This policy explains how personal data is processed in the following mobile apps published by the Presidency of the Republic of Türkiye, Directorate of National Palaces ("the Directorate"):

• Millî Saraylar (listed in the app stores as "Milli Saraylar: Saray Müzeleri"): app for visitors (information on palaces, pavilions and museums; e-tickets and book sales)
• Millî Saraylar Yönetim: for Directorate staff only
• Millî Saraylar Acente: for travel agencies under contract with the Directorate only

1. Data controller

Presidency of the Republic of Türkiye, Directorate of National Palaces
Vişnezade Mah. Dolmabahçe Sarayı, 34357 Beşiktaş / Istanbul, Türkiye · Tel: +90 212 236 90 00

Data protection requests: info@millisaraylar.gov.tr · Registered e-mail (KEP): millisaraylaridaresibaskanligi@hs01.kep.tr

2. Data we process

Millî Saraylar (visitor app)

• Viewing palace, museum, news and event content requires no personal data, and no account is created.
• E-ticket purchase: for Turkish citizens, Turkish ID number and date of birth (identity is verified through the national Identity Sharing System, which returns the name; the date of birth is not stored); for foreign visitors, first and last name; visitor type (full, student, etc.); the e-mail address and mobile phone number to which the tickets are sent.
• Book purchase: name, e-mail address, mobile phone number and delivery address.
• Payment: card details are transmitted over an encrypted connection only at the time of payment and are used for the bank's 3D Secure verification. The card number and security code are not stored on the device or in the Directorate's systems; only the masked card number reported by the bank (e.g. 4546 **** **** 1234) is recorded with the payment result.
• My Tickets / My Orders: e-mail address, mobile phone number and a one-time verification code sent to that number, used to display past tickets and orders.
• Your acceptance of the agreement and privacy notice at purchase is recorded together with the time and IP address.

Millî Saraylar Yönetim (staff)

• Directorate user details (user name, full name, permissions) and a one-time verification code sent to the registered mobile phone.
• Reports shown in the app are the Directorate's ticket sales and visitor statistics.
• Report files exported by the user (Excel/PDF) are shared only with the app the user chooses.

Millî Saraylar Acente (agencies)

• Agency user details (e-mail, full name, agency name) and a one-time verification code sent to the agency's registered mobile phone.
• Balance, balance top-ups, membership payments, QR tickets and entry records.
• Card details for top-ups and membership payments are processed as described under Payment above. No card details are collected for bank transfers.

3. Data stored on your device and device permissions

• Session (Yönetim, Acente): a session key is kept in the device's secure storage (iOS Keychain / Android Keystore) so you stay signed in, and it is deleted when you sign out.
• App lock (Yönetim, Acente; optional): Face ID, Touch ID, fingerprint or device screen lock. Verification is performed only by the operating system. The apps do not access your biometric data, which never leaves your device and is never sent to the Directorate.
• Save to Photos (Acente): requested only if you choose to save a QR ticket image.
• The apps do not request access to location, camera, microphone, contacts or calendar.
• The visitor app stores no personal data on the device; the shopping cart is cleared when the app is closed.

4. Advertising, tracking and analytics

The apps contain no advertising and no third-party software (analytics, advertising or tracking libraries) that tracks users across apps or websites or analyses their behaviour. Personal data is not used for marketing and is not sold.

5. Purposes and legal bases

Personal data is processed to sell and deliver tickets and books, to collect payments, to enable visitor entry, to run agency transactions, to give staff access to the reports they are authorised for, to secure accounts and prevent fraud, and to meet legal obligations.

The legal bases are those listed in Article 5 of Turkish Personal Data Protection Law No. 6698 (KVKK): establishment and performance of a contract, compliance with a legal obligation, establishment, exercise or protection of a right, and the legitimate interests of the data controller.

6. Who we share data with

Personal data is shared only as required to provide the service:

• the General Directorate of Population and Citizenship Affairs – Identity Sharing System (KPS) to verify the identity of Turkish citizen visitors
• the bank for payments (virtual POS / 3D Secure): Türkiye Halk Bankası A.Ş.
• the SMS service provider for verification codes and notifications
• the Directorate's contracted courier company for book deliveries (name, phone and delivery address)
• public authorities where required by law (on request)

The Directorate's servers are located in Türkiye.

7. Retention

Ticket, order, invoice and payment records, together with the related consent and entry records, are kept for 10 years from the transaction date in line with financial legislation and the general limitation period; app sign-in and security logs are kept for 2 years; staff and agency account details are kept for the duration of the employment or contractual relationship and for 10 years after it ends. At the end of the period the data is deleted, destroyed or anonymised in the next periodic destruction cycle.

8. Security

All communication between the apps and the Directorate's servers is encrypted (HTTPS/TLS). The card number and security code are not stored. Session data is kept in the device's secure storage. Staff and agency sign-in uses two-step verification (SMS code).

9. Children

The apps are not directed at children. For children's tickets, visitor details are entered by the adult purchasing the ticket.

10. Your rights and requests (including deletion)

Under Article 11 of KVKK, you have the right to learn whether your personal data is processed, request information, request correction or deletion, object to processing, and claim compensation for damages.

11. Deleting your data

You can ask us at any time to delete the personal data processed when you use our apps. You do not need to have an account or to have the app installed to make this request.

Data that is deleted

• Visitor app: your contact details (e-mail, phone) that are not subject to a legal retention obligation, and the related notification records, are deleted or anonymised so that they can no longer be linked to you.
• Staff app: your account is closed by the Directorate and your app access is removed.
• Agency app: the agency representative's account is closed; the representative's contact details are deleted or anonymised.
• Data on your device: uninstalling the app removes the session data and preferences stored on the device.

Data that is kept

Ticket, order, invoice and payment records, together with the transaction records needed to evidence them (consent, transaction time, masked card number, sign-in and entry records), continue to be kept for 10 years from the transaction date in line with financial legislation and the general limitation period; sign-in and security logs are kept for 2 years. When those periods end, this data is also deleted, destroyed or anonymised. If your deletion request can therefore only be met in part, our reply states which data is kept and on what grounds.

12. Changes

This policy may be updated. The current version is always published on this page with its effective date.

Related documents: Policies and Agreements (Privacy Notice, Privacy and Security Policy, Distance Sales Agreements).