SUPPLIER, AGENT, AND OTHER BUSINESS PARTNER PERSONAL DATA DISCLOSURE NOTICE
This disclosure notice has been prepared by COSMIC TICKETS AUDIOS TURİZM VE TİCARET A. Ş. (the “Company”) as the data controller, in accordance with Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and relevant other legislative provisions. In the context of our Company’s activities, the personal data necessary to be collected regarding your status as a supplier or business partner is collected and processed by us in accordance with the relevant legislative provisions and the principles explained below.
1. Method and Legal Basis for the Collection of Your Personal Data
Your personal data is collected by our employees through verbal and written records in physical environments and electronically through channels such as call centers, telephone, fax, email, websites (via email communication forms and technologies like cookies), and instant messaging and video call tools. This data is collected in the form of verbal, written, digital, auditory recordings, and visual recordings. In our Company’s service units, this includes digital visual recordings from security cameras. Data is collected either wholly or partially through automatic means or non-automatic methods, provided that it is part of the data recording system.
In this context, the personal data processed by our Company regarding our suppliers, agents, and other business partners, as well as their authorized representatives or employees, includes: name and surname, Turkish ID number, passport information, address, email address, phone number, real person business/commercial title, tax administration and number, bank account and IBAN numbers, check-bill information, current account information, delivery notes, invoices, payment receipts and slips, including bank and credit card information contained therein, signature data, call center voice recordings, security camera footage taken during entry to and while staying at our workplaces and their extensions, and website IP and cookie information.
In this context, the special category personal data processed by our Company regarding the authorized representatives or employees of our suppliers, agents, and other business partners is biometric data related to video recordings obtained through internet-based platforms used for working via video conferencing. Other special category personal data is not processed by our Company in any way.
The data collected for obtaining your consent for personalized marketing, analysis, and electronic communication is processed based on your explicit consent provided in accordance with Article 5/1 of the KVKK. Data related to security camera footage taken during entry to and while staying at our Company’s workplaces and their extensions is processed due to the necessity of processing data for our Company’s legitimate interests, as outlined in Article 5/2-f of the KVKK. Biometric data related to video recordings obtained through internet-based platforms used during remote work is processed based on your explicit consent in accordance with Article 6/3-a of the KVKK.
Other personal data of yours is processed by our Company based on the legal grounds specified in Article 5/2 of the KVKK and as shown below. Personal data within this scope includes:
- The processing of your personal data is necessary as it is directly related to the establishment or performance of a commercial contract you have with our Company, where your personal data is processed as the other party to the contract.
- When explicitly stipulated by laws or when it is necessary for our Company to fulfill its legal
- When it is necessary for the establishment, use, or protection of a right belonging to our
- When it is necessary for our Company’s legitimate interests, provided that it does not harm your fundamental rights and freedoms.
Collected and processed based on legal grounds.
2. The Purpose and Method of Processing Your Personal Data
The personal data obtained as described above is processed by our Company primarily for the following purposes related to the execution of our domestic and international commercial activities: conducting contract and performance processes; planning and monitoring work with business partners and suppliers; purchasing and marketing of goods and services; post-sales performance and support services; financial and accounting processes; ensuring information and physical security; fulfilling legal processes and regulatory obligations; providing commercial offerings under the best conditions; conducting video conferencing during extraordinary times such as pandemics to ensure uninterrupted operations; improving quality standards; managing market research, analysis, marketing, and digital marketing processes related to our field of activity; sending general or personalized emails, instant messages, and voice calls for activities such as advertising, promotions, proposals, and satisfaction surveys; and monitoring requests and complaints, as well as securing our legal rights for applications and defenses. Your data is processed in connection with the purpose of your relationship with our Company.
The personal data collected by our Company is processed in accordance with the general principles regulated in Article 4 of the KVKK, as specified below.
In this context, your data is:
- Processed in compliance with the law and principles of honesty,
- Accurate and, when necessary, up-to-date,
- Collected for specific, explicit, and legitimate purposes,
- Relevant, limited, and proportionate to the purposes for which it is processed,
- Retained for the duration necessary as stipulated by the relevant legislation or for the purposes for which it is processed.
You can access more detailed information about the processing principles of your personal data shared with our Company in our Company’s “Personal Data Protection and Processing Policy.”
3. Scope, Duration, and Security of the Processing of Your Personal Data
The nature of the processing of your personal data obtained as described above by our Company includes its recording, storage, safeguarding, backing up, modification, reorganization/update, disclosure, transfer, making accessible, classification, or restriction of use both physically and electronically by our relevant departments. It is also limited to the transfer of data to third parties with whom we have a business relationship, as specified below.
Our Company stores all personal data processed in our database, systems, website, or physical environments in accordance with legal regulations, using technological methods and information security standards. In compliance with Article 12 of the KVKK, we take all necessary administrative and technical measures to ensure that data is accurate, up-to-date, secure, and confidential. However, during online purchases and payments on our website, all bank and credit card transactions are conducted online between you and the relevant bank or card issuer independently of our Company. As such, information such as “bank-credit card details or passwords” is not seen or recorded by our Company. Once the reasons for processing your personal data no longer exist or the retention periods specified in the relevant legislation and our Company’s Policy have expired, we will delete, destroy, or anonymize the data either automatically or upon the request of the data subject, in accordance with the relevant legislative provisions and our “Personal Data Retention and Destruction Policy.”
4. To Whom and For What Purposes Your Processed Personal Data May Be Transferred
The personal data collected by our Company may be transferred, as necessary for conducting our commercial activities, to shareholders, relevant departments of the Company, our group companies, business partners, suppliers, service providers, their authorized representatives or employees, relevant bank branches, legally authorized institutions and organizations, and private legal entities. This transfer is carried out in compliance with the conditions and purposes of personal data transfer as specified in Articles 8 and 9 of the KVKK and other relevant legislation. Transfers may occur domestically or internationally as required, and all transfers are made in accordance with applicable regulations.
In this context, auditory and biometric data related to audio and video recordings obtained through internet-based platforms with foreign centers used during video conferencing must also consider the fact that, in accordance with the Personal Data Protection Board’s decision dated 31.05.2019 and numbered 2019/157, personal data transferred via foreign email servers and similar systems are considered to have been transferred abroad.
5. Your Rights Under the KVKK
Under Article 11 of the KVKK, you have the following rights regarding your personal data:
- To learn whether your personal data is being processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
- To know the third parties to whom your personal data has been transferred, whether domestically or internationally,
- To request the correction of your personal data if it is incomplete or incorrect,
- To request the deletion or destruction of your personal data when the reasons for processing it no longer exist, as stipulated in Article 7 of the KVKK,
- To request that the processes carried out in accordance with (d) and (e) be communicated to the third parties to whom your personal data has been transferred,
- To object to the result of processing your data exclusively through automated systems that produces a negative consequence for you,
ı) To request compensation for damages suffered due to unlawful processing of your personal data,
- To withdraw your consent regarding the processing of your personal data and the sending of electronic commercial communications at any time, without providing any reason.
6. How to Apply to Our Company Regarding Your Rights
To exercise your rights mentioned above, you may submit your requests by filling out the “Personal Data Owner Application Form” available on our website www.cosmic-tickets-audios.com/tours in accordance with the “Regulation on the Procedures and Principles for Application to the Data Controller” or by submitting a similar petition in person at our Company’s address: “Gümüşsuyu Mah. İnönü Cad. Melek Apt. No: 11/2 Beyoğlu/İSTANBUL” with identity verification, or through a notary public. Alternatively, you may send an email to “info@cosmic-tickets-audios.com” via registered/secure electronic mail.
Your requests will be processed free of charge as soon as possible and within a maximum of thirty days, depending on the nature of your request. However, if the process incurs additional costs, you may be charged according to the tariff determined by the Personal Data Protection Board.