Privacy Policy

For the purposes of the Turkish Personal Data Protection Law no. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"), the data controller is:

• Legal entity: Epic Zone Teknoloji Ltd. Şti.
• Address: İstanbul / Üsküdar, Türkiye
• Email: hello@epic-zone.com
• Website: https://hx.zone

This Policy applies to the HX Zone family of enterprise SaaS products (Ticket Zone, Event Zone, Auto Zone, QR Zone, Alert Zone, HR Zone) and to the https://hx.zone marketing website.

HX Zone products are SaaS services provided to enterprise customers (B2B) under a corporate services agreement.

• For data processed by the Customer in the course of their business, Epic Zone Teknoloji Ltd. Şti. acts as a Data Processor within the meaning of KVKK Art. 3/h and GDPR Art. 4(8). The purpose, scope and duration of processing are determined by the corporate agreement and the related data processing addenda concluded with the Customer.
• For activities HX Zone carries out on its own behalf (account administration, billing, support, product analytics, contact-form enquiries on hx.zone, etc.), HX Zone acts as a Data Controller.

This Policy describes the data HX Zone processes as a controller and the principles applied across both roles; product-specific processing details are governed by the agreement with the relevant Customer.

By product and process, the following categories may be processed:

• Identification: First name, last name, username, employee/personnel number (HR Zone)
• Contact: Email address, phone number, postal address
• Customer / event: Ticket number (PNR), QR identifier, event attendance status, section/sector selection (Ticket Zone, Event Zone)
• Vehicle: License plate, chassis number, make/model, owner contact information (Auto Zone; vehicle plate at parking entry in Event Zone)
• Employee: Job title, department, job level, position in the org chart, start / leaving date (HR Zone)
• Financial and payment: Order amount, currency, order status, payment method. Card numbers and card security data are not stored by HX Zone; they are processed through PCI DSS–compliant payment providers.
• Location: Address, map-selected coordinates, location name (Auto Zone, Ticket Zone — through Google Maps Platform)
• Transaction security: IP address, browser information, usage and log data, OIDC session tokens
• Marketing / analytics: Usage data collected through cookies and similar technologies

Special categories (KVKK Art. 6 / GDPR Art. 9): HX Zone products in their standard use profile do not require the processing of special categories of personal data (health, biometric, religious, political, criminal-conviction data). Where a Customer chooses to upload such data through their own configuration, the additional security and explicit-consent obligations rest with that Customer.

• Provision of products and services, performance of the agreement
• Authentication of Customers and end users (OIDC)
• Execution of payment, ticketing, event and service workflows
• Sending notifications, reminders and announcements (email, SMS)
• Service quality measurement, error monitoring and performance improvement
• Information security and fraud prevention
• Compliance with legal obligations
• Responding to contact-form enquiries on the website

• KVKK Art. 5/1 — GDPR Art. 6(1)(a): Explicit consent (e.g. marketing communications, optional cookies)
• KVKK Art. 5/2(a): Where expressly provided by law
• KVKK Art. 5/2(c) — GDPR Art. 6(1)(b): Necessary for the conclusion or performance of a contract
• KVKK Art. 5/2(ç) — GDPR Art. 6(1)(c): Compliance with a legal obligation
• KVKK Art. 5/2(f) — GDPR Art. 6(1)(f): Legitimate interests (security, service continuity, improvement)

Cloud infrastructure provider:

• Microsoft Azure (United States — East US region): Website and product infrastructure, databases, file storage, monitoring and telemetry (including Azure Application Insights)

Payment service providers (PCI DSS compliant):

• PayCore (Türkiye)
• iyzico (Türkiye)
• Stripe (United States)

SMS service providers:

• Verimor (Türkiye)
• Turatel (Türkiye)
• Twilio (United States)

Email service provider:

• SendGrid / Twilio (United States)

Maps and location services:

• Google Maps Platform / Google LLC (United States)

Web analytics:

• Google Analytics / Google LLC (United States) — uses cookies; see Section 7
• Microsoft Azure Application Insights (United States) — application performance and error monitoring

Public authorities: Where required by applicable law.

International transfers (KVKK Art. 9 / GDPR Chapter V): Transfers to providers identified above as based in the United States are made on the basis of data processing agreements (DPAs), standard contractual clauses (SCCs) and/or explicit consent, together with additional safeguards where necessary.

HX Zone products and the website use the following technologies:

• Strictly necessary cookies and storage: Session management (OIDC access tokens), interface state, language preference — via browser localStorage and/or cookies
• Analytics cookies: Google Analytics (visitor behaviour and traffic analysis), Microsoft Azure Application Insights (application performance and error tracking)
• Third-party service cookies: Google reCAPTCHA (bot protection — on the hx.zone contact form), Google Maps Platform (maps and location services)

You can manage or delete cookies through your browser settings.

Data is retained for periods set by applicable law (Tax Procedure Law, Code of Obligations, social security legislation, commercial-book retention obligations, etc.) or for as long as the purpose of processing requires. After that, it is deleted, destroyed or anonymised.

Upon termination of the agreement with a Customer, return or deletion of that Customer's data is governed by the corporate agreement.

You have the right to:

• Learn whether your personal data is being processed
• Request information about how it is being processed
• Learn the purpose and whether it is being used in accordance with that purpose
• Learn the third parties to whom it has been transferred, within Türkiye or abroad
• Request correction of incomplete or inaccurate data
• Request erasure or destruction under the conditions of KVKK Art. 7
• Request notification of correction/erasure to the parties to whom data was transferred
• Object to results produced against you by automated analysis
• Claim compensation for damages resulting from unlawful processing

How to exercise your rights:

• Email: hello@epic-zone.com
• Post: Epic Zone Teknoloji Ltd. Şti., İstanbul / Üsküdar, Türkiye

For data HX Zone processes as a controller, requests are answered within 30 days at the latest. For data controlled by a Customer, you may need to contact the relevant Customer directly; where you contact us, we will route your request appropriately.

This Policy may be updated as needed. Material changes will be announced on the website. The updated version takes effect from the date of publication.

For any questions: hello@epic-zone.com