1.Data Controller
The data controller is APOLLO PARKS EĞLENCE ETKİNLİK VE ORGANİZASYON HİZMETLERİ LİMİTED ŞİRKETİ (hereinafter “Apollo Park” or “we”).
Head office and correspondence address: Küçükbakkalköy Mah. Selvili Sk. No: 4 İç Kapı No: 20, Ataşehir / İstanbul
E-mail: info@apollopark.tr · Registered e-mail (KEP): apolloparks@hs03.kep.tr
MERSIS number: 0071106179400001 · Website: apollopark.tr
Park address: Gaziantep Botanical Garden, Gazi Mah., Zübeyde Hanım Blv. No: 45, Şehitkamil / Gaziantep. You can send requests concerning your personal data to our head office address above or through our electronic communication channels.
2.Ticket Purchase and Payment
We process the contact and order details you provide at purchase, the ticket type and number, the QR code, the payment status and the ticket usage information in order to issue the ticket, check the right of entry and carry out any changes or refunds. The legal basis is the conclusion and performance of a contract [KVKK Art. 5/2(c)].
We retain the data required for invoicing and accounting in order to fulfil our legal obligations [Art. 5/2(ç)]. In the event of a dispute, we may also process the necessary data to exercise and protect our rights [Art. 5/2(e)].
The person who buys the ticket and the visitor may be different people. For tickets not issued in a name, we do not ask for the name of each visitor. Buying a ticket does not mean subscribing to our newsletter.
3.Personalised Season Pass
The Season Pass is personal and non-transferable. At purchase, the first name and surname of the person who will use each pass must be provided. This rule also applies to passes bought for children. We link the name to the pass, its QR code, its validity period and its entry records.
A photo ID must be shown at entry. Our staff compares the name on the document with the details on the pass, and the photo with the person entering. We only check the document visually; we do not copy it, photograph it or record its number. We do not use facial recognition.
If the pass user is a party to the contract, the legal basis for the check and the necessary data processing is the performance of the contract [Art. 5/2(c)]. If the pass was bought for another person, we rely on our legitimate interest in preventing misuse [Art. 5/2(f)]. We limit the check to the necessary data, respecting the rights of the pass user. We do not ask for a separate signature for this.
4.Communication and Website Security
When you write to us, we use your contact details, your message and the related order information to reply. For purchase-related matters the legal basis is the performance of the contract [Art. 5/2(c)]; for other requests it is our legitimate interest in providing customer service [Art. 5/2(f)]. For requests concerning personal data and requests from competent authorities, we fulfil our legal obligations [Art. 5/2(ç)].
For website security, we process the necessary IP address, access time, technical logs and error logs on the basis of our legitimate interest in preventing misuse and ensuring continuity of service [Art. 5/2(f)]. Cookies and similar technologies are explained in a separate notice.
5.Where We Obtain Data and Whom We Share It With
We obtain data from online forms, purchase and box office transactions, ticket checks and the requests you send us. For passes bought for someone else, the buyer provides the name. Information on payment and refund status comes from the payment service provider. Data is processed electronically, by fully or partly automated means; in written transactions we also process paper documents included in our filing system.
Ticketing service providers receive the necessary data to issue and check tickets, banks and payment service providers for payments and refunds, and IT service providers for hosting and communication services, to the extent appropriate to their tasks. We share the data needed for accounting obligations with our accountant. In legal matters we transfer the necessary data to our legal representative and, where legally required, to the competent authorities. Transfers within Türkiye are based on Article 8 of the KVKK and on the legal bases stated above for the relevant purpose.
| Service | Service provider or data |
|---|---|
| Ticketing system provider | Taaf Media — development and maintenance of the apollopark.tr ticket sales, box office and entry control system. |
| Payment service provider | Sipay Elektronik Para ve Ödeme Hizmetleri A.Ş. (online payments); for card payments at the box office POS terminal, the relevant bank. |
| Payment data passed to Apollo | Payment result, amount, order and transaction number, masked card number (first 6 and last 4 digits) and refund status. Card details are sent only to the payment service provider for the payment; Apollo Park does not store the full card number, expiry date or security code (CVV). |
| Hosting and e-mail service provider | Hostinger International Ltd. — website, ticketing system, database and e-mail service (servers in Germany; see section 6). |
6.Transfers Abroad
For transfers of data abroad, the conditions of Article 9 of the KVKK also apply. Information on the services, recipients and safeguards concerned:
| Service and recipient abroad | Country, data transferred and purpose | Legal safeguard for the transfer |
|---|---|---|
| Hosting and e-mail — Hostinger International Ltd. | Germany (Frankfurt data centre). Data processed on the website, in the ticketing system and in the e-mail service (contact, order, ticket, entry, correspondence and technical records); hosting and operation of the website, the ticketing system and e-mail. | To be completed by Apollo Park. |
7.How Long We Keep Data
We keep data for as long as necessary to carry out the relevant transaction or to fulfil our legal obligations. We use the name linked to a pass for entry checks during the pass’s validity period; after that we keep only the data required by a continuing retention purpose. Visually checking an ID document does not create a separate copy of the document or a database of ID documents.
| Data category | Retention period and start |
|---|---|
| Ticket, order and entry information | From 11 November 2026. We keep order records and commercial documents evidencing the sale for 10 years from the end of the calendar year in which they were created. We delete or anonymise detailed entry records within 90 days after the ticket’s validity ends; data needed to prove performance or for a specific legal proceeding is retained. |
| Pass user’s name and pass details | From 11 November 2026. We process the data in active entry control records during the pass’s validity period, then delete or anonymise it within 90 days. Data contained in documents that evidence the sale and must be retained is kept until the retention period of the relevant document ends. |
| Invoices and accounting documents | From 11 November 2026. 10 years from the end of the calendar year in which the document was created. |
| Customer service correspondence | From 11 November 2026. We keep correspondence about general information requests for 1 year after the matter is concluded. Correspondence concerning a purchase, contract change, refund or resolution of a complaint that qualifies as a commercial document is kept for 10 years from the end of the calendar year in which it was created. |
| Technical and security logs | From 11 November 2026. We keep logs on the general operation of the website, errors and security for 90 days from the date they are recorded. Log sections relating to a specific security incident are kept separately for as long as needed to investigate the incident and conclude any resulting legal claim. |
When the reason for retention no longer exists, we delete or destroy the data or anonymise it so that it can no longer be linked to a person. Where a legal proceeding is ongoing, we keep only the data needed for that proceeding for longer.
8.Your Rights and Our Contact Details
Under Article 11 of the KVKK you may find out whether your personal data is processed, and request information about the processing, its purpose, whether the data is used in line with that purpose, and the recipients in Türkiye or abroad. You may ask for incomplete or inaccurate data to be corrected, for data to be deleted or destroyed where the legal conditions are met, and for these actions to be notified to the recipients to whom the data was transferred. You may object to a result to your detriment arising from analysis of the data exclusively by automated systems, and claim compensation for damage caused by unlawful processing.
You can send your request to our postal address above, to our KEP address apolloparks@hs03.kep.tr, or to info@apollopark.tr from an e-mail address you have previously given us and that is registered in our system. Other methods set out in the Turkish rules on application procedures may also be used. We do not require you to fill in our own application form; where necessary we ask for information to verify your identity.
We reply to your request as soon as possible and within 30 days at the latest. The process is free of charge as a rule; if it involves an additional cost, only the fee permitted by the Personal Data Protection Board may be charged.
9.Cameras and Newsletter
Security cameras operate only at the park entrance. Details are given in the Privacy Notice on Camera Recordings. The Newsletter Privacy Notice provides information about the newsletter, to which you can subscribe with your name, surname and e-mail address. Entering the park or buying a ticket does not mean consenting to receive advertising or to the use of photographs for promotional purposes.