Last updated: October 2026
As Girl Math Society, we may collect the following personal data during event registration and service processes:
• Name and surname • Phone number • Email address • Invoice details: full name, Turkish ID number (or, if you are a foreign national, only that status) and province • For manual sales, the full name, phone and email entered by our team • Order and event registration details • Payment transaction details, where necessary • Plus or Premium membership subscription details: plan, period, subscription status, payment dates and amounts, iyzico subscription and customer references • PR package requests and your choice on whether your name is shown with a request
Card details are not stored directly by Girl Math Society. Payments are processed through the infrastructure of the secure payment institution used (iyzico), and your card details are processed only within that institution's secure systems.
The personal data collected is used for the following purposes:
• Completing event registration and sharing participation details • Processing payments and issuing invoices • Notifying you of cancellations, changes or important updates • Providing customer service and support • Fulfilling legal obligations • Marketing communication, where explicit consent is given • Setting up and renewing membership subscriptions and providing membership benefits (including PR packages and Premium Kulis)
Payments are processed through a PCI DSS-compliant secure payment infrastructure. Your credit and debit card details are not stored on Girl Math Society servers; they are processed only through the payment institution's encrypted systems.
All payment pages are protected by SSL/TLS encryption.
If you request a refund for a ticket you paid for by bank transfer, the IBAN and account holder name you enter are stored so the refund can be sent. Only our authorised team sees this information, solely to send the refund; it is deleted 30 days after the request is settled (refunded or declined). The refund itself (amount, date, method, transfer/receipt number) is kept as a financial record for the legally required period. For card payments the refund is made to the card through the payment institution (iyzico); no card details are collected.
After you buy a ticket, your full name, Turkish ID number and province are requested under My Account → My Tickets so that your e-Archive invoice can be issued; this information is not requested at purchase. If you are not a Turkish citizen, you can tick "foreign national"; in that case your ID number is not collected and the invoice is issued with the general number provided for in the legislation (11111111111).
This information is processed solely to issue invoices under Tax Procedure Law No. 213. The legal basis is that processing is necessary for the data controller to fulfil its legal obligation (KVKK Art. 5/2-ç). Your invoice details are not used for marketing or any other purpose.
Your invoice details can be seen by you and by authorised team members who sign in with two-step verification (2FA). In lists the team sees your ID number masked (e.g. 123******01); the full number is opened one person at a time only to issue an invoice, and each opening is logged with who opened it and when (the number itself is not written to the log). This information is shared only with our e-Archive invoice service provider and our accountant, solely to issue the invoice.
Your invoice details are kept for as long as your account is open; you can update or delete them at any time in My Account, and they are also deleted when you delete your account. Issued invoices are kept in the accounting records for 10 years under the Tax Procedure Law and the Turkish Commercial Code; these records are not affected by deleting your account.
If you bought your ticket by messaging us on Instagram or WhatsApp and paying by bank transfer to our IBAN, our team enters your full name, phone number and email address into the system together with the ticket and payment details when recording the sale. This information is processed to issue your ticket, admit you to the event and issue the invoice (KVKK Art. 5/2-c and Art. 5/2-ç).
When you open an account with the same email address, or change your account email to that address, the sale and its tickets are linked to your account automatically; this match is safe because the email address is verified with the code sent at sign-in. Since phone numbers are not verified, sales that match only by phone number are not linked automatically; they are moved to your account once our team has checked and confirmed the match. This way, someone who enters another person's phone number in their profile cannot see that person's tickets. Sales records are financial records and are kept for the statutory period.
When you buy a ticket without signing in, you enter your full name, email address and mobile number. This data is processed to issue your order and ticket, take your payment, admit you to the event and contact you (KVKK art. 5/2-c). To prevent abuse, the number of orders that can be placed with the same email or phone in a short time is limited.
An account is created for you automatically when you buy a ticket; you can delete it any time from My Account. Once payment is complete, an account is opened with this email address (if you already have an account with that address, the order is added to it) and your ticket is linked to it; the name and phone you entered are saved to your profile if those fields are empty (the phone shows as "unconfirmed" until you confirm it). The account has no password; you sign in with a code sent to your email. We send you a single transactional email saying your ticket is ready; marketing messages require your separate consent.
Your personal data is not shared with or sold to third parties without your explicit consent. Limited sharing may take place in the following cases:
• With payment institutions in order to process payments • Where required by law or requested by authorised public authorities • With service providers essential to organising the event (venue, transport, etc.) • With service providers we work with to deliver the service, only as much as necessary: Supabase (hosting and database), Expo (delivery of app notifications), our email delivery provider (Resend), iyzico (payments and membership subscription renewals), Vercel (site hosting and anonymous, cookieless visit statistics: country, device, referring site) and the cargo company (delivery of shop orders) • To issue invoices, limited to invoice details, with our e-Archive invoice service provider and the accountant (mali müşavir) who provides our accounting services
Your personal data is deleted, destroyed or anonymised once the purpose of processing no longer applies or the legal retention periods expire. Commercial records and invoice details are kept for the periods required under the Turkish Commercial Code and the Tax Procedure Law.
Account deletion: You can delete your account under My Account → Profile (website) or My Account (app). Once we receive your request, all your sessions are signed out, marketing messages and notifications stop, and your account is permanently deleted after 28 days. If you sign in to your account within these 28 days, your deletion request is cancelled automatically. When the deletion takes place, your profile, points, codes, reviews and photos assigned to you are deleted; purchase and invoice records are kept for the legal retention period without being linked to you. The record showing that a deletion was requested and carried out only contains dates and an anonymous account number; your name, email or phone number are not kept in it.
Our website may use cookies to improve the user experience. Essential cookies are required for the site to work properly; analytics and marketing cookies are only enabled with your consent. You can manage your cookie preferences in your browser settings.
To understand how the site is used and to improve the purchase steps, we keep counts that do not identify you: pages and events/products viewed, buttons clicked, checkout steps, form fields that produced an error, how far a page was scrolled and time spent on it. These records contain no name, email, IP address or account ID; only a random session ID that is deleted when the tab closes. No cookies are used, the data is not shared with advertising networks and it is deleted after 180 days. If "Do Not Track" or Global Privacy Control is enabled in your browser, nothing is counted.
These counts also include the general context of the visit: device type (phone, tablet, computer), operating system family (e.g. iOS, Android, Windows), whether the site or the app was used, and the traffic source (e.g. Instagram, Google, direct). These are reduced to fixed categories on your device; we do not record your browser identification string, the full address of the page you came from, your IP address or your location, and they are not used to identify you.
We also use the cookieless, anonymous visit statistics of Vercel, which hosts the site (Vercel Web Analytics): the page visited (without query strings or personal parameters), country, device type, operating system and browser family, and the referring site. Vercel does not use a persistent visitor identifier or cookies; the IP address is processed only transiently and not stored. The admin panel is not measured.
If you are signed in, the items in your shop cart (product and quantity only) are stored with your account; our team can see carts and orders that were left unpaid. Reminders or promotional messages about them are only sent if you have consented to marketing communications. Your cart is deleted when you delete your account.
The mobile app uses the same account data as your account on the site (email, name and surname, phone, ticket and order details); no additional account data is collected for the app.
If you allow notifications, an app-specific device notification identifier (push token) is stored with your account so that we can send notifications to your device. This identifier is used to send notifications about your tickets and events and, only if you have consented to marketing communications, campaign and new event announcements. Notifications are delivered via Expo (650 Industries, USA) and Apple Push Notification Service (APNs) / Google Firebase Cloud Messaging (FCM); the notification identifier and notification content are therefore transferred abroad.
The notification identifier is deleted when you turn off notifications in the app, sign out or delete your account. You can also turn off notifications at any time in your phone's settings. The app does not collect an advertising ID (IDFA/GAID) and does not track you across other apps or websites.
For forms you send from the site or the app (contact, brand collaboration, private event, city request), your name, email address or phone number, your message and the form-specific details are stored and used only to respond to your request.
Our team or a photographer we appoint may take photos at our events. These photos are shared only with attendees who held a ticket for that event, in My Account → Past; they are not published at a public address and are viewed only through time-limited, personal links. A photo may be assigned to a specific attendee as "just for you"; only that person can see such photos (while their Premium membership is active).
Photos are stored in connection with your account in order to provide the event service and let attendees access their memories. Photos are used for social media or promotion only with your separate explicit consent. If you would like a photo deleted or prefer not to be photographed, tell our team at the event or write to info@girlmathsociety.net. When you delete your account, photos assigned personally to you are also deleted.
The score (1–5) and optional comment you leave in "How was it?" after an event are stored in connection with your account to improve our events and are seen only by our team; they are not published under your name. Your rating is deleted when you delete your account.
If you join the waitlist of a sold-out event, the event, ticket type and quantity, the time you joined and the expiry of any spot held for you are stored with your account. Your Premium membership status is taken into account for the order. When a spot opens, we let you know by app notification and email (a transactional notice). The entry is deleted when you delete your account.
When you gift Premium or receive it as a gift, we store which order the gift was bought with, the buying and claiming accounts and the time it was claimed; this is kept as a financial record and to prevent misuse, and is written to our audit log.
If your Premium membership ends without renewal and you have given marketing consent, we may send you a single "come back" notification; the record of the offer being sent and used is stored with your account and deleted when you delete your account.
When you start a Plus or Premium membership subscription, the plan and period you choose (monthly or yearly), the subscription price, the subscription status, the period end date, the time of any cancellation request, the amount and date of each payment and the subscription, customer and order references issued by iyzico are stored with your account. This data is processed to set up, renew and cancel the subscription and to assign membership benefits, on the legal basis that processing is necessary for the conclusion and performance of a contract (KVKK Art. 5/2-c).
So that the subscription can be created in the iyzico Abonelik (subscription) infrastructure and renewal payments collected, your full name, email address, phone number and, if you have provided invoice details, your Turkish ID number and province are shared with iyzico (if you have not, the general number provided for in the legislation is used). Your card details are stored only by iyzico and are not transmitted to Girl Math Society. You and our authorised team can see your subscription records. Subscription records are deleted when you delete your account; financial records relating to payments are kept for the legal retention period.
When you request a PR package as a Premium member, the package requested, the time of the request, its status (requested, approved, delivered, cancelled) and any note by our team on the request are stored with your account and processed to get the package to you (KVKK Art. 5/2-c). If you wish, when making the request, your first name and the initial of your surname (e.g. "Ayşe K.") are shown to visitors of our site in the list of members who received the package; this is entirely optional and based on your choice (your explicit consent, KVKK Art. 5/1). If you do not opt in, your name is not shown and you are only counted in the total number of requests. To withdraw your choice, you can write to info@girlmathsociety.net. Request records are deleted when you delete your account.
Premium Kulis contains event photos and announcements shared by our team; members do not upload content to Kulis. Members-only posts and images are shown only to Plus and Premium members, while posts marked as showcase posts are publicly visible on the site. Because you may appear in event photos, these images are subject to our photo policy in the "Event Photos and Ratings" section: in public showcase posts and for promotional use, photos in which people are recognisable are used only with their separate explicit consent. You can ask for an image to be removed at info@girlmathsociety.net.
If you leave us a review or feedback from My Account, the text you write, the event you optionally select, the time of submission, your publication consent and our team's review outcome (under review / published / not published, the review time and the reviewing team member) are stored with your account. The display name is generated on our server from the name in your profile: your first name and the initial of your surname (e.g. "Ayşe K."). Your full surname, email address and phone number are not published.
Your review may be published under this name on our website and on Girl Math Society's social media accounts only with your explicit consent and if our team selects it; whether it is published is at our team's discretion. The legal basis is your explicit consent (KVKK Art. 5(1)). When reviewing, our team can see your first name, surname and email address.
You can withdraw your consent at any time: if you delete your review under My Account → Past → My reviews, it is removed from the website and its record is deleted. You can ask us via the Contact page to remove posts already shared on our social media accounts. The records are also deleted when you delete your account.
In the "Bring Girl Math to My City!" form, the city you enter and your email address or Instagram username are stored so we can let you know when we bring events to your city and see which cities are requested most.
For "The Society Guest List" applications we process your full name, email, Instagram username, city, content area and follower range to review your application and for invitations to exclusive events. Only our authorised team can see these applications; they are not shared with third parties.
Event suggestions you send to the Wish List and your votes are linked to your account. Once approved by our team, a suggestion appears on the public list without your name. If you delete your account, your suggestions and votes are deleted too.
Marketing communication by email and app notification about event announcements, special offers and Girl Math Society news is based on your explicit consent, obtained separately from any purchase.
You can opt out of marketing communication at any time by turning off the marketing consent on the My Account page, using the 'unsubscribe' link in our emails, turning off app notifications or writing to info@girlmathsociety.net.
If you filled in the "Join the community" form on our previous website, we use your name, email and (if provided) phone number to invite you to complete your membership on our new website. This invitation is sent at most three times per person, and you can stop invitations immediately with the link in each email. If you do not join, we keep this information only so that we do not invite you again; write to info@girlmathsociety.net if you want it deleted. If you join, the record is linked to your account and deleted when you delete your account.
Under Law No. 6698 on the Protection of Personal Data (KVKK), you have the right to:
• Find out whether your personal data is being processed • Request information about it if it has been processed • Find out the purpose of processing and whether it is used in line with that purpose • Know the third parties in Turkey or abroad to whom it has been transferred • Request correction if it has been processed incompletely or inaccurately • Request its deletion or destruction under Article 7 of the Law • Object to an outcome against you arising from analysis exclusively through automated systems • Claim compensation if you suffer damage due to unlawful processing
You can send requests about your personal data to info@girlmathsociety.net. Applications will be answered within 30 days at the latest.