Privacy Notice on the Processing of Personal Data
The binding and authoritative version of this document is Turkish. This English translation is provided for information purposes only. The operator is a legal entity established in Türkiye, billing is processed in Turkish Lira (TRY), and this relationship is governed by Turkish law. In case of any discrepancy, the Turkish text and Turkish law shall prevail.
Last updated: 27 June 2026
Effect:This notice has been prepared to inform data subjects who use the Eventmakerapp service pursuant to Art. 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
1. Identity of the Data Controller
Pursuant to Art. 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in the capacity of data controller:
- Title: Bilcod Web Teknolojileri Ticaret Limited Şirketi (“Bilcod”, “we”)
- MERSİS No: 0170064768600001
- Tax Office / Tax No: Kadıköy V.D. / 1700647686
- Registered Address: Rasimpaşa Mah. Nüshetefendi Sk. Dursun Genç İş Blok No:50 İç Kapı No:8, 34714 Kadıköy / İstanbul
- KEP (Registered E-mail) Address: bilcod@hs01.kep.tr
- Phone: +90 216 706 07 16
- E-mail: info@bilcod.com
Eventmakerapp (“Platform”) is a software service for corporate event organizers that produces, based on uploaded venue images and an event brief, AI-powered layout designs, photorealistic visuals (renders) and itemized proposals (PDF).
Method of collecting the data: Your account is mostly created by your own registration (self-service). However, your account may also have been created by an administrator authorized by your organization (within the scope of the service agreement entered into with the data controller) or by Bilcod, based on your name, surname and e-mail address. This processing relies on the legal grounds of Art. 5/2-(c) of the KVKK (performance of a contract) and Art. 5/2-(f) (legitimate interest); explicit consent is not required for account creation. For operations requiring the transfer of data abroad (render and proposal generation), your explicit consent is obtained separately and solely from you upon your first login; these functions cannot be used without giving this consent.
2. Categories of Personal Data Processed
Within the scope of your use of the Platform, the following personal data of yours is processed:
| Category | Data Processed |
|---|---|
| Identity | Name, surname |
| Contact | E-mail address |
| Customer / Transaction | Company (organization) name, account registration information |
| Transaction Security | Account password (hashed irreversibly by our cloud infrastructure provider; it is not visible to us as plain text), approval timestamps and the IP address at the moment of approval (for proof of explicit consent) |
| Visual Records | Venue photographs you upload to the Platform (these visuals may, under your responsibility, contain images/personal data belonging to individuals) and the render visuals generated from them |
| Usage | Usage statistics such as the number of events/proposals/renders generated |
| Finance / Payment | Plan purchased, order/transaction amount (TRY), collection date, invoice information, payment status and the transaction/result data returned from the payment institution. Card number, CVV and expiry date are not processed or stored by us; this data is processed directly at the payment institution (PayTR). |
| Stored Card (Tokenization) | For auto-renewing (recurring) subscriptions, the payment token generated by the payment institution for periodic collection — which does not contain the actual card number — together with the masked information that only enables recognition of the card (e.g. last 4 digits, card brand). This processing is carried out only for users who approve the recurring plan and the card storage authorization. |
Note: At the moment you give explicit consent/approval, your IP address together with the approval timestamp is recorded for the purpose of proving the validity of the consent (Art. 3 and Art. 12 of the KVKK). This record is kept solely for the purpose of proving consent and for account security, and is not used for marketing purposes.
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes, each constituting a separate purpose:
- Creating your membership account, verifying identity and ensuring account security,
- Providing the AI-supported layout, render and proposal (PDF) service based on the venue image and brief you upload,
- Operating and improving the service, troubleshooting errors/faults and managing usage capacity (usage statistics),
- Sending you mandatory notifications relating to the service (transactional e-mails: account confirmation, password reset, service notices),
- Fulfilling our legal obligations, managing requests and complaints, and presenting evidence in disputes,
- Carrying out the sale of paid plans/credits, collecting payment and fulfilling invoicing obligations,
- For auto-renewing subscriptions, carrying out periodic collection via the stored card (token) based on your explicit approval, and subscription management (renewal, cancellation, plan change),
- Ensuring payment security and managing error/dispute/refund (chargeback) and fraud processes.
4. Legal Grounds for Processing Personal Data (Art. 5 of the KVKK)
Your personal data is processed, depending on the relevant purpose, relying on the following legal grounds:
- Art. 5/2-(c) – Establishment/performance of a contract: Account creation, identity/contact data, provision of the service based on the uploaded image and brief (render + proposal generation).
- Art. 5/2-(ç) – Legal obligation: Retention, notification and response obligations arising from legislation.
- Art. 5/2-(f) – Legitimate interest: Service security, prevention of misuse, service improvement through usage statistics (provided this does not harm your fundamental rights and freedoms).
- Art. 5/1 – Explicit consent: The transfer abroad that is mandatory for processing the images you upload relies on this legal ground in cases where your explicit consent is deemed necessary.
- Payment and subscription (additional): Purchase, payment collection, invoicing and recurring period collections rely on Art. 5/2-(c) (performance of a contract) and Art. 5/2-(ç) (retention of invoice/financial records — Turkish Tax Procedure Law (VUK), Turkish Commercial Code (TTK)); payment security and fraud/chargeback prevention rely on the legitimate interest under Art. 5/2-(f). The infrastructure for periodic collection via a stored card (token) relies on the separate and explicit automatic-collection/card-storage instruction you give at the payment step; the card data itself is not held by us — only the token generated by the payment institution and the masked information are stored at the payment institution.
Special-category data warning: The Platform does not aim to process special-category personal data (health, biometric, religion, etc.). Should the venue images you upload contain data such as the face/image of third parties, obtaining the necessary permissions from those persons (Art. 6 of the KVKK and, where required, explicit consent) is the responsibility of the data subject/user. Please upload venue images that, as far as possible, do not contain individuals.
5. Transfer of Personal Data and Transfer Abroad (Art. 8 and Art. 9 of the KVKK)
In order for the service to be provided technically, your personal data is transferred to our authorized data processor service providers. Some of these service providers are established abroad (primarily the USA):
| Recipient Category | Subject of Processing | Location | Data Transferred |
|---|---|---|---|
| Cloud infrastructure / database and file storage service provider | Database and file (image) storage, hosting | USA / abroad | Account data, uploaded images, render images |
| AI image (render) generation service provider | AI-powered generation of photorealistic visuals (renders) | USA | Venue images, brief data |
| AI text generation and image analysis service provider | Text/proposal generation and visual content analysis | USA | Brief text, image content, proposal data |
| Application hosting service provider | Serving the application and traffic management | USA / abroad | Data within the scope of application traffic |
| Payment institution (PayTR Ödeme Hizmetleri A.Ş.) | Payment collection via 3D Secure, stored card (tokenization) and recurring collection | Turkey | Payment/transaction data, invoice information, card processing data (including card number — only at the payment institution) |
Payment and collection operations are carried out by PayTR Ödeme Hizmetleri A.Ş., a payment institution established in Turkey and subject to the supervision of the BDDK (Banking Regulation and Supervision Agency). Your card information is not transmitted to the Platform; within the scope of Art. 8 of the KVKK it is transferred to this domestically established payment institution. For auto-renewing subscriptions, upon your explicit instruction your card is stored as a token on PCI-DSS compliant infrastructure; we only access the token, which does not contain the actual card number, and the masked information.
The recipients above are the authorized data processors we use in order for the service to be provided technically, and are stated on a category basis. The up-to-date and specific (commercial-title-level) list of the service providers to whom transfers are made is provided, for data subjects, upon application, and for our corporate customers within the scope of the data processing agreement (DPA) entered into, upon request.
Render and proposal generation functionally require the transfer of the venue image and brief data to these service providers abroad; the service cannot be provided without this transfer.
Legal basis for the transfer (Art. 9 of the KVKK):Pursuant to Art. 9 of the KVKK as amended by Law No. 7499, for transfers abroad the following apply in order of priority: (i) an adequacy decision, (ii) appropriate safeguards (a standard contract approved by the Board or binding corporate rules), (iii) incidental/exceptional cases (explicit consent). Since the USA is not on the Board's adequacy decision list, for these continuous transfers an appropriate safeguard mechanism (standard contract) is being established by us; until this mechanism is completed and/or in exceptional cases, the transfer is carried out relying on your explicit consent within the scope of Art. 9/6 and Art. 5/1 of the KVKK. You may withdraw your explicit consent at any time, knowing that this will result in the suspension of the service's abroad component.
6. Retention Periods
| Data | Retention Period |
|---|---|
| Account and contact data | For as long as your membership continues; when membership ends, it is deleted/anonymized at the end of the statute-of-limitations periods set out in the relevant legislation |
| Uploaded images and renders | Depending on the period you keep/delete them in your account; subject to the deletion/anonymization procedure upon account closure |
| Approval timestamps (proof of consent) | For the duration of the relevant legal statute of limitations |
| Usage statistics | Membership + statute of limitations for as long as it contains attributable personal data; anonymous thereafter |
| Payment/invoice and financial transaction records | For the duration of the book/document retention periods under the Turkish Tax Procedure Law (VUK) and the Turkish Commercial Code (TTK) (as a rule, 10 years) |
| Stored card token and recurring instruction | For as long as the subscription is active and the auto-renewal authorization has not been withdrawn; after cancellation/withdrawal it is deleted at the payment institution |
At the end of the period, your personal data is deleted, destroyed or anonymized pursuant to Art. 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
7. Your Rights as a Data Subject (Art. 11 of the KVKK)
As a data subject, you have the following rights:
- To learn whether your personal data is being processed,
- To request information about it if it has been processed,
- To learn the purpose of processing and whether it is used in accordance with its purpose,
- To know the third parties to whom it is transferred domestically/abroad,
- To request its correction if it has been processed incompletely/incorrectly,
- To request its deletion/destruction within the framework of Art. 7 of the KVKK,
- To request that the correction/deletion operations be notified to the third parties to whom it was transferred,
- To object to a result arising against you as a result of analysis carried out exclusively by automated systems,
- To request compensation for the damage in the event that you suffer harm due to unlawful processing.
8. How to Apply
To exercise the rights above, you may submit your request, together with information confirming your identity, through the following channels pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller:
- E-mail: info@bilcod.com (please clearly state the subject of your application)
- Written / KEP: Rasimpaşa Mah. Nüshetefendi Sk. Dursun Genç İş Blok No:50 İç Kapı No:8, 34714 Kadıköy / İstanbul / bilcod@hs01.kep.tr
Your application will be concluded within 30 days at the latest; should the operation additionally entail a cost, the fee in the tariff determined by the Board may be charged. Should you not be satisfied with the response, you may lodge a complaint with the Personal Data Protection Board (kvkk.gov.tr).
9. Updates
This Privacy Notice is updated when necessary; the current version is always published on this page. The effective date is stated at the beginning of the notice.
Full binding text (Turkish): https://www.etkinlikstudyo.com/kvkk.