Privacy Policy (EU)
Informational English version. hangel is operated by Social Business Global (International Social Benefit Association), Türkiye. Effective: 31 August 2026.
1. Controller
The controller of your personal data is Social Business Global (International Social Benefit Association), an association registered in İstanbul, Türkiye (Social Business Global (International Social Benefit Association) · Registry no: 34-262-102 · Tax office / number: 8900445615 · Registered address: Maslak Meydan Sk. Beybi Giz Plaza A Blok No 1 İç Kapı 26, Sarıyer 34485 İstanbul).
- Data protection contact: privacy@hangel.org
- Türkiye (KVKK) contact: kvkk@hangel.org
This notice applies to users of the hangel app and hangel.org in the EU/EEA, including Hungary and Germany. The Turkish-language privacy documents are the master versions; this English version is provided for convenience and prevails only to the extent permitted by law. Your mandatory GDPR rights are unaffected.
2. EU representative and DPO — current status
Social Business Global is established only in Türkiye and has no EU subsidiary or branch. An EU representative under Article 27 GDPR has not yet been appointed; one will be appointed before hangel actively targets users in the EU. hangel has not designated a data protection officer; data-protection questions go to privacy@hangel.org.
3. What we collect
- Account and contact data — name, email address, phone number, sign-in identifiers (Google or Apple sign-in).
- Profile data you choose to add — city, interests, the NGOs you support.
- Blood type (optional) — special-category health data, processed only with your explicit consent for the blood-donor matching feature (Article 9(2)(a) GDPR). You can withdraw this consent at any time.
- Approximate location — only with your device permission, e.g. for nearby blood requests or listings.
- Affiliate click and conversion identifiers — a click ID when you open a partner store through hangel, and the conversion parameters (such as order value and status) the affiliate network reports back.
- Device and usage data — IP address, device model, OS and app version, crash logs, push token. Analytics events are collected only after your consent.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and operating your account; core platform features | Contract — Art. 6(1)(b) |
| Attributing purchases to your account so the donation model works; showing "My Donations" | Contract — Art. 6(1)(b) |
| Blood-donor matching using your blood type | Explicit consent — Art. 9(2)(a) with Art. 6(1)(a) |
| Approximate location features | Consent — Art. 6(1)(a) |
| Analytics (Firebase Analytics) | Consent — Art. 6(1)(a) |
| Security, fraud and abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Compliance with legal obligations (mainly Turkish law) | Legal obligation — Art. 6(1)(c) |
| Optional marketing messages | Consent — Art. 6(1)(a) |
Consent can be withdrawn at any time with effect for the future, in the app or via privacy@hangel.org.
5. Recipients
- Google (Google Cloud / Firebase) — hosting, authentication, storage, analytics after consent.
- Apple — app distribution, Apple sign-in, push notifications.
- Affiliate networks — only the limited identifiers needed for commission attribution (click ID, conversion parameters). Your name and email are not shared with them.
- Organisations or users you choose to interact with — e.g. when you apply to a volunteering listing or respond to a blood request.
- Authorities — where disclosure is legally required.
hangel does not sell personal data and uses no third-party advertising networks.
6. International transfers (Articles 44–49)
Social Business Global operates from Türkiye, and the application is served from Google Cloud region europe-west4 (Netherlands). Your data may nevertheless be processed on Google Cloud and Apple infrastructure in other countries and is accessed from Türkiye. hangel relies on Google's and Apple's standard data-processing terms, which incorporate the EU Standard Contractual Clauses, and is formalising its own transfer documentation. hangel does not claim EU-only data residency or any transfer certification.
7. Retention
- Account and profile data: kept while your account exists; deleted or anonymised after account closure, except where Turkish commercial, tax or liability rules require longer retention.
- Blood type: deleted when you withdraw consent or delete your account.
- Affiliate click and conversion records: kept as long as needed for donation accounting and statutory record-keeping.
- Analytics data: retained no longer than 12 months.
8. Your rights (Articles 15–22)
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right not to be subject to solely automated decisions with legal or similarly significant effect (Art. 22). hangel makes no such automated decisions.
To exercise your rights, write to privacy@hangel.org or use the in-app account settings. We may need to verify your identity, and we respond within one month (extendable as GDPR allows). Exercising your rights is free of charge.
9. Complaints (Article 77)
You can lodge a complaint with the supervisory authority of your member state of residence, workplace or the place of the alleged infringement — for example NAIH in Hungary, the BfDI or your competent state data-protection authority in Germany, or any other EU/EEA supervisory authority. In Türkiye, the competent authority is the Personal Data Protection Authority (KVKK).
10. Children
hangel is intended for users aged 18 or over and is not directed at children. As the only exception, residents of the EU/EEA aged 16 or 17 may register in a limited mode: parental consent is declared and recorded at signup (verification steps are being phased in), and in limited mode the blood-donor matching feature and marketing communications are disabled. The blood-type feature remains available only to users aged 18 or over. We do not knowingly collect data of anyone under 16; see the Children's Data Policy (EU).
11. Changes
We will announce material changes to this notice in the app or by email before they take effect.
12. Google user data
If you are an organisation administrator and connect a Google account to hangel, hangel uses the Google Meet and Google Drive permissions only to create meeting spaces for your online events, to read the attendance records of those spaces for attendance and participation certificates, and to store recordings made in hangel's own meeting room. Data received from Google APIs is not sold, not used for advertising and not used to train artificial intelligence models. Details: Privacy Policy — Google user data.
If you sign in with Google, hangel receives only your Google account identifier, verified e-mail address and name; if you connect Google Calendar, hangel writes the events you registered for only to a separate “hangel” calendar it creates in your account and does not access your other calendars.
In addition, any user may connect their own Google Drive with the drive.file permission only: hangel then fetches only the file you choose in the Google Picker into the action you started (it is not stored permanently) and, at your request, creates or updates in your own Drive a Google Doc or Sheet of content you can already see and download in the panel (project application, meeting notes, participant and attendance lists, etc.). If you pass a chosen file to an AI-powered action, its text is processed only for that request and is not used to train any model.
hangel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
YouTube: if an organisation administrator connects their own YouTube channel, hangel uses the youtube.force-ssl permission only to create, start and end live broadcasts on that channel for Oda events; the stream key is kept only on the server. This feature uses YouTube API Services; by using it you agree to the YouTube Terms of Service. How Google processes data: Google Privacy Policy.
You can withdraw access with the disconnect button in the hangel panel or at https://myaccount.google.com/permissions.