Data Processing Agreement

• Controller: the organizer who opens an organization in the app and manages their events with Desdoor (the "Organizer").
• Processor: Raşit Şahin (owner of the Desdoor brand; desdoor.com). Address: Bereketzade Mah. Büyük Hendek Cad. No:11/1 Beyoğlu/İstanbul · E-mail: privacy@desdoor.com ("Desdoor").

This agreement sets out the parties' rights and obligations regarding the personal data the Organizer has Desdoor process for their events (guest lists, tickets, applications, door entry, reports and related records), within the framework of Article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK). It forms an integral part of the Terms of Use; in case of conflict, this agreement prevails as regards personal data.

Desdoor's own account, team, security and public listing (website) activities are not covered by this agreement; for those Desdoor is the controller and the Privacy Policy applies.

Desdoor processes personal data only on the Organizer's instructions and only to provide the service. Instructions are this agreement, the settings and actions the Organizer takes in the app (uploading lists, issuing tickets, approving applications, deleting, exporting, etc.) and their written requests. If Desdoor considers an instruction unlawful, it informs the Organizer and may decline to carry it out.

• To have a valid legal basis for every piece of personal data they collect or upload, and to inform data subjects under Article 10 KVKK (Desdoor shows a short notice on the application form on the Organizer's behalf; this does not replace the Organizer's own obligation).
• To obtain consent compliant with Law No. 6563 from people they send commercial electronic messages to, and to meet the Message Management System (IYS) obligations.
• To decide which team members and door-link holders get access, bind them to confidentiality and remove access when no longer needed; to keep their own devices secure.
• Non-discrimination: to comply with anti-discrimination law, in particular Law No. 6701 on the Human Rights and Equality Institution of Türkiye, when deciding on applications and admitting guests. Desdoor offers no admission or rejection mechanism based on gender or any other ground; gender is recorded for statistics only. The Organizer is responsible for their own admission and rejection decisions.
• To comply with laws on age limits and venues serving alcohol; Desdoor only applies the age limit the Organizer enters.
• Not to write special categories of data, such as health or criminal records, in the blocklist reason field.
• To answer data subjects' requests under Article 11 KVKK and to make notifications to the Board where required.

• Not to use the data for its own purposes, not to sell it, not to share it between organizations (blocklists included), and to use only truly anonymous aggregate figures to improve the product.
• To bind everyone with access to the data to confidentiality.
• To apply the technical and organizational measures in Annex 3 (under Article 12(2) KVKK the parties are jointly responsible for security measures).
• To reasonably assist the Organizer with data subject requests (the deletion, correction and export tools in the app; technical support where needed).
• To provide the information the Organizer needs to meet their legal obligations.

The Organizer gives general authorization to use the sub-processors in Annex 2 to provide the service. Desdoor binds each sub-processor to obligations at least as protective as this agreement. Desdoor notifies the Organizer in the app or by e-mail at least 15 days before adding or replacing a sub-processor. Within that period the Organizer may raise a justified objection based on data protection; if no reasonable solution is found, the Organizer may terminate the agreement for the affected service.

All sub-processors in Annex 2 are outside Türkiye. The Organizer authorizes these transfers. Desdoor carries them out in line with Article 9 KVKK: it obtains the explicit consent of the organizer account and of applicants who fill in the application form, each with a separate checkbox, and records it with its date; establishing the standard contracts announced by the Board or the other appropriate safeguards under Article 9, and making the required notifications, is Desdoor's obligation. For people the Organizer adds itself (guest list, team members), providing the legal basis for the transfer is the Organizer's obligation. The Organizer's authorization does not remove Desdoor's obligation.

The Organizer accepts the default periods below as their instruction; to delete earlier they can use the deletion tools in the app or ask Desdoor.

• Deleted data remains in backups only for the periods above and is used for no other purpose; if a backup is restored, previously deleted records are deleted again.
• Data collected by a feature that is withdrawn (for example the marketing consent list removed in November 2026) is deleted.
• Statutory retention of financial records is the Organizer's responsibility; the Organizer should export what they need before the periods expire.

When Desdoor becomes aware of a security breach affecting the Organizer's data, it informs the Organizer without undue delay and within 24 hours at the latest; the first notice shares what is known at that point and is completed as the investigation progresses, and Desdoor takes the measures needed to limit the harm. Notifying the Board (72 hours) and data subjects is the Organizer's obligation as controller; Desdoor provides the information needed for it.

Desdoor accesses the Organizer's data only when the Organizer's support request, a security incident or a legal obligation requires it — limited to the organization concerned, for the shortest possible time, and logged.

The Organizer may request in writing information and documents showing compliance with this agreement; Desdoor replies within a reasonable time. Audits take into account the security of the service and the confidentiality of other organizers' data.

The agreement takes effect when the Organizer accepts it and remains in force while the organization account is open. When the organization is deleted, all of its data is deleted (backups within the periods in section 7). The Organizer can export their data before deleting. Confidentiality obligations survive termination.

• Each party is liable in proportion to its fault for breaching its own obligations. Consequences of the Organizer's unlawful instructions, of collecting data without a legal basis, or of failing to inform data subjects lie with the Organizer.
• Limitation of liability: without prejudice to intent, gross negligence and mandatory law, Desdoor's total liability under this agreement is limited to the service fees the Organizer paid Desdoor in the 12 months before the event giving rise to the damage.
• Nothing in this agreement excludes liability that cannot be limited by law.

If Desdoor changes this agreement, the new version is shown to the Organizer in the app and acceptance is requested again; until accepted, the previous version applies. The agreement is governed by the laws of the Republic of Türkiye; the courts and enforcement offices of Istanbul have jurisdiction.

Annex 1: Data subjects and data categories

• Data subjects: guests, ticket holders, applicants, people on the blocklist, the Organizer's team members (only as regards activity records).
• Data categories: name; e-mail and phone (in a separate, more restricted record); year of birth (for the age limit); optional Instagram username; ticket and QR data; check-in status and time; gender selected by staff at entry or ticket sale (if the Organizer enabled it); VIP flag; blocklist entry and short reason; activity records.

Annex 2: Sub-processors

Annex 3: Technical and organizational measures

• Role-based access; door staff cannot see contact details or revenue; door links are locked to a single event and time-limited.
• Contact details kept in separate, more restricted records; raw IP addresses are not stored in the application database.
• Encryption in transit; server-side access rules; request verification (App Check).
• Audit log for important settings, team and permission changes.
• Masking of personal data in error logs.
• Guest lists on the device are deleted at sign-out and after the event.
• Backups, restore drills and an incident response process.