Privacy Notice (KVKK)
This is a translation. The Turkish version prevails.
Seller details
- Trade name
- To be provided by the venue
- Brand
- Petro
- MERSİS no.
- To be provided by the venue
- Tax office
- To be provided by the venue
- Tax no.
- To be provided by the venue
- Professional chamber
- To be provided by the venue
- Address
- İskenderpaşa Mah. Sıramağazalar Cd. No:5/E, 61000 Ortahisar/Trabzon
- KEP address
- To be provided by the venue
- To be provided by the venue
- Phone
- +90 539 637 61 61
- ETBİS registration
- To be provided by the venue
This is a translation. If it differs from the Turkish version, the Turkish version prevails.
This notice explains, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), how we process your personal data when you open an account or book a ticket or a table on the Petro website. It is information only; you are not asked to approve it. Your optional permission for marketing messages is covered by a separate text (the “Commercial Electronic Messages Consent”).
1. Data controller
The data controller is the seller that operates Petro. The seller’s details are shown at the top of this page.
2. Data we process
| Category | Data |
|---|---|
| Identity | Full name, date of birth |
| Contact | E-mail address, mobile phone number |
| Customer transactions | Your account, language preference, ticket and table bookings (event date, number of tickets, table, amount, status), ticket codes and QR codes |
| Finance | Payment record: amount, date, result, the payment institution’s transaction number, card brand and last 4 digits |
| Legal transactions | The texts you accepted (pre-information form, distance sales contract, 18+ declaration), text version, date and time, and a keyed hash of your IP address |
| Security | An irreversible hash of your password (the password itself is not stored), the session cookie, server logs kept for security |
| Marketing | Only if you give permission: your marketing permission and its grant/withdrawal records |
Your card number, expiry date and security code (CVC) are entered on the payment institution’s page. Petro does not receive or store them. No identity documents, photos or special categories of personal data (such as health or biometric data) are collected through this website.
3. Purposes and legal grounds
| Purpose | Data | Legal ground (KVKK art. 5/2) |
|---|---|---|
| Opening your account and signing you in; concluding and performing your ticket or table booking (ticket and QR code, check at the door, notice of changes or cancellation) | Identity, contact, customer transactions | Conclusion and performance of a contract (c) |
| Checking that you are 18 or older on the event date | Date of birth | Legal obligation (ç): persons under 18 may not be admitted to venues serving alcohol; also performance of the contract (c) |
| Taking payment and making refunds | Finance, customer transactions | Performance of the contract (c), legal obligation (ç) |
| Issuing invoices, keeping distance-sales and e-commerce records for the statutory periods, answering requests from competent authorities | Identity, contact, customer transactions, finance, legal transactions | Expressly provided by law (a), legal obligation (ç) |
| Proving the texts you accepted and your transactions; protecting our rights in a dispute | Legal transactions, customer transactions | Establishing, exercising or protecting a right (e) |
| Protecting the site and accounts against misuse (session management, rate limiting, error logs) | Security | Legitimate interest (f) |
| Sending you event and campaign news (SMS, e-mail) | Contact, marketing | Only your explicit consent (KVKK art. 5/1); see the separate text |
Messages required for your booking (ticket, payment result, postponement or cancellation of the event) are not marketing and do not depend on marketing permission.
4. Who receives your data
- Payment institution (licensed under Law No. 6493): your name, e-mail, phone, order number and amount, to take payment and make refunds. Legal ground: performance of the contract.
- Accountant and e-invoice/e-archive provider: the data needed to issue an invoice. Legal ground: legal obligation.
- Hosting and technical service providers: only on our behalf and on our instructions, as data processors.
- Message Management System (İYS): if you give marketing permission, your phone number or e-mail and your permission record. Legal ground: legal obligation.
- Competent public authorities (courts, police, Ministry of Trade, tax offices): only when required by law.
We do not sell your data or share it with anyone for advertising. Your personal data is not transferred abroad.
5. How we collect data
We collect your data electronically, by automated means: the information you enter in the sign-up and booking forms, the payment result sent to us by the payment institution, the session cookie and server logs.
6. Cookies and similar technologies
The site uses only one strictly necessary cookie (petro_session), set when you sign in. It keeps you signed in and is deleted after 30 days or when you sign out. No analytics, advertising or third-party cookies are used. Your browser’s session storage holds a flag with no personal data so that the opening animation is shown only once.
Map, Instagram and WhatsApp links open those services only when you tap them; from then on, that service’s own privacy rules apply.
7. Retention periods
| Data | Period |
|---|---|
| Ticket, booking and payment records, accepted texts | 10 years from the transaction (Law No. 6563 art. 11; also the Turkish Commercial Code No. 6102 and Tax Procedure Law No. 213) |
| Unpaid or expired bookings | 1 year |
| Account data | While your account is open; after closure it is deleted except for the statutory records above. Accounts not used for two years are closed after notice by e-mail |
| Marketing permission and withdrawal records | 3 years from the end of the permission |
| Server logs kept for security | Up to 90 days |
When a period ends, the data is deleted or anonymised within three months at the latest.
8. Your rights
You have the rights listed in Article 11 of the KVKK; for example, to learn whether your data is processed, to request information, to have incomplete or incorrect data corrected or, where the conditions are met, deleted, to learn who received your data, to object to a result against you based solely on automated processing, and to claim compensation for damage caused by unlawful processing.
9. How to apply
You can send your request in writing (with a wet signature) to the seller’s address, to the seller’s KEP (registered e-mail) address, or by e-mail from the address registered in our system to the seller’s e-mail address. Please include your full name, Turkish ID number (for foreigners: nationality and passport number), your address for notices, your e-mail and phone if any, and your request. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Board.