A Sema ceremony is a UNESCO-listed living tradition, not a tourist show. The booking itself is simple: a name, an email, a seat selection. This policy is about what we collect to coordinate your evening, why we need it, and who else sees it. Plain English. GDPR + KVKK aligned.
Operated by Istanbul Tourist Information Ltd., TÜRSAB A-7812, VAT 3470891204. Registered office: Sultanahmet Mah. Divan Yolu Cad. 17, 34122 Fatih, Istanbul. Data officer: privacy@istanbul-tourist-information.com.
Covers whirling-dervish.com — the booking site for the Mevlevi Sema ceremony at the Sirkeci Station hall. Does not cover the Mevlevi brotherhood's own pages or third-party resellers.
Contact & booking data — cardholder name, email, phone, ceremony date, group size.
Payment data — card on Stripe, we keep last four + brand only.
Usage data — which pages, referrer, device class, anonymised.
Support data — email and reply, 36-month retention.
Contract performance — we must know your booking reference to print the voucher. Art. 6(1)(b) GDPR.
Legal obligation — Turkish tax records retained 10 years. Art. 6(1)(c) GDPR.
Legitimate interest — analytics, fraud, crash reports. Opt-out via cookie panel. Art. 6(1)(f) GDPR.
Consent — marketing, newsletters. Opt-in. Art. 6(1)(a) GDPR.
Directly from you, in the booking form or a support email. No data purchases, no third-party enrichment, no device fingerprinting.
Record: reference (WD- prefix), ceremony date, group size, cardholder name, email, phone, VAT amount, total paid, refund history.
Visible to you (via confirmation), support, and the hall attendant at the door (group size only).
Helpdesk: Front. 36 months retention. Not training data, not marketing.
GA4: IP anonymisation, ad-signals disabled, demographics off. Sentry: PII scrubbed.
| Vendor | Purpose | Data held | Region |
|---|---|---|---|
| Stripe | Payments | Card tokens | EU + US |
| External sales API | Hall seat inventory | Date, tier, quantity | Türkiye |
| Transactional email | Confirmation + voucher | Email, summary | EU |
| Google Analytics 4 | Anonymised usage | Anonymous session ID | EU + US |
| Meta Pixel | Ad attribution (opt-in) | Opaque ID | EU + US |
| Sentry | Crash reports (scrubbed) | Error trace, no PII | EU |
| Hosting & CDN | Serving the site | IP, user-agent (transient) | EU |
DPA-signed, annually audited.
No selling, no renting, no partner marketing. Only processor vendors under our instructions. Legal order exception: you're notified unless forbidden.
Booking records — 10 years. Support — 36 months. Analytics — 24 months. Crash reports — 14 days. Marketing cookies — 90 days or until revoked.
Primary infrastructure: EU (Frankfurt, Amsterdam). Stripe and Google route through US under EU-US Data Privacy Framework + SCCs.
TLS 1.3. DB encryption at rest. 2FA all staff. Quarterly pen-tests. 72-hour breach notification commitment.
Eight rights under GDPR + KVKK.
Full copy, 30-day SLA.
Same-day fixes.
Outside 10-year retention.
Freeze during disputes.
JSON/CSV export.
Stop legitimate-interest processing.
None. No profiling.
KVKK or EU DPA directly.
No knowing collection of under-16 data. Under-6 not admitted (ceremony etiquette); age 6-15 free seated with a paying adult — only first name on the voucher.
Material changes: 30-day email notice. Minor: version increments.
One in-house person. First reply in 8 business hours, resolution in 15 business days for 98% of cases.