Compliance Management Policy

1. Purpose

To explain how hangel keeps track of its legal obligations, agreements and its own policies, and how this policy library is managed.

2. Scope

The main rules that apply to the International Social Benefit Association and the hangel platform: Türkiye's Law on Associations (No. 5253), the Personal Data Protection Law (KVKK, No. 6698), Law No. 5651, the E-Commerce Law (No. 6563), tax legislation, the GDPR for EU users, and Apple App Store and Google Play rules; the policies in this library and user and organisation agreements.

3. Principles

1. Single source. Policy texts are kept in one place; each policy states its version, effective date, owner and review frequency.
2. Don't write what you don't do. Policies describe only what is actually done; something that is not done but is intended is written as a "goal".
3. Announce changes. Substantial changes to agreements are announced to users and previous versions are kept.
4. Provable acceptance. It is recorded which text, in which version, a user accepted.
5. Report contradictions. When a contradiction is found between a policy and practice, or between two texts, the text is not changed silently; it is reported to the Board of Directors.

4. Roles and responsibilities

• Board of Directors: approves policies and decides on contradictions.
• Policy owners: each policy is updated according to its own review frequency.
• Lawyer: reviews legal texts and the legal questions raised.
• Super-admins: monitor acceptance records, data requests and breach records in the legal desk.

5. How it works at hangel today

• Policy library: These policies are kept as full Turkish and English texts in a single source, with version and effective-date information.
• Agreement version: The version date of the agreement set is written to users' acceptance records; acceptance records cannot be changed from the app.
• Change history: Changes to agreements are listed on a public page; the full text of previous versions is kept in an archive; the "Our agreement has been updated" e-mail and notification link to this page.
• Text by country: The relevant version of an agreement is shown according to the user's country; a rule-based check scores whether the topics required for each country are present in the text.
• Legal desk: Acceptance records, KVKK data requests and breach records are monitored in the super-admin panel.
• Correspondence with organisations: Correspondence with partners, public bodies and networks is kept in a single file per organisation.
• App store rules: App store requirements such as child safety standards, content reporting and blocking are implemented in the app and published at hangel.org/child-safety.

6. Not yet in place and our goals

• There is no appointed compliance officer or compliance committee.
• No compliance calendar showing legal obligations, owners and deadlines is kept.
• There is not yet a flow for collecting re-acceptance from existing users after a substantial change to an agreement.
• The policies in this library overlap with existing agreement and policy texts; which text prevails will be decided after legal review.
• No independent compliance audit of the policies has been carried out.

7. How to raise a concern

Compliance questions: info@hangel.org. Non-compliance or misconduct: kvkk@hangel.org (subject "Whistleblowing — Confidential").

8. Review

At least once a year; each policy also on its own schedule.

9. Related documents

Risk Management Policy · Code of Ethics · Existing "Corporate Risk and Compliance Committee Statement" and "Development Roadmap and Standards Not Yet Met Statement" · Agreement change history