Privacy Policy

This Privacy Policy explains how your personal data is collected, used, shared, kept and deleted when you use the iTicket website (iticket.com.tr) and the iTicket mobile app for Android and iOS (together, the “Platform”).

The data controller and the developer of the app is İBilet Bilet Dağıtım ve Basım Tic. A.Ş. (“iTicket”). Our full notice under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) is on the Personal Data Protection Notice page. This policy adds to that notice; it does not replace it.

1. Data we collect

Account details

First and last name, email address and phone number. If you choose to enter them: Turkish ID number, date of birth and gender. If you sign in with Google or Apple: the name and email address those services share with us.

Orders and tickets

Tickets and add-ons you buy, amount and payment method, invoice details, ticket transfers and refunds. Card details are never stored by iTicket; they go straight to the payment provider.

Device and usage data

Device model, operating system, app version, IP address, advertising ID, push notification token, interactions in the app and on the site, and campaign link data.

Error and performance logs

Technical records created when the app or the site hits an error.

Support messages

Messages you send us through live support, email or the application form.

Cookies

The cookies used on the website and your choices are explained in our Cookie Policy. Non-essential cookies run only if you allow them.

2. Data that stays on your device

The mobile app uses these permissions only when you allow them. The data they give access to is not sent to our servers:

  • Camera: to scan another user’s QR code when you transfer a ticket.
  • Photos: to read a QR code from a saved picture.
  • Calendar and contacts: to add an event to your calendar and suggest a place.

3. Why we use your data

  • Selling, delivering, transferring and refunding tickets.
  • Managing your account and customer support.
  • Keeping your account and payments secure and preventing fraud.
  • Legal obligations: invoicing, e-tickets, tax and consumer law.
  • Improving the Platform and fixing errors.
  • With your explicit consent: campaign and event announcements (through the Turkish Message Management System, İYS) and personalised advertising.

We process your data on the legal grounds listed in Article 5 of the KVKK: entering into and performing a contract, legal obligation, legitimate interest and, where needed, explicit consent.

4. Who we share it with

We do not sell your personal data. We share it only as far as the service needs:

  • Event organisers: for tickets and entry control.
  • Payment institutions and banks: for payments and refunds.
  • E-ticket and e-invoice service providers and the Turkish Revenue Administration: to issue legal documents.
  • SMS and email service providers: for ticket, order and verification messages.
  • Hosting, content delivery and security providers (e.g. Cloudflare).
  • Google Firebase: app analytics, notifications and remote configuration.
  • Sentry: error logs.
  • Google (Analytics, Tag Manager) and Meta: for measurement and advertising, only if you accept cookies.
  • Google and Apple: if you choose to sign in with them.
  • Public authorities: when the law requires it.

Some of these providers process data outside Türkiye. These transfers follow Article 9 of the KVKK.

5. How long we keep it

We keep your account details while your account is open. Order, invoice and payment records are kept for 10 years from the end of the commercial relationship, as the Tax Procedure Law, the Turkish Commercial Code and related laws require. Data whose period has ended is deleted, destroyed or anonymised. Details are in our Personal Data Retention and Destruction Policy.

6. Deleting your account

You can delete your account in the app or on the website at any time, and you can ask for it to be deleted without having the app installed. The steps, and what is deleted and kept, are on the Delete your account page.

7. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about it, to ask for it to be corrected or deleted, to learn which third parties it was shared with, and to object to its processing. Send your request with the Data Subject Application Form or to [email protected]. Requests are completed within 30 days.

You can change your campaign, SMS and email permissions at any time in the app’s Profile section or on the website’s Account page. You can turn off notifications in your device settings.

8. Security

Data is encrypted in transit (HTTPS) and kept on systems that only authorised staff can access. Account deletion and important account changes are confirmed with a one-time verification code.

9. Contact

İBilet Bilet Dağıtım ve Basım Tic. A.Ş. — [email protected]

10. Changes

When this policy changes, the new version is published on this page.

Last updated: 6 November 2026