Privacy Policy (Summary and Links)

1. Purpose and place of this document

The binding and detailed text describing how hangel processes personal data is the Privacy Policy published on the site (hangel.org/gizlilik-politikasi). A short bilingual summary prepared for the Chrome extension and the app stores is at hangel.org/privacy. This document holds the privacy policy's place in the policy library: it summarises our privacy principles and links to the detailed texts. If this summary and the Privacy Policy differ, the Privacy Policy prevails.

2. Scope

The hangel.org website, the hangel iOS and Android apps, the hangel Chrome extension and related services (including Oda meeting rooms). Data controller: International Social Benefit Association (Social Business Global), association registry no. 34-262-102.

3. Principles

1. We collect only the data needed for the service.
2. Every processing activity has a stated purpose and legal basis; we do not use data beyond that purpose.
3. We do not sell personal data.
4. Health data (blood group, health information related to volunteering) is processed only with explicit consent.
5. Marketing messages are sent only to people who have agreed; consent can be withdrawn at any time.
6. Analytics and marketing cookies run only with consent.
7. We say openly where data is stored.

4. Roles and responsibilities

• Data controller (the Association): decides the purposes and means of processing and answers requests.
• Super-admins: access user data only when their duties require it.
• Organisation administrators (NGOs, clubs, brands): use the data of people who apply to their events and listings only for that activity.
• Service providers: providers such as Google Cloud/Firebase process data on our behalf (Supplier and Third-Party Policy).

5. How it works at hangel today

• Data location: The database is in Europe (eur3: Belgium and the Netherlands), the application server in the Netherlands and scheduled jobs in Belgium. Uploaded photos and documents are kept in file storage in the United States, and a few background functions, such as sending notifications, run in the United States. Oda meeting recordings are kept in a separate storage bucket in the United States.
• Your rights: In the app, under Settings → Privacy, you can submit requests for information, correction, erasure and objection, and you can delete your account (Personal Data Protection Policy).
• Cookies: Analytics and marketing are consented to separately; without consent they do not run (Cookie Policy).
• Error monitoring: Error reports do not include names, e-mail addresses or user IDs and are kept in a European data region.
• Test accounts: No notifications or e-mails go to real people from test accounts.

6. Not yet in place and our goals

• No EU representative under GDPR Article 27 has been appointed, and there is no appointed Data Protection Officer (DPO).
• Keeping uploaded files in storage in the United States is an international transfer; its basis is explained in the Privacy Policy and the Data Transfer and Hosting Statement. There is no decision yet to keep files in a European region.
• Written data protection impact assessments are not yet carried out routinely for every new feature; our goal is to make them mandatory for high-risk processing (health data, location, children).

7. How to raise a concern

Personal data requests and privacy questions: kvkk@hangel.org or Settings → Privacy in the app. Requests are answered within 30 days at the latest, as required by Article 13 of the KVKK.

8. Review

At least once a year, whenever a new processing activity or a new service provider is added and whenever the data location changes.

9. Related documents

Privacy Policy (hangel.org/gizlilik-politikasi) · hangel.org/privacy · KVKK Information Notice · Explicit Consent Text · Personal Data Protection Policy · Cookie Policy · Data and Records Retention and Destruction Policy · hangel.org/guvenlik