Personal Data Protection (KVKK) Notice

For the purposes of the KVKK, the controller of your personal data is the legal entity SKYWAY TRAVEL TURİZM SEYAHAT TİCARET LİMİTED ŞİRKETİ (the Company), which operates the RaveHunt brand and platform. Throughout this Notice, RaveHunt refers to the web platform operated by the Company.

Legal name: SKYWAY TRAVEL TURİZM SEYAHAT TİCARET LİMİTED ŞİRKETİ

Address: Cumhuriyet Mah. İstiklal Cad. No: 8, Ürgüp / Nevşehir, Türkiye

Phone: +90 384 341 25 20 · Email: contact@ravehunt.com · Web: ravehunt.com

Tax office and number: Ürgüp Tax Office · 772 068 38 39 · MERSIS No: 0772068383900014

Identity and account data: your name, username, profile information and account preferences.

Contact data: your email address and the content of your communications with us.

Age verification data: your date of birth and the resulting age information (the platform is available only to users aged 18 and over).

Identity provider data: if you choose to sign in with Google or Apple, the authentication information received from those providers (such as the provider account, email and name fields shared with us).

Transaction and ticket data: the event tickets you purchase, QR ticket records, tickets held in your wallet, and records of any free transfers you make to a friend. Selling or reselling tickets is prohibited, and transfers can only be made free of charge.

Loyalty point data: your BPM balance and your point earning and spending activity. BPM is not a currency but solely an in-app loyalty point.

Location data: your optional location information, processed only if you grant location permission on your device, in order to show you nearby events.

Usage and transaction security data: IP address, device and browser information, session and login records, cookie records and log data relating to your use of the platform.

Payment data: payments are carried out through a licensed payment institution. Your card details are not stored by the Company; only limited information necessary for the outcome of the transaction and ticket matching is transmitted to us. Payment integration is being separately implemented, and this Notice may be updated once it is completed.

Creating your membership account, verifying your identity and managing your account.

Selling event tickets, generating QR tickets and enabling the organizer to verify them at the door upon entry.

Operating the RaveHunt platform as an intermediary service provider: events are created and offered for sale by organizers, the seller is the organizer, and the Company (RaveHunt) acts as an intermediary service provider/marketplace and charges a service fee.

Assigning tickets to your wallet and carrying out the free transfer of tickets to a friend.

Awarding and displaying BPM loyalty points and allowing them to be used at events entered with BPM.

Verifying the age limit so that the platform is offered only to users aged 18 and over.

Conducting payment and invoicing processes together with the licensed payment institution.

Preventing fraud, ticket resale and misuse and ensuring the security of the platform and transactions.

Responding to requests, complaints and support enquiries and communicating with you.

Fulfilling legal obligations arising from applicable legislation (including tax, commercial recordkeeping, distance sales and, where required, providing information to competent authorities).

Being directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c): membership, ticket purchase, assignment of tickets to the wallet and their free transfer, and operation of BPM points rely on this ground.

Being expressly provided for by law and necessary for the controller to fulfil a legal obligation (KVKK Art. 5/2-a and 5/2-ç): requirements of tax, commercial and distance sales legislation.

Processing being mandatory for the establishment, exercise or protection of a right (KVKK Art. 5/2-e): dispute and claim processes.

The legitimate interests of the controller, provided they do not harm your fundamental rights and freedoms (KVKK Art. 5/2-f): platform security, prevention of fraud and resale, and improvement of services.

Your explicit consent (KVKK Art. 5/1): processing of optional location data, commercial electronic message/marketing preferences and certain cases in which data may be transferred abroad rely on explicit consent. Where processing is based on consent, you may withdraw it at any time.

Note: Because event tickets relate to an entertainment service to be provided on a specific date, they fall within the services that constitute an exception to the right of withdrawal under distance sales legislation; the related records are processed and retained for the performance of the contract and as required by law.

Your personal data is collected through the RaveHunt web platform via account creation and profile forms, Google or Apple sign-in, ticket purchase and transfer transactions, BPM point activity, your support requests, and log and cookie records generated automatically as you use the platform.

Your location data is collected only if you grant the relevant permission on your device. The service is currently offered only over the web and no mobile application is yet available; the collection methods will be updated in this Notice when a mobile application is released.

Your personal data may be transferred to the following recipient groups, limited to the purposes above and in accordance with the conditions in Articles 8 and 9 of the KVKK:

Payment institutions: to licensed payment service providers, for the collection of the ticket price and the secure completion of the payment transaction.

Organizers: to the organizer of the relevant event, with only the minimum information necessary, so that the validity of the ticket you purchased can be verified at entry (door/QR check).

Hosting and infrastructure providers: to our cloud/infrastructure service providers, chiefly Supabase, for the secure storage of data and the operation of the platform.

Identity providers: to Google or Apple, where you choose to sign in with them, in order to carry out the authentication process.

Competent authorities and legal advisors: to fulfil obligations arising from legislation and to protect rights, limited to such requests and legal requirements.

Your personal data is not sold to third parties for marketing purposes outside the purposes set out in this Notice.

Because the hosting infrastructure (for example Supabase) and the Google and Apple identity providers may operate servers located abroad, your personal data may be transferred abroad in order to provide these services.

Such transfers are carried out under Article 9 of the KVKK, either on the basis of your explicit consent or by applying the safeguarded transfer mechanisms provided for in the law (an adequacy decision, appropriate safeguards, or the applicable exceptions). You may request detailed information about the legal basis of the transfer.

Your personal data is retained for the period necessary for the purpose for which it is processed, taking into account the statutory limitation periods and retention obligations set out in applicable legislation (for example the periods under tax and commercial law).

Records relating to your account, ticket and BPM transactions are kept for as long as your account is active and thereafter for the applicable legal retention periods. Once these periods expire, your personal data is deleted, destroyed or anonymized.

RaveHunt is intended only for users aged 18 and over. Age is verified through the date of birth declared during registration, and the platform is not intended for use by persons under 18.

If we become aware that data belonging to a person under 18 has been processed inadvertently, we will remove the relevant account and data as required. If you notice such a situation, you may contact us at contact@ravehunt.com.

The Company takes the necessary technical and administrative measures to ensure an appropriate level of security, in order to prevent the unlawful processing of and unauthorized access to your personal data and to ensure its safekeeping.

These measures include access authorization, restriction of data access based on roles, encryption in transit and at rest, maintenance of session and login records, and contractual arrangement of data processing obligations with the providers from whom we obtain services.

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

Learn whether your personal data is being processed and, if so, request information about it.

Learn the purpose of processing and whether the data is used in accordance with that purpose.

Know the third parties to whom the data has been transferred, domestically or abroad.

Request the correction of your data where it has been processed incompletely or inaccurately.

Request the deletion or destruction of your data within the conditions set out in the KVKK and related legislation.

Request that correction, deletion and destruction actions be notified to the third parties to whom the data was transferred.

Object to a result arising against you due to the analysis of your data exclusively through automated systems.

Request compensation for any damage you suffer as a result of the unlawful processing of your data.

You may submit your requests under Article 11 of the KVKK to the data controller in writing together with information verifying your identity, or through the other methods designated by the Personal Data Protection Board, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Your applications will be concluded free of charge as soon as possible and in any event within thirty (30) days at the latest, depending on the nature of the request; if the process requires an additional cost, the fee in the tariff set by the Board may be charged.

Contact and application channels: SKYWAY TRAVEL TURİZM SEYAHAT TİCARET LİMİTED ŞİRKETİ · Cumhuriyet Mah. İstiklal Cad. No: 8, Ürgüp / Nevşehir, Türkiye · Phone: +90 384 341 25 20 · Email: contact@ravehunt.com