Personal Data Protection (KVKK) Notice

For the purposes of the KVKK, the controller of your personal data is the legal entity TripsTerra LLC (the Company), which operates the RaveHunt brand and platform. Throughout this Notice, RaveHunt refers to the platform operated by the Company, that is, the ravehunt.com website together with the RaveHunt mobile app.

Legal name: TripsTerra LLC

Address: 1007 North Orange Street, Wilmington, DE 19801, United States

Email: contact@ravehunt.com · Web: ravehunt.com

Identity and account data: your name, username, profile information and account preferences.

Contact data: your email address and the content of your communications with us.

Age verification data: your date of birth and the resulting age information (the platform is available only to users aged 18 and over).

Identity provider data: if you choose to sign in with Google, the authentication information received from Google (such as the provider account, email and name fields shared with us).

Transaction and ticket data: the event tickets you purchase, QR ticket records, tickets held in your wallet, and records of any free transfers you make to a friend. Selling or reselling tickets is prohibited, and transfers can only be made free of charge.

Loyalty point data: your BPM balance and your point earning and spending activity. BPM is not a currency but solely an in-app loyalty point.

Location data: your optional location information, processed only if you grant location permission on your device, at two levels. Coarse location (city and country) is kept on your profile in order to show you nearby events and is not shown to other users. Precise location (latitude and longitude) is taken only while an event you have checked in to is running, is kept for at most one hour attached to that event, and is shown, for the in-event friends map, to your mutual friends and, if you opted into 'nearby', to attendees who have checked in to the same event.

Usage and transaction security data: IP address, device and browser information, session and login records, cookie records and log data relating to your use of the platform.

Payment data: payments are carried out through our payment services provider, Stripe. At the payment step you enter your card details into the payment form served by Stripe; those details never reach the Company's servers and are not stored by the Company. Only limited information necessary for the outcome of the transaction and ticket matching is transmitted to us.

Creating your membership account, verifying your identity and managing your account.

Selling event tickets, generating QR tickets and enabling the organizer to verify them at the door upon entry.

Operating the RaveHunt platform as an intermediary service provider: events are created and offered for sale by organizers, the seller is the organizer, and the Company (RaveHunt) acts as an intermediary service provider/marketplace and charges a service fee.

Assigning tickets to your wallet and carrying out the free transfer of tickets to a friend.

Awarding and displaying BPM loyalty points and allowing them to be used at events entered with BPM.

Showing you nearby events and sorting your feed by the city you are in (coarse location).

Running the in-event friends map: while an event you have checked in to is running, showing your precise location, on the basis of your explicit consent, to your mutual friends and, if you opted into 'nearby', to attendees who have checked in to the same event. You can switch this sharing off in Settings at any time.

Verifying the age limit so that the platform is offered only to users aged 18 and over.

Conducting payment and invoicing processes together with the payment services provider.

Preventing fraud, ticket resale and misuse and ensuring the security of the platform and transactions.

Responding to requests, complaints and support enquiries and communicating with you.

Fulfilling legal obligations arising from applicable legislation (including tax, commercial recordkeeping, distance sales and, where required, providing information to competent authorities).

Being directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c): membership, ticket purchase, assignment of tickets to the wallet and their free transfer, and operation of BPM points rely on this ground.

Being expressly provided for by law and necessary for the controller to fulfil a legal obligation (KVKK Art. 5/2-a and 5/2-ç): requirements of tax, commercial and distance sales legislation.

Processing being mandatory for the establishment, exercise or protection of a right (KVKK Art. 5/2-e): dispute and claim processes.

The legitimate interests of the controller, provided they do not harm your fundamental rights and freedoms (KVKK Art. 5/2-f): platform security, prevention of fraud and resale, and improvement of services.

Your explicit consent (KVKK Art. 5/1): processing of optional location data, commercial electronic message/marketing preferences and certain cases in which data may be transferred abroad rely on explicit consent. Where processing is based on consent, you may withdraw it at any time.

Note: Because event tickets relate to an entertainment service to be provided on a specific date, they fall within the services that constitute an exception to the right of withdrawal under distance sales legislation; the related records are processed and retained for the performance of the contract and as required by law.

Your personal data is collected through the RaveHunt platform (the ravehunt.com website and the RaveHunt mobile app) via account creation and profile forms, Google sign-in, ticket purchase and transfer transactions, BPM point activity, your support requests, and log and cookie records generated automatically as you use the platform.

Your location data is collected only if you grant the relevant permission on your device. The mobile app is a shell that opens the same platform on your device, so the data collected and the methods of collection are the same on the website and in the app.

Your personal data may be transferred to the following recipient groups, limited to the purposes above and in accordance with the conditions in Articles 8 and 9 of the KVKK:

Payment services provider: to Stripe, so that the ticket price can be collected and the payment transaction completed securely. The data transferred are the order amount, the currency, the order and event references, and your email address, so that the payment receipt can be delivered to you. Your card details are entered directly into Stripe's payment form and do not reach the Company.

Organizers: to the organizer of the relevant event, with only the minimum information necessary, so that the validity of the ticket you purchased can be verified at entry (door/QR check).

Other users: the precise location you share while an event is running is shown to your mutual friends and, if you opted into 'nearby', to attendees who have checked in to the same event. Your profile and the content you share on the platform are likewise visible to other users within your visibility settings.

Hosting and infrastructure providers: to our cloud/infrastructure service providers, chiefly Supabase, for the secure storage of data and the operation of the platform.

Identity provider: to Google, where you choose to sign in with it, in order to carry out the authentication process.

Content safety (moderation) provider: the images you share and the text you write (post and story captions, comments and messages) are transferred to OpenAI's content moderation service to be classified automatically before they go live. The purpose is to stop clearly harmful content (such as child sexual abuse material, threats, hate and violence) from being published and to keep the platform safe; all we receive back is the categories flagged, which we record for human review.

Email delivery provider: to Resend, your email address and the content of the message sent to you (including the QR-coded PDF attached to a ticket email), so that your ticket, account and transaction emails can be delivered.

Competent authorities and legal advisors: to fulfil obligations arising from legislation and to protect rights, limited to such requests and legal requirements.

Your personal data is not sold to third parties for marketing purposes outside the purposes set out in this Notice.

Because the hosting infrastructure (for example Supabase), the Google identity provider, the payment services provider Stripe, the content moderation provider OpenAI and the email delivery provider Resend operate servers located abroad, your personal data is transferred abroad in order to provide these services.

Such transfers are carried out under Article 9 of the KVKK, either on the basis of your explicit consent or by applying the safeguarded transfer mechanisms provided for in the law (an adequacy decision, appropriate safeguards, or the applicable exceptions). You may request detailed information about the legal basis of the transfer.

Your personal data is retained for the period necessary for the purpose for which it is processed, taking into account the statutory limitation periods and retention obligations set out in applicable legislation (for example the periods under tax and commercial law).

Records relating to your account, ticket and BPM transactions are kept for as long as your account is active and thereafter for the applicable legal retention periods. Once these periods expire, your personal data is deleted, destroyed or anonymized.

RaveHunt is intended only for users aged 18 and over. Age is verified through the date of birth declared during registration, and the platform is not intended for use by persons under 18.

If we become aware that data belonging to a person under 18 has been processed inadvertently, we will remove the relevant account and data as required. If you notice such a situation, you may contact us at contact@ravehunt.com.

The Company takes the necessary technical and administrative measures to ensure an appropriate level of security, in order to prevent the unlawful processing of and unauthorized access to your personal data and to ensure its safekeeping.

These measures include access authorization, restriction of data access based on roles, encryption in transit and at rest, maintenance of session and login records, and contractual arrangement of data processing obligations with the providers from whom we obtain services.

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

Learn whether your personal data is being processed and, if so, request information about it.

Learn the purpose of processing and whether the data is used in accordance with that purpose.

Know the third parties to whom the data has been transferred, domestically or abroad.

Request the correction of your data where it has been processed incompletely or inaccurately.

Request the deletion or destruction of your data within the conditions set out in the KVKK and related legislation.

Request that correction, deletion and destruction actions be notified to the third parties to whom the data was transferred.

Object to a result arising against you due to the analysis of your data exclusively through automated systems.

Request compensation for any damage you suffer as a result of the unlawful processing of your data.

You may submit your requests under Article 11 of the KVKK to the data controller in writing together with information verifying your identity, or through the other methods designated by the Personal Data Protection Board, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Your applications will be concluded free of charge as soon as possible and in any event within thirty (30) days at the latest, depending on the nature of the request; if the process requires an additional cost, the fee in the tariff set by the Board may be charged.

Contact and application channels: TripsTerra LLC · 1007 North Orange Street, Wilmington, DE 19801, United States · Email: contact@ravehunt.com