KVKK privacy notice

This notice is for everyone who uses Superevent or whose records are kept through Superevent: organizers who run events and their team members, people who join events with a QR code or join code (including those who join by invitation, such as speakers, jury members, booth staff and sponsors), people who apply to the partner program, visitors to superevent.io and anyone who writes to us through the contact form or live support.

Superevent is a product name. The business that provides the service, referred to in this notice as "we" or the data controller, is:

Our position regarding your personal data depends on the purpose of the processing and on whose behalf it is done.

• Data we control. Your Superevent account (name, email, phone, password), the event and billing details you give as an organizer, purchase and payment records, partner applications, support and live support conversations, the contact form, website visits and records kept for the security of the service. We decide for what purpose and how this data is processed.
• Data we process on behalf of organizers. Attendee records entered in Superevent for an event or created in Superevent during an event: registration and check-in details, questions, poll and voting responses, jury scores, questions asked to the event assistant, gallery photos and face matching data, certificates, matchmaking profiles and lead records. The data controller for these records is the organizer running the event. We process this data only on the organizer's instructions and to provide the service.

Data we process as a data controller:

• Identity and contact: first name, last name, email address, phone number.
• Account and transaction security: an irreversible hash of your password, verification codes, session and device details, IP address, login and activity records.
• Event and team: the name, date and venue of the events you create and the organizer contact details; team invitations and roles.
• Purchases and billing: billing name, Turkish ID or tax number, tax office, address, the modules ordered, order and payment status, and the time and IP address of the agreement approval. Card details never reach Superevent; they are entered on the payment institution's page.
• Partner program: the identity, contact, tax and bank details in the application form; referral and commission records.
• Support and contact: the content of your message and the event or organization name you give.
• Superevent Assistant usage: the messages you write to the organizer assistant, its replies, the actions you approve and your monthly usage count.
• Marketing consent: your email and SMS preferences, if you gave consent.
• Cookies: session and preference data; analytics data if you consent (cookie policy).

As a data processor, depending on the modules the organizer turns on, we process the following attendee data: the device-bound attendee session; details in the registration form (for example name, email, organization) and check-in records; submitted questions, poll and voting responses, jury scores; questions asked to the event assistant; certificate and attendance document details; matchmaking profiles and meeting requests; QR badge details scanned at booths and booth staff notes; in live translation, the speaker's audio and, if the organizer turns it on, the transcript.

Biometric data. In the AI Photo Gallery, a face vector is created from an attendee's selfie only with their explicit consent. The selfie is not kept after matching. Face vectors are used only within that event, to find the attendee's own photos; they never appear in reports, exports or assistant replies.

As a data controller, we process your data on the following grounds listed in KVKK art. 5:

• Establishing and performing a contract (art. 5/2-c): opening an account and logging in, managing events and teams, purchases, payment and invoicing, running the partner program, answering support requests, and mandatory service notifications.
• Legal obligation (art. 5/2-ç): keeping records required by tax and commercial legislation, and requests from authorized institutions.
• Establishing, exercising or protecting a right (art. 5/2-e): records that must be kept as evidence in case of a dispute.
• Legitimate interest (art. 5/2-f): account and service security, preventing misuse, fixing bugs, and improving the service through aggregate usage measurements that don't identify individuals.
• Explicit consent (art. 5/1): sending commercial electronic messages and optional analytics cookies. You can withdraw your consent at any time.

For attendee records we process as a data processor, the purpose and legal ground are set by the organizer (for example, registration and entry control, issuing certificates, in-event interaction). The organizer is responsible for informing its attendees and, where necessary, obtaining their explicit consent. The biometric data processed in face matching is special category personal data under KVKK art. 6; it is processed only with the attendee's explicit consent, which is recorded with its version on a Superevent screen on the organizer's behalf.

Your data is collected, by automated or partly automated means, from you through the superevent.io website, the web dashboard, the mobile app, attendee screens, the contact form, live support and email; from attendee records organizers enter or import in the dashboard; from payment results returned by payment institutions; and from SMS providers' delivery reports.

Personal data is shared only as far as necessary and limited to the purpose, with the following groups of recipients:

• Server, database, file storage, backup and email delivery service providers.
• Payment institutions for purchase payments (iyzico; Stripe if the foreign card option is on).
• SMS delivery service providers; for SMS sent on an organizer's behalf, the SMS account the organizer connects.
• Apple and Google notification services, to deliver mobile notifications.
• AI service providers: speech recognition, translation and speech synthesis in live translation; a language model for assistant replies. Only the content needed to fulfil the request concerned (for example the speaker's audio, the text to translate, the question asked) is sent. Selfies and face vectors are not sent to these providers.
• Recipients the organizer chooses, depending on the modules it turns on (for example the exhibitor whose staff scan a visitor's QR badge in the lead capture module, or a sponsor viewing its sponsor report). The organizer is the data controller for these transfers.
• Public institutions authorized by law and, in case of a dispute, our legal advisers.

Some of these providers may have servers abroad; where the service will be hosted will be stated in this notice before the live service starts. Transfers abroad are made in line with KVKK art. 9: to countries with an adequacy decision, with appropriate safeguards such as the standard contracts announced by the Board, or in the incidental transfer cases listed in the law.

• Account, purchase and billing records: for the duration of membership and, after it ends, for the period required by tax and commercial legislation.
• Security and access records: for the period required by the relevant legislation.
• Support and contact conversations: for a reasonable period after the request is resolved, for possible disputes.
• Attendee records: for the retention period set for the event; when that period ends, when the event is deleted or when the organizer requests it, they are deleted or anonymized, subject to statutory retention obligations.
• Face vectors: deleted immediately when the attendee asks, and automatically at the latest when the retention period after the event ends; deletion also covers matches in photos.
• Live translation: the speaker's audio is not recorded by default; a transcript is kept only if the organizer turns it on in the event settings.
• Marketing consent: until it is withdrawn.

Under KVKK art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it has been transferred; to request its correction if it is incomplete or inaccurate, its deletion or destruction when the legal conditions are met, and notification of these actions to the third parties to whom it was transferred; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can submit your application to info@superevent.io from the email address registered to your account, or in writing to Ahmet Aksungur (Aksungur Yazılım), Karşıyaka Mah. 3923 Sk. Tez Apt. No: 2 İç Kapı No: 1 Kepez / Antalya. Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board.

You can delete your Superevent account yourself in the account settings in the app; records subject to statutory retention obligations are kept for that period. You can withdraw the explicit consent you gave for face matching at any time and delete your face data from the gallery screen.

This notice is updated when necessary. The current version is published on this page; the "Last updated" date at the top of the page applies.