal.

5. Transfer of Personal Data

Personal data may be shared with the following parties, limited to the achievement of the purposes stated above and to the relevant legal grounds:

• iyzico: for the purpose of executing the payment transaction, 3D Secure verification and processing card data,
• Organiser: for the purpose of sharing attendee list, RSVP, ticket and form submission information within the scope of the relevant event and community management. If you attend an Event (RSVP), purchase a ticket or submit a form belonging to a community, you will be made a member of that community if you are not already a member. Where an Event is organised collaboratively by more than one community, since those communities are joint organisers of the event, your attendance at the event constitutes interaction with all of those communities; membership and the associated data transfer arise for all of those communities on the legal grounds of performance of the contract and legitimate interest. Each Organiser bears separate responsibility in its own processes in respect of the data transferred to it,
• Google Analytics: for the purpose of optional analytical measurement,
• Google Maps: for the purposes of location and map display services,
• Hosting provider: for the purposes of storing data and operating the platform (DigitalOcean, LLC),
• E-mail/SMS delivery provider: for the purpose of transmitting transactional messages and messages subject to explicit consent (Mailgun (e-mail only; no SMS is sent)),
• Video meeting/room provider: for the purpose of running online events (Memeet — memeet.lodos.io; a service provided within Lodos),
• Authorised public institutions and organisations: for the purpose of fulfilling obligations arising from the legislation to provide information and documents.

Location of the servers hosting personal data: Germany (DigitalOcean Frankfurt data centre) and the Netherlands (DigitalOcean Amsterdam data centre). Error-monitoring records are kept in the Amsterdam data centre.

The infrastructure of some of the providers listed above may be located abroad. In that case, transfer abroad is carried out within the framework of the conditions provided for in Article 9 of the KVKK, on condition that an adequacy decision exists or, in the absence of an adequacy decision, that the appropriate safeguards set out in the Law (such as standard contracts or undertakings) are provided, or that the exceptional circumstances provided for in the Law or explicit consent exist.

6. Retention Periods

Personal data is retained for as long as is necessary for the purpose for which it is processed and for the minimum periods prescribed by the relevant legislation. Where the purpose ceases to exist and the statutory retention periods expire, the data is deleted, destroyed or anonymised.

• Fiscal and commercial records (invoices, documents and accounting records): legally 10 years pursuant to the relevant legislation,
• Account and profile data: for as long as the account is active,
• Transaction and traffic records (logs): for the periods prescribed by the relevant legislation,
• Visitor and session analytics records (including IP address and browser identifier): kept as business records for measuring, securing and improving the service, for as long as necessary for that purpose. Where the account is deleted, analytics records linked to the account are de-identified within 30 days of deletion: the link to the account, the IP address, the browser identifier and the device identifier are removed from the records, and the remaining data is used only as statistics that cannot be linked to a person,
• Error records: at most 90 days; technical error logs: at most 30 days (deleted automatically at the end of the period),
• Where the account is deleted, the retention period for data other than that required in respect of legal obligations and potential disputes: within 30 days at the latest, subject to data required for legal obligations and potential disputes and to the mandatory retention periods prescribed by the legislation.

7. Data Security

Loopcode takes technical and administrative measures pursuant to Article 12 of the KVKK in order to prevent the unlawful processing of and unlawful access to personal data and to ensure the safekeeping of the data. In this scope, measures such as the use of 3D Secure at the payment step, encrypted communication during transmission (TLS), storage of passwords in irreversibly hashed form, restriction of access rights, operation of authorisation and logging mechanisms, and the establishment of confidentiality and data security undertakings with suppliers are applied. Card details are not stored by Loopcode; payment is carried out through the iyzico infrastructure using encrypted communication (TLS) and 3D Secure verification.

8. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, the User has the following rights in relation to themselves by applying to the data controller:

• To learn whether their personal data is processed,
• To request information if their personal data has been processed,
• To learn the purpose of processing and whether the data is used in accordance with that purpose,
• To know the third parties to whom the data is transferred domestically or abroad,
• To request rectification where the data has been processed incompletely or inaccurately,
• To request the erasure or destruction of the data within the framework of the conditions provided for in Article 7 of the KVKK,
• To request that rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred,
• To object to a result arising against the person themselves through the analysis of processed data exclusively by automated systems,
• To claim compensation for damage suffered as a result of the unlawful processing of the data.

How requests relating to these rights are to be submitted is explained in section 12 of this Policy and in the KVKK Privacy Notice.

9. Cookies

On the marketing site, a cookie consent banner is presented which governs whether Google Analytics is activated; cookie use may be accepted or rejected through this banner. The User's cookie preference is stored in the consent cookie named "lodos-togather-consent". While strictly necessary cookies are used for the core functions of the platform, analytical cookies are activated only subject to the User's approval. The Platform's first-party visitor and session analytics, however, is independent of this cookie consent and is based on legitimate interest (see Section 2.8/a); the only exception is the persistent device identifier gathin_aid, which is created in local storage only when cookie consent is given (see Section 2.8/b). Withdrawing consent also deletes this identifier. Detailed information about the types, purposes and management of cookies is set out in the Cookie Policy.

10. Children's Privacy

Gathin is not directed at persons under the age of 16, and personal data is not knowingly collected from such persons. Any person using the platform declares that they have completed the age of 16. If it is determined that personal data belonging to a person under the age of 16 is being processed, such data is deleted without delay. Anyone who identifies such a situation may contact Loopcode through the contact channels in section 12 of this Policy.

11. Changes

Loopcode may update this Privacy Policy in line with changes in legislation, updates to services or developments in business processes. The current text is published on gathin.com together with its effective date. For material changes requiring the User's explicit consent, consent is obtained separately. The update date shown at the beginning of the text indicates the date of the most recent change.

12. Contact and Applications

The User may submit requests relating to their rights under Article 11 of the KVKK and questions about this Policy to Loopcode through the following channels:

• KVKK / legal contact e-mail: info@loopcode.co
• Support e-mail: info@loopcode.co
• Registered address: Yavuz Sultan Selim Mah. Dr. Sadık Ahmet Cad. No:24 İç Kapı No:1, Fatih/İstanbul, Türkiye

Applications are assessed and concluded in accordance with the procedures and periods provided for in the Communiqué on the Procedures and Principles of Application to the Data Controller. The channel for submitting misuse or content complaints: info@loopcode.co. For detailed information regarding the processing of personal data, the KVKK Privacy Notice may be consulted.