Personal Data Protection Policy (KVKK)

1. Purpose

To explain which processes we run as data controller under Türkiye's Personal Data Protection Law No. 6698 (KVKK), how data subjects can exercise their rights and how those rights are handled on the platform. For users in the European Union, the General Data Protection Regulation (GDPR) is also taken into account.

2. Scope

All personal data processing by the International Social Benefit Association (operator of the hangel platform) relating to platform users, organisation representatives, volunteers, event participants, speakers, people who use the contact form and the Association's employees.

3. Principles

We apply the general principles of Article 4 of the KVKK: lawfulness and fairness; accuracy and being kept up to date; specified, explicit and legitimate purposes; relevance, limitation and proportionality; and retention only for as long as necessary. Special categories of personal data (health data) are processed only with explicit consent.

4. Roles and responsibilities

• Data controller (the Association, Board of Directors): approves the processing inventory and the information notices and consent texts.
• Request handler (the authorised person who monitors kvkk@hangel.org): records requests and makes sure they are answered within 30 days.
• Super-admins: follow the "Data Requests" list in the admin panel and update its status; access personal data only when their duties require it.
• Organisation administrators: use the data of people who apply to their activities only for that activity and do not export it elsewhere.

5. How it works at hangel today

• Information and consent: The information notice, the explicit consent text and the agreements are published in the app. Acceptances and consents are stored as records that cannot be changed or deleted from the app (who, which text version, when).
• Separate consents: Separate, optional consent is collected for health data (blood group and health information related to volunteering), marketing messages, the use of identifiable faces in event photos and sharing contact details through event name badges.
• Request form: Under Settings → Privacy, users can submit requests for information/access, correction, erasure, objection and other matters. Each request is linked to the person's account; to prevent abuse there is a limit of 5 requests per person per hour. Requests are listed in the super-admin panel and tracked as "open" or "answered".
• Account deletion: When deletion is requested in Settings, the account enters a 30-business-day waiting period; anyone who changes their mind during this time can ask for cancellation at destek@hangel.org. When it ends, an automated job that runs every night deletes the sign-in account, the user record and its sub-records, the public profile and notifications. Records that must be kept by law (acceptance of agreements and donation records) are not deleted; the field identifying the person is replaced with an irreversible hash. Every deletion is written to a destruction log without the real user ID.
• Age: People under 16 cannot register; 16–17-year-olds use a limited mode (Age Limit and Parental Consent Policy).
• International: Uploaded files and some background functions are in the United States; details are in the Privacy Policy and the Data Transfer and Hosting Statement.

6. Not yet in place and our goals

• There is no automatic countdown reminding us of the 30-day deadline for requests; it is tracked manually in the panel. Our goal is a reminder that warns before the deadline.
• Whether a standard contract and notification to the Personal Data Protection Board are required for international transfers under Article 9 of the KVKK is under review by our lawyer.
• Keeping the personal data processing inventory up to date as a single document is ongoing work.
• Account deletion does not yet cover the person's posts, event and volunteering application records, or files they uploaded such as profile photos (the CV file is deleted). Our goal is to bring these into the scope of deletion or anonymisation (Data Retention and Destruction Policy).
• There is no appointed Data Protection Officer (DPO).

7. How to raise a concern

kvkk@hangel.org or Settings → Privacy in the app. If you are not satisfied with our answer, you retain the right to complain to the Personal Data Protection Board (KVKK Kurulu).

8. Review

At least once a year; whenever the KVKK, secondary legislation or Board decisions change; and whenever a new category of data starts being processed.

9. Related documents

KVKK Information Notice · Explicit Consent Text · Privacy Policy · User Rights Policy · Data and Records Retention and Destruction Policy · Data Breach Response Policy · Age Limit and Parental Consent Policy