KVKK Disclosure Statement

1. Identity of the Data Controller

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by KALKAN DİJİTAL PLATFORM E-TİCARET LİMİTED ŞİRKETİ (“Atolira” or the “Company”) in the capacity of data controller.

Trade name: KALKAN DİJİTAL PLATFORM E-TİCARET LİMİTED ŞİRKETİ

Address: Yakuplu Mah. Hürriyet Bul. Skyport Sitesi Skyport Residence No: 1 İç Kapı No: 151, Beylikdüzü 34520 Istanbul, Turkey

E-mail: info@atolira.com

Phone: 0850 303 81 02 

Tax No: 4931528768

MERSIS No: 0123119987300001

2. Scope of the Clarification Text

This text covers visitors to the atolira.com website, registered users, non-member guest users who create event/workshop participation registrations, workshop/event participants offered by Atolira, those who contact customer service, those who grant newsletter or commercial communication permissions, and those who submit requests via Atolira support channels.

3. Categories of Personal Data That May Be Processed

  • Identity data: name, surname, and other identity information necessary according to the nature of the transaction.

  • Contact data: e-mail address, phone number, communication and support correspondence.

  • Customer transaction data: Participation registration, reservation/session, event information, number of participants, cancellation/refund/postponement requests, workshop preferences, campaign and transaction history.

  • Financial data: The amount regarding the completion of the payment transaction, transaction/reference/registration number, refund information, and billing data. Credit/debit card numbers, expiration dates, and CVC/CVV security codes are strictly not recorded and stored by Atolira. Payment transactions are carried out directly with the relevant financial institution with 3D Secure assurance via the infrastructure of BRSA (BDDK) licensed payment institutions and/or authorized virtual POS providers.

  • Transaction security data: IP address, session information, log records, device/browser information, security and fraud prevention records.

  • Legal transaction data: request, complaint, warning, dispute, official institution correspondence, and legal process records.

  • Marketing data: commercial communication permission, newsletter subscription, campaign interaction, preference, and permission records.

  • Visual and audio data: Covers photographs, videos, and audio recordings taken during events. This data is processed based on the legal reason of the specific activity and, if legally required, the explicit consent to be obtained from the relevant person.

  • Request/complaint and support data: Contents submitted via live support (chat), support tickets, contact forms, e-mail, and the user panel; registration cancellation, refund, and date change requests submitted via Atolira support/communication channels or system automation, along with the correspondence and transaction (log) records related to these.

4. Special Categories of Personal Data

Processing of special categories of personal data is not intended for Atolira's ordinary registration and reservation activities. However, in the event that the declaration of health data is needed regarding the security of participation in a specific workshop or event (for example, food, botanical, audio/light sensitivities, or physical disability conditions in areas such as gastronomy tastings, plant/soil workshops, yoga/sports effort, theater/roleplay activities); the principle of data minimization is observed, only the necessary data is processed, and the appropriate current processing condition stipulated in Article 6 of the KVKK is relied upon. In cases where explicit consent must be relied upon, explicit consent is obtained separately from the KVKK clarification text.

5. Methods of Collecting Personal Data

Personal data may be collected wholly or partially by automatic means or non-automatic means provided that it is a part of a data recording system, via the website and mobile-compatible interfaces, membership and guest payment forms, registration and reservation modules, payment and refund processes, e-mail, live support, contact forms, customer service, group event applications, cookies and similar technologies, social media interactions, and other physical or electronic channels permitted by legislation.

6. Purposes of Processing and Legal Reasons

Processing Purpose Main Data Categories Main Legal Reason
Membership, guest checkout, creation of participation registration, and performance of service Identity, contact, customer transaction KVKK Art.5/2-c – establishment or performance of the contract
Payment, refund, billing, and accounting Finance, customer transaction, identity KVKK Art.5/2-a and ç – legal obligation / statutory obligation
Customer support, request, and complaint management Contact, customer transaction, legal transaction KVKK Art.5/2-c, e, and f
Information security, logging, and fraud prevention Transaction security, customer transaction KVKK Art.5/2-ç, e, and f
Execution of legal disputes and official institution requests Legal transaction, identity, contact, customer transaction KVKK Art.5/2-a, ç, and e
Execution of event operation Identity, contact, customer transaction KVKK Art.5/2-c and f
Newsletter, campaign, advertising, and personalized marketing Contact, marketing, cookie data Explicit consent and/or other applicable legal condition according to the relevant activity; commercial electronic communication permissions are managed separately
Statistics, analysis, and service development Transaction security, usage/cookie data Legitimate interest according to the nature of the data or explicit consent if necessary
Use of event visual and audio recordings in promotion Visual/audio data Legal reason specifically determined according to the concrete activity; separate explicit consent where necessary

7. Explicit Consent and Commercial Communication

Within the scope of KVKK, the clarification obligation and explicit consent processes are separate from each other. Reading the clarification text or granting consent for marketing activities that are not mandatory for the provision of the service is not made a condition for benefiting from the basic service. Commercial electronic communication permissions are obtained separately and can be withdrawn in accordance with the relevant legislation. For marketing and analytical cookies, a separate selection option is offered via the cookie preference panel to the extent necessary.

8. Domestic Transfer of Personal Data

Your personal data may be transferred to the following third parties domestically in accordance with the personal data processing conditions specified in Article 8 of the KVKK and only to the extent required by the purpose of processing (in line with the data minimization principle):

  • Instructors and Field Officials in Charge: To the instructors and officials assigned by Atolira in accordance with data minimization principles for the purposes of verifying the created participation registration, creating event area entrance/participant lists, and carrying out physical/digital participation attendances,

  • Financial Institutions and Payment Providers: To BRSA (BDDK) licensed payment institutions, virtual POS providers, and banks for the secure completion of payment and refund transactions,

  • Financial and Legal Consultants: To financial advisors, authorized integrators, and legal consultants for the purposes of legal accounting processes, e-document/e-invoice issuance, and performance of legal obligations,

  • Technical and Operational Service Providers: To information technology and support service providers for the purposes of maintaining the website infrastructure, e-mail transmission, and carrying out customer support processes,

  • Public Institutions and Organizations: To authorized administrative and judicial authorities and legally authorized public institutions in line with legal obligations and official requests.

9. International Transfer of Personal Data

In the event that the data centers of the cloud server, e-mail transmission, analytics, customer communication, security, or similar technical service providers used by Atolira while providing its platform infrastructure are located abroad, your personal data may be transferred abroad. Such transfers are carried out in accordance with the current Article 9 of the KVKK, within the framework of an adequacy decision, appropriate safeguards, or incidental transfer cases regulated in the Law, limited only to technical obligations and the requirements of the service.

10. Retention Periods and Destruction

Personal data is kept for the period required by the relevant processing purpose and the minimum retention periods stipulated in the relevant legislation. While determining the period, the type of transaction, continuation of the contractual relationship, tax and trade legislation, consumer transactions, dispute limitation periods, information security requirements, and legal obligations of the data controller are taken into consideration. When the purpose of processing and the legal reason cease to exist, the data is deleted, destroyed, or anonymized in the first periodic destruction period.

11. Data Security

  • Authorization and access controls, strong password, and account security practices

  • SSL/TLS and appropriate encryption methods

  • Logging, security monitoring, and unusual transaction detection

  • Data security and confidentiality obligations with service providers

  • Not collecting unnecessary data and limiting access to duty

  • Backup, incident response, and data breach procedures

  • Acting in accordance with the KVKK notification periods in force upon learning of a personal data breach

12. Rights of the Relevant Person within the Scope of KVKK

Pursuant to Article 11 of the KVKK, relevant persons have the rights to learn whether their personal data is processed, to request information if processed, to learn the purpose of processing and whether it is used appropriately, to know the third parties to whom it is transferred domestically or abroad, to request the correction of incompletely or incorrectly processed data, to request its deletion or destruction if the conditions are met, to request the notification of these operations to third parties to whom the data has been transferred, to object to a result against them arising exclusively from analysis by automatic systems, and to demand the compensation of the damage due to unlawful processing.

13. Application Procedure to the Data Controller

Requests within the scope of KVKK can be transmitted in writing, via registered electronic mail (KEP), secure electronic signature, mobile signature, or the e-mail address previously notified to Atolira by the relevant person and registered in the Atolira system. Applications are concluded as soon as possible and within 30 days at the latest, depending on the nature of the request.

  • Postal/hand delivery address: Yakuplu Mah. Hürriyet Bul. Skyport Sitesi Skyport Residence No: 1 İç Kapı No: 151, Beylikdüzü 34520 Istanbul, Turkey
  • E-mail: info@atolira.com

14. Data Regarding Children

In workshops and events aimed at children, personal data relating to the child is processed only to the extent necessary for the performance of the service and safe participation. Depending on the age and nature of the event, parent/guardian information and consent may be requested. Collecting data from children for direct marketing purposes and unnecessary profiling activities are avoided.

15. Update and Enforcement of the Text

Atolira may update this Clarification Text depending on changes in legislation, Board decisions, technical infrastructure, or data processing activities. The current text enters into force on the date it is published on atolira.com.