Privacy Notice (KVKK)
Effective date: 4 October 2026
This notice explains how we at Six Seats process your personal data in accordance with the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"): which data we process, for what purposes and on which legal grounds, with whom we share it, how long we keep it and how you can exercise your rights.
Details about cookies and similar records stored in your browser are set out in our Cookie Policy.
In short
- Your card details never reach us; payment is taken by Biletino.
- Not even we can see your password; only an irreversible digest (hash) of it is stored.
- Your phone number, e-mail address and LinkedIn address are not shared with other participants.
- On table pages, only participants whose payment has been confirmed appear, under a masked name and with limited information depending on the table format (section 6).
- We use analytics and marketing cookies only if you allow them. You can change your choice at any time through the "Cookie Preferences" link at the bottom of the site.
- We do not sell your personal data, and we do not share it with anyone for marketing purposes.
- Our database is located in Germany (Frankfurt); we work with providers abroad to host the site and to send service e-mails. Section 7 sets out which data goes to which provider, and why.
1. Data controller
The data controller for your personal data is Six Seats ("Six Seats", "we", "us").
- Website: sixseats.club
- Contact: the WhatsApp line on our site
2. Who does this notice cover?
This notice concerns the personal data of:
- visitors to sixseats.club and www.sixseats.club,
- people who create a membership account and book a seat at a table,
- people who fill in the "Call Me" form and people who contact us by WhatsApp, e-mail or telephone,
- people who use the table finder (sixseats.club/masa-bul),
- people who buy a gift ticket, and the people it is sent to,
- people who give feedback after an event,
- people who applied through the previous version of our website.
Only people aged 18 or over may join Six Seats tables. If we notice that data belongs to someone under 18, we delete it.
3. Which personal data do we process?
| Data group | Content |
|---|---|
| Identity | First name, last name, age |
| Contact | E-mail address, telephone number |
| Account and transaction security | Irreversible digest of your password (not the password itself), account role, account creation, last login and update times, whether the account has been suspended, session cookie, IP address and browser information |
| Profile (all table formats) | City, profession, short introduction, what you hope to get from the meet-up |
| Profile (Business only) | Company, job title, sector, LinkedIn address (optional), professional experience, networking goal, the people you would like to meet, what you can bring to the table |
| Profile (Meet in English only) | English level (A1–C2), the topics you enjoy talking about, the topics you would like to hear about and to tell, where you use English and what you are like when you speak it |
| Profile (Yeni Yüzler only) | Interests, how talkative you are, when you last made a new friend, how long you have lived in the city, how your friends would describe you, a topic you could talk about for hours |
| Booking and payment | Table, booking code, amount and currency, payment method (Biletino), payment status, your "I've Completed the Payment" notice, the buyer's name, e-mail address and order number (if any) on Biletino, seat hold period, cancellation and refund requests and their outcome, the reason for rejection if your payment cannot be verified, attendance status, booking language (Turkish or English), a copy of your profile as it was at the time of booking |
| Consent and preference records | Which text or consent (with its version) you accepted or refused and when, the IP address and browser information used at the time; your cookie choice stored in your browser |
| Requests and correspondence | "Call Me" requests (name, telephone, the table format you are interested in, optional note, and where applicable the table, your account and the campaign source), WhatsApp and e-mail correspondence, the type, sending time and status of the service e-mails sent to you |
| Feedback | Rating from 1 to 5, whether you would come again, optional comment |
| Gifts | The buyer's name and e-mail address, the recipient's name and e-mail address, an optional note, the gift code and whether it has been used |
| Table finder | The meet-up type you chose, your sector preference (same, different or no preference), your sector, your profession, your English level, your short purpose; if you are a member, the scoring results |
| Service event records | The type and time of the following events, the table concerned and, where applicable, your account: booking created, payment notified, refund requested, booking expired, table full and table confirmed, feedback given and call-back requested |
| Measurement and marketing (only with your permission) | Google Analytics and Meta Pixel cookie identifiers, a random measurement identifier, the pages you visit and the booking steps you take, campaign source (utm parameters), the domain of the site that referred you, landing page, screen size, device type (mobile, tablet or desktop), browser language, IP address |
| Legacy application records | If you applied through the previous version of our website: first name, last name, e-mail address, telephone number, city, LinkedIn address, sector, job title, vision and expectations |
We do not ask for special categories of personal data. Please do not write information about health, religion, sect or other beliefs, political opinions, ethnic origin or similar matters in the short introduction, expectation, interests, open questions or note fields. If we notice that such information has been written, we delete it.
4. How do we collect your personal data?
- From you, through the forms on the site: the membership, booking and profile form, the "Call Me" form, the table finder, the feedback form and refund requests. This data is collected by fully automated means.
- Through cookies and similar technologies: strictly necessary ones on every visit, analytics and marketing ones only with your permission, by automated means.
- Through server and security logs: while you use the site, by automated means.
- From Biletino: to verify your payment, our team checks the buyer's name, e-mail address, order number (if any) and payment status shown in the Biletino management panel and records them against your booking. This is done by partly automated means.
- By WhatsApp, e-mail and telephone: when you contact us, by partly automated means.
- From our own records: the booking code, payment, refund and attendance statuses and table finder scores are generated by us while providing our service.
5. For what purposes and on which legal grounds do we process your data?
We rely on the following legal grounds listed in Article 5 of the KVKK:
- Contract (Art. 5(2)(c)): processing needed to conclude the Membership Agreement and to perform your booking.
- Legal obligation (Art. 5(2)(ç)): our obligations under tax, commercial, commercial electronic message and data security legislation.
- Establishment, exercise or protection of a right (Art. 5(2)(e)): to be able to protect our rights in possible disputes.
- Legitimate interest (Art. 5(2)(f)): processing needed to run our service securely and well, provided that it does not harm your fundamental rights and freedoms.
- Explicit consent (Art. 5(1)): only for analytics and marketing cookies and for marketing messages. Not giving explicit consent does not affect your ability to join our tables.
| What we process it for | Which data | Legal ground |
|---|---|---|
| Opening your membership account, verifying your login, keeping you logged in | E-mail, telephone, password digest, account role and time data, session cookie | Contract |
| Taking your booking and holding your seat for a limited time for payment | First name, last name, booking data | Contract |
| Composing tables of people suited to the format; our team reviews every profile individually (curation) | Profile data, age, city | Contract |
| Applying the minimum B1 level requirement for Meet in English tables | English level | Contract |
| Setting the date, time and venue once a table is full, and informing you | Booking data, first name, e-mail | Contract |
| Matching your Biletino payment to your booking, verifying it and sending your ticket | First name, last name, e-mail, Biletino order number, payment status | Contract |
| Selling gift tickets, verifying their payment and e-mailing the gift code to the recipient | The buyer's and the recipient's names and e-mail addresses, note, gift code | Contract |
| Handling your cancellation and refund requests | Booking and payment data | Contract |
| Keeping accounting and tax records | First name, last name, amount, date, payment and refund status | Legal obligation |
| Sending service e-mails: booking received, payment confirmed and ticket, payment could not be verified, table confirmed (date, time, venue), booking and event reminders, cancellation, postponement and refund notices | First name, e-mail, booking and table data, booking language | Contract |
| Calling you by telephone, or writing to you on WhatsApp if you have previously messaged us there, when there is an urgent change to the time, venue or attendance on the day of the event | First name, telephone | Contract |
| Calling you back at your "Call Me" request and choosing a suitable table with you | Name, telephone, table format or table, note, and where applicable your account and campaign source | Contract (at your request, before a contract is concluded) and legitimate interest |
| Answering your questions by WhatsApp and e-mail | Content of the correspondence, name, telephone or e-mail | Contract and legitimate interest |
| Suggesting open tables that suit you in the table finder | Table finder answers; if you are a member, your profile data | Contract (at your request) |
| Recording members' table finder results to measure the quality of the suggestions | Scoring results, chosen meet-up type | Legitimate interest |
| Asking for feedback after the event and reviewing feedback | E-mail, booking, feedback | Legitimate interest |
| Showing the composition of a table on its table page (section 6) | Masked name and limited information depending on the format | Legitimate interest |
| Monitoring the booking flow and the operation of the service statistically (without cookies, through event records kept on our own server) | Service event records | Legitimate interest |
| Ensuring compliance with the Community Guidelines; suspending or terminating a membership that breaches them | Account status, the related booking and correspondence | Contract and legitimate interest |
| Measuring site use and improving the site (Google Analytics and our own measurement) | Measurement data | Explicit consent ("Analytics" in the cookie preferences) |
| Measuring the results of our Meta (Facebook, Instagram) ads (Meta Pixel) | Measurement data | Explicit consent ("Marketing" in the cookie preferences) |
| If you separately agree, sending commercial electronic messages by e-mail about new tables, events and offers | First name, last name, e-mail, consent record | Explicit consent and approval for commercial electronic messages under Article 6 of Law No. 6563 |
| Being able to prove that we informed you and what you agreed to or refused | Consent and preference records (including IP address and browser information) | Legal obligation and protection of a right |
| Protecting the site and accounts: limiting excessive requests, preventing misuse and attacks | IP address, browser information, requested page address, time | Legitimate interest and our data security obligation under Article 12 of the KVKK (legal obligation) |
| Responding to lawful requests from competent authorities and protecting our rights in disputes | Data relating to the request or dispute | Legal obligation and protection of a right |
| Keeping the application records left over from the previous version of our website, with restricted access, until they are deleted (they are not used for any other purpose) | Legacy application records | Protection of a right |
We do not currently send commercial electronic messages for marketing purposes. When we start, we will send them only to people who have separately agreed, and every message will contain an opt-out link.
Automated decisions: Our team decides who sits at which table. The table finder's results are suggestions only; no decision affecting you is taken about you solely by automated systems.
Table finder: If you are not a member, your answers are not stored; they are used only at that moment to produce suggestions. If you are a member, the scoring results are recorded and linked to your account so that we can measure the quality of the suggestions. The table finder ranks open tables with rule-based scoring.
6. Information shown on table pages
Table pages are public and may appear in search engines. On these pages, only participants whose payment has been confirmed are shown, under a masked name: only one letter of your first name and one letter of your last name are visible, and the other letters are hidden by asterisks. For example, for a participant named "Ahmet Yılmaz", only the letter "m" of the first name and the letter "a" of the last name are visible.
Next to the masked name, only the following information is shown, depending on the table format:
| Table format | Information shown |
|---|---|
| Business | Job title and sector |
| Meet in English | Age and English level |
| Yeni Yüzler | Age and profession |
Seats whose payment has not yet been confirmed appear only as "Reserved seat", with no personal information. Your telephone number, e-mail address, company, LinkedIn address, short introduction and other profile data are never shown on the table page.
We show this on the basis of our legitimate interest, so that people considering a table can get an idea of who they would be sitting with. If you do not want to appear on a table page, write to us on WhatsApp; only the word "Participant" will then be shown instead of your name, and your other information will be hidden.
7. Who do we share your personal data with?
We do not sell your personal data, and we do not share it with anyone for marketing purposes. Your data is shared only in the cases below, for the stated purpose and only as far as necessary.
| With whom? | What for? | Legal ground |
|---|---|---|
| Supabase (Supabase Inc.) — database | Hosting the records we keep for the site: account, profile, booking and payment, consent and preference, request, gift and service e-mail records, and our own measurement records. The database is located on servers in Germany (Frankfurt). | Contract and legitimate interest |
| Vercel (Vercel Inc.) — hosting the site | Serving the site to you; processing the information you enter in forms and passing it to the database. This runs on servers in Germany (Frankfurt). When you visit the site, your IP address and browser information are processed through Vercel's worldwide network and kept in short-lived system logs. | Contract and legitimate interest |
| Resend (Resend, Inc.) — service e-mails | Sending booking, payment, ticket, reminder and gift e-mails. For this, your e-mail address, your name and the content of the e-mail (such as the table, booking code, date, venue or gift code) are passed to Resend. The e-mails are sent through infrastructure in the United States. | Contract |
| Biletino (ticket sales and payment platform) | Verifying your payment, cancellations and refunds, resolving payment issues | Contract |
| Google (Google Analytics) and Meta (Meta Pixel), only if you allow them in your cookie choices | Measuring site use and ad results | Explicit consent |
| Competent public authorities and judicial bodies | Only where there is a legal request or obligation | Legal obligation and protection of a right |
| Our lawyers and our certified public accountant (where necessary, under a duty of confidentiality) | Our legal and financial obligations and disputes | Legal obligation and protection of a right |
Supabase, Vercel and Resend process the data only on our behalf and in line with our instructions.
Transfers abroad: Our database (Supabase) and the server-side processing of the site (Vercel) run in Germany, and the infrastructure through which service e-mails are sent (Resend) is in the United States; site traffic passes through Vercel's worldwide network. Data passed to these providers is therefore transferred abroad. All three providers are companies based in the United States. Google and Meta, if you allow them, also process the data they obtain through cookies on their servers abroad. These transfers fall under Article 9 of the KVKK.
For purchases and card payments you make on Biletino, Biletino is a separate data controller under its own privacy notice. Google and Meta may also process the data they obtain through cookies for their own purposes, under their own terms and privacy policies; for that processing, they are separate data controllers.
Apart from the masked information on the table page, we do not share any of your information with other participants; at the table, you introduce yourself as much as you wish.
WhatsApp: You choose to write to us on WhatsApp. This correspondence is carried under WhatsApp's own terms and privacy policy. We recommend that you do not share unnecessary personal information or special categories of personal data on WhatsApp.
8. How long do we keep your data?
| Data | Retention period |
|---|---|
| Account data (e-mail, telephone, password digest, account status) | As long as your account is open. When you ask for your account to be closed, it is deleted within 30 days; records still subject to a statutory retention period are kept only for that period. Accounts with no login and no booking in the last 24 months are closed 30 days after we notify you by e-mail. |
| Current profile data | Deleted together with your account. |
| Copy of the profile at the time of booking | 12 months from the date the table takes place, or from the date the booking is closed through cancellation, refund or expiry |
| Gift records | 10 years from the beginning of the year following the year of the transaction |
| Booking, payment and refund records (first name, last name, booking code, table, date, amount, payment and refund status, Biletino order number) | 10 years from the beginning of the year following the year of the transaction (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253, Turkish Code of Obligations Art. 146) |
| Records of acceptance of the Membership Agreement and of the information given (including IP address and browser information) | 10 years from the end of the membership |
| Records of approval and refusal of commercial electronic messages | 3 years from the end of the approval |
| Record of suspension or termination of membership | 3 years from the date of the decision |
| "Call Me" requests | 6 months from the request being concluded |
| WhatsApp and e-mail correspondence | 12 months from the last message; if there is a dispute, until it is resolved |
| Records of service e-mails sent | 12 months from sending |
| Feedback | 24 months; afterwards kept only as statistics, with the link to you removed (anonymised) |
| Table finder scoring records | 12 months |
| Service event records and our own measurement records | 14 months; then deleted or anonymised |
| Google Analytics data | Up to 14 months, according to our retention setting in Google Analytics |
| Meta Pixel data | Meta's own retention periods apply |
| IP addresses used for rate limiting | Only in server memory, for at most 10 minutes; not stored permanently |
| System logs of our hosting provider (Vercel) | The logs made available to us are short-lived (at most 1 day); the provider's own security logs are subject to its own policies |
| Legacy application records | Deleted no later than 31 December 2026 |
| Cookies and records stored in the browser | For the periods stated in the Cookie Policy |
We delete, destroy or anonymise data whose retention period has expired in the first periodic destruction run after expiry, and in any case within six months. If a dispute or an official investigation is ongoing, the relevant data may be kept until it is concluded.
9. Your rights
Under Article 11 of the KVKK, you may apply to us to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of the processing and whether the data is used in line with that purpose,
- know the third parties, in Turkey or abroad, to whom your data has been transferred,
- request the correction of your data if it is incomplete or inaccurate,
- request the deletion or destruction of your data under the conditions in Article 7 of the KVKK,
- request that the third parties to whom your data has been transferred be notified of any correction, deletion or destruction,
- object to a result to your detriment that arises from the analysis of your data exclusively by automated systems,
- claim compensation if you suffer damage because your data has been processed unlawfully.
You may withdraw the consent you have given for processing based on explicit consent at any time: for cookies, through the "Cookie Preferences" link at the bottom of the site; for marketing messages, through the opt-out link in each message. Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal.
10. How can you apply to us?
You can send us requests about your rights through the WhatsApp line on our site. We may ask for additional information to verify your identity.
We conclude your request free of charge within 30 days at the latest.
11. Cookies
On our site we always use the strictly necessary cookies that the site needs in order to work; we use analytics and marketing cookies only if you allow them. The Google Analytics and Meta Pixel code is not loaded until you give the relevant permission. You can change your choice at any time through the "Cookie Preferences" link at the bottom of the site. The name, purpose and duration of every cookie we use are listed in our Cookie Policy.
12. Changes to this notice
We update this notice when the way we process personal data changes. We will inform you before we start processing your data for a new purpose. The current notice is always available on this page; its effective date appears at the top.