As HY OFİS YAZILIM BİLİŞİM TURİZM SEYAHAT ve TİC. LTD. ŞTİ. (“MetaBilet”), we place the utmost importance on the protection of your personal data.
This Personal Data Protection and Processing Policy explains how personal data is collected, processed, and safeguarded in accordance with the Law on the Protection of Personal Data (Law No. 6698 – KVKK).
By visiting MetaBilet.com or using our mobile applications, you acknowledge and accept the terms of this policy.
1. Purpose and Scope of the Policy
Under the Personal Data Protection Law (KVKK), personal data refers to any information relating to an identified or identifiable natural person.
According to the KVKK, the person or legal entity that determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system is called the “Data Controller.”
For the purposes of the KVKK, our company acts as the Data Controller.
This document (“Policy”) has been prepared to inform individuals whose personal data is processed by our company, in accordance with Article 10 of the KVKK.
MetaBilet reserves the right to update this Policy at any time in line with amendments to the applicable legislation.
2. Methods and Legal Grounds for Collecting Personal Data
MetaBilet collects personal data through:
- The www.metabilet.com website
- Mobile applications
- Social media accounts
- Cookies (browser data)
- Call center interactions
- Official notifications from administrative or judicial authorities
- Commercial communications (business cards, proposals, CVs, etc.)
Personal data may be collected physically or electronically, face-to-face or remotely, verbally, in writing, or electronically, in accordance with the data processing conditions defined in the KVKK and for the legal reasons stated in this Policy.
The following legislation serves as the legal basis for data collection:
- Law No. 6698 – Law on the Protection of Personal Data (KVKK)
- Law No. 6563 – Law on the Regulation of Electronic Commerce
- Law No. 5237 – Turkish Penal Code
- Law No. 6502 – Law on Consumer Protection and the Distance Sales Regulation
3. Purposes of Processing Personal Data
As a rule, personal data cannot be processed without the explicit consent of the data subject.
MetaBilet may process your personal data to the extent permitted by law for the following purposes:
- To verify the identity of the person purchasing the ticket
- To record necessary contact and address information
- To fulfill obligations arising from Distance Sales Agreements
- To create documents and records that serve as the basis of the transaction
- To comply with legal obligations and respond to official requests for public security
- To enhance customer satisfaction and provide personalized campaigns and notifications
- To conduct marketing activities and organize surveys
- To evaluate customer complaints and requests
- To ensure employee entitlements and manage employment relationships
Sensitive personal data (e.g., race, ethnicity, political opinion, religion, or health information) may only be processed with explicit consent of the individual or under conditions permitted by the KVKK and with additional safeguards required by the Personal Data Protection Board.
4. Legal Rights and Obligations of the Company
MetaBilet processes personal data in accordance with Article 20 of the Constitution and Article 4 of the KVKK, adhering to the following principles:
- Lawful and fair processing
- Accuracy and up-to-date maintenance
- Specific, explicit, and legitimate purposes
- Relevance, limitation, and proportionality to the purpose
- Retention for the necessary period only
Security Measures
As the Data Controller, MetaBilet applies the following measures:
Technical Measures:
- SSL encryption (256-bit RSA),
- Data encryption systems,
- Penetration tests,
- Access authorization matrices.
Administrative Measures:
- Employee training,
- Access restrictions,
- Secure storage of physical records in locked cabinets.
Data is deleted, destroyed, or anonymized once the legal retention period expires.
5. Rights of Data Subjects
According to Article 11 of the KVKK, data subjects have the right to:
- Learn whether their personal data is being processed,
- Request information regarding the processing of their data,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know third parties to whom data is transferred domestically or abroad,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction of personal data,
- Object to results arising from automated data analysis,
- Demand compensation if they suffer damages due to unlawful data processing.
To exercise these rights, you may contact us at [email protected].
6. Transfer of Personal Data
MetaBilet does not share personal data with third parties without consent, except under the following conditions:
- With bus companies for trip operations,
- With banks and payment service providers for transaction processing,
- With official authorities upon legal requests,
- With business partners, solution partners, and service providers within the scope of cooperation.
Transfer of personal data abroad is permitted only to countries recognized as “safe” by the Personal Data Protection Board (KVKK).
Transfers to non-safe countries are allowed only with adequate protection commitments and the Board’s approval.
7. Categories of Personal Data
Customer Information:
Name, surname, Turkish ID number, email, phone, location, date of birth, ticket PNR code, billing details, membership info, password, IP address, call center records, cookies, campaign participation, complaints, and requests.
Job Applicant Information:
Resume, application details, interview notes, and test results.
Employee Information:
Personnel file details, onboarding documents, payroll, and benefit data.
8. Data Controller and Contact Information
Data Controller / Company Title:
HY OFİS YAZILIM BİLİŞİM TURİZM SEYAHAT ve TİC. LTD. ŞTİ.
Tax Office / No: 19 Mayıs VD. – 4651604353
Trade Registry No: 38685
MERSİS No: 046516043530001
E-mail: [email protected]