Privacy Policy (UK)
Informational English version. hangel is operated by Social Business Global (International Social Benefit Association), Türkiye. Effective: 31 August 2026.
1. Controller
The controller of your personal data under the UK GDPR and the Data Protection Act 2018 is Social Business Global (International Social Benefit Association), an association registered in İstanbul, Türkiye (Social Business Global (International Social Benefit Association) · Registry no: 34-262-102 · Tax office / number: 8900445615 · Registered address: Maslak Meydan Sk. Beybi Giz Plaza A Blok No 1 İç Kapı 26, Sarıyer 34485 İstanbul).
- Data protection contact: privacy@hangel.org
- Türkiye (KVKK) contact: kvkk@hangel.org
This notice applies to users of the hangel app and hangel.org in the United Kingdom. The Turkish-language privacy documents are the master versions; this English version is provided for convenience and prevails only to the extent permitted by law. Your mandatory rights under the UK GDPR are unaffected.
2. UK representative, ICO registration and DPO — current status
Social Business Global is established only in Türkiye and has no UK subsidiary or branch. A UK representative has not yet been appointed, and hangel is not yet registered with the ICO; both will be completed before hangel actively targets users in the UK. hangel has not designated a data protection officer; data-protection questions go to privacy@hangel.org.
3. What we collect
- Account and contact data — name, email address, phone number, sign-in identifiers (Google or Apple sign-in).
- Profile data you choose to add — city, interests, the NGOs you support.
- Blood type (optional) — special-category health data, processed only with your explicit consent for the blood-donor matching feature. You can withdraw this consent at any time.
- Approximate location — only with your device permission, e.g. for nearby blood requests or listings.
- Affiliate click and conversion identifiers — a click ID when you open a partner store through hangel, and the conversion parameters (such as order value and status) the affiliate network reports back.
- Device and usage data — IP address, device model, OS and app version, crash logs, push token. Analytics events are collected only after your consent.
4. Purposes and lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and operating your account; core platform features | Contract |
| Attributing purchases to your account so the donation model works; showing "My Donations" | Contract |
| Blood-donor matching using your blood type | Explicit consent (special-category data) |
| Approximate location features | Consent |
| Analytics (Firebase Analytics) | Consent |
| Security, fraud and abuse prevention | Legitimate interests |
| Compliance with legal obligations (mainly Turkish law) | Legal obligation |
| Optional marketing messages | Consent |
Consent can be withdrawn at any time with effect for the future, in the app or via privacy@hangel.org.
5. Recipients
- Google (Google Cloud / Firebase) — hosting, authentication, storage, analytics after consent.
- Apple — app distribution, Apple sign-in, push notifications.
- Affiliate networks — only the limited identifiers needed for commission attribution (click ID, conversion parameters). Your name and email are not shared with them.
- Organisations or users you choose to interact with — e.g. when you apply to a volunteering listing or respond to a blood request.
- Authorities — where disclosure is legally required.
hangel does not sell personal data and uses no third-party advertising networks.
6. International transfers
Social Business Global operates from Türkiye, and the application is served from Google Cloud region europe-west4 (Netherlands). Your data may nevertheless be processed on Google Cloud and Apple infrastructure in other countries and is accessed from Türkiye. hangel relies on Google's and Apple's standard data-processing terms, which incorporate the EU Standard Contractual Clauses, and is formalising its transfer documentation, including what UK law requires for restricted transfers. hangel does not claim UK- or EU-only data residency or any transfer certification.
7. Retention
- Account and profile data: kept while your account exists; deleted or anonymised after account closure, except where Turkish commercial, tax or liability rules require longer retention.
- Blood type: deleted when you withdraw consent or delete your account.
- Affiliate click and conversion records: kept as long as needed for donation accounting and statutory record-keeping.
- Analytics data: retained no longer than 12 months.
8. Your rights
Under the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effect. hangel makes no such automated decisions.
To exercise your rights, write to privacy@hangel.org or use the in-app account settings. We may need to verify your identity, and we respond within one month (extendable where the law allows). Exercising your rights is free of charge.
9. Complaints
You can complain to the Information Commissioner's Office (ICO) — https://ico.org.uk — at any time, although we would welcome the chance to resolve your concern first via privacy@hangel.org. In Türkiye, the competent authority is the Personal Data Protection Authority (KVKK).
10. Children
hangel is intended for users aged 18 or over and is not directed at children. We do not knowingly collect children's data; see the Children's Data Policy (UK).
11. Changes
We will announce material changes to this notice in the app or by email before they take effect.
12. Google user data
If you are an organisation administrator and connect a Google account to hangel, hangel uses the Google Meet and Google Drive permissions only to create meeting spaces for your online events, to read the attendance records of those spaces for attendance and participation certificates, and to store recordings made in hangel's own meeting room. Data received from Google APIs is not sold, not used for advertising and not used to train artificial intelligence models. Details: Privacy Policy — Google user data.
If you sign in with Google, hangel receives only your Google account identifier, verified e-mail address and name; if you connect Google Calendar, hangel writes the events you registered for only to a separate “hangel” calendar it creates in your account and does not access your other calendars.
In addition, any user may connect their own Google Drive with the drive.file permission only: hangel then fetches only the file you choose in the Google Picker into the action you started (it is not stored permanently) and, at your request, creates or updates in your own Drive a Google Doc or Sheet of content you can already see and download in the panel (project application, meeting notes, participant and attendance lists, etc.). If you pass a chosen file to an AI-powered action, its text is processed only for that request and is not used to train any model.
hangel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
YouTube: if an organisation administrator connects their own YouTube channel, hangel uses the youtube.force-ssl permission only to create, start and end live broadcasts on that channel for Oda events; the stream key is kept only on the server. This feature uses YouTube API Services; by using it you agree to the YouTube Terms of Service. How Google processes data: Google Privacy Policy.
You can withdraw access with the disconnect button in the hangel panel or at https://myaccount.google.com/permissions.