1. Data controller
Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is Disparco Bilişim Medya ve Teknoloji Ticaret Limited Şirketi ("Disparco"). Ortamix is Disparco's background music service for businesses: the website, the management panel and the Ortamix app that runs on the device in the venue.
This notice is for people who visit ortamix.com, who use the management panel or the Ortamix app on behalf of our customers, who scan the QR code on a license certificate, and for the rights holders of the works in the catalogue.
Address: Recep Tayyip Erdoğan Mah. Aziz Yıldırım Cad. 4. Ada 7. Blok No: 11 İç Kapı No: 14, Merkez / Bingöl, Türkiye
Email: [email protected]
Contact person for requests: Sezer Esen
2. Personal data processed
Depending on your relationship with Ortamix, your personal data is processed in these groups:
- Website visitors: transaction security data (IP address and browser information; session and security cookies, see the Cookie Policy).
- Panel and app users (business owners and branch staff): identity (name), contact (email address), user account (an irreversible hash of the password, role, assigned branches), transaction security (IP address and browser information of the session; in the app, the name and platform of the device used to log in, the app version, a random installation identifier and the time of last use; only an irreversible hash of the login token is stored, not the token itself).
- User actions: commands given as a remote (skip, like, dislike, volume, pause, change playlist, play an announcement) and the user who gave them; like and dislike records.
- Business and branch details: business name and type, tax office and tax number for invoicing (received from Disparco's management system), branch name, address, floor area, opening hours and time zone. Your device's GPS location is not collected; only the branch's time zone is used so that the schedule runs at the right time.
- Devices in the venue: device name, platform (Android, Android TV, Windows), app version, last seen time and last reported status (track playing, progress, volume, cache usage), the user who added the device.
- Play records: which track was played or skipped at which branch, on which device, when and for how long; if done from a remote, the user who did it.
- Announcements: the audio file uploaded or the announcement text written by the business, and the chosen voice.
- People verifying a license certificate: the page opened by the QR code only shows the business and branch name, the period and whether the certificate is valid; no identity is asked, only transaction security data (IP address) is processed.
- Rights holders of catalogue works: name of the artist and rights holder, role in the work (composer, lyricist, performer, producer), collecting society membership status and date checked, contract or permission record.
No special categories of personal data are processed.
3. Purposes
- Concluding and performing the contract: setting up accounts, branches and devices; playing music by schedule; providing the panel, the app and the remote,
- Preparing a license certificate for each branch and making it verifiable by QR code,
- Providing play history and reports to the business; calculating the share payable to the rights holders in the catalogue,
- Recording the chain of rights of every work in the catalogue and playing only works with complete rights,
- Voicing text-to-speech announcements,
- Sending account opening, password setup and password reset emails,
- Information security; preventing unauthorised access, repeated wrong login attempts and misuse,
- Meeting legal obligations and informing competent authorities,
- Handling requests and complaints.
4. Method of collection and legal grounds
Your personal data is collected electronically, partly by automated means, through the website, the management panel and the Ortamix app. Business details and the business owner's account are transferred from Disparco's own management system when the subscription is opened.
Your data is processed on these legal grounds under KVKK Art. 5/2: (c) it is directly related to concluding or performing a contract, (ç) it is necessary for the data controller to meet a legal obligation, (e) it is necessary to establish, exercise or protect a right (rights records of works and the license certificate), (f) it is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (information security). No processing is based on explicit consent.
5. Transfers
Your personal data is not sold. It may be transferred only as far as the service requires, to:
- Suppliers of hosting, email delivery and technical infrastructure,
- Cloudflare, Inc. (USA), which carries the traffic of the website and the app for security and speed: your requests (including IP address and browser information) pass through Cloudflare's servers. This is a transfer of personal data abroad.
- If text-to-speech announcements are used, the announcement text and the chosen voice are sent to Google LLC's Cloud Text-to-Speech service to be voiced. This is also a transfer of personal data abroad, so no names, phone numbers or other personal data should be written in announcement texts. The same text and voice are not sent twice; the earlier voicing is reused.
- A monthly report to Disparco Music to calculate payments to rights holders in the catalogue: it only contains the track, the artist name and the counted plays; it contains no business or user details.
- The business that is our customer: the business owner sees in the panel the account details, actions and play records of staff at their own branches,
- Public authorities authorised by law.
6. Retention
Your personal data is kept for as long as the purpose of processing requires and for the periods set by the relevant legislation. When the period ends it is deleted, destroyed or anonymised. Some periods run automatically in the system:
- Remote commands are deleted after 7 days.
- App and remote logins expire if unused for 90 days.
- Text-to-speech voicings are deleted after 90 days if no announcement uses them.
- Play records and rights records of works are kept for the duration of the contract and the statutory limitation periods, for payments to rights holders and as proof for the license certificate.
7. Your rights
Under KVKK Art. 11 you have the right to apply to Disparco to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions in KVKK Art. 7,
- request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
- object to a result against you arising solely from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
8. How to apply
You can send your requests in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, to Recep Tayyip Erdoğan Mah. Aziz Yıldırım Cad. 4. Ada 7. Blok No: 11 İç Kapı No: 14, Merkez / Bingöl, Türkiye, or from the email address registered with us to [email protected]. Requests are answered free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Personal Data Protection Board may apply.