KVKK Policy

POLICY ON PROCESSING AND PROTECTION OF PERSONAL DATA IN ACCORDANCE WITH LAW ON THE PROTECTION OF PERSONAL DATA NO 6698 INFORMATION TEXT

Various personal data belonging to the stakeholders of the May 17 Association are processed in accordance with the Law on the Protection of Personal Data (KVKK) numbered 6698, by the May 17 Association which operates within the framework of the Associations Law as the data controller. The purpose and method of processing and transfer of personal data are explained below.

Definitions

For the purposes of this Processing and Protection of Personal Data Information Text the following definitions shall apply:

Personal data: all the information relating to an identified or identifiable natural person,

Law (“KVKK”): Law on Protection of Personal Data No. 6698 published in the Official Gazette on April 7, 2016,

The Association: May 17 Association,

Activity: activities of which the association is part of the organization, alone or together with partners,

Data Owner: persons participating in activities that are organized by the association or together with partners,

Data Processor: the natural or legal person who processes personal data on behalf of the controller upon their authorization,

Data Controller: the Association,

Text: this Policy on Processing and Protection of Personal Data Information Text.

Data Controller

Your personal data that you share with the ASSOCIATION as a Member and/or Data Owner in accordance with the KVKK; will be evaluated by the Data Controller within the scope stated below.

Method, Purpose, and Legal Reason for Collection of Personal Data

2.1. Your personal data is being obtained due to legal obligations arising from association membership, for the execution of the contracts you have made with the association including the subscription to the magazine, for the execution of your employment contract with the association, the legally mandatory information requested by the association due to your election to the organs of the association, to continue to communicate with you for your participation in the activities of the association, or in order to document your participation for the purpose of executing the contract made with the organizations that fund the event, to publish your articles at the association's media organs, to continue the journalism activities on the news website supported by the association within the scope of freedom of expression, to prepare accommodation and transportation contracts in the events with accommodation and/or remote events, to establish and execute attorneyship, work, partnership contracts.

2.2. No private personal data is requested in any way. The information requested during the event is limited to name-surname, phone number, e-mail address. Information necessary for the payment, transportation, and accommodation can be obtained if there is a request for these services from the participants or instructors attending the event.

2.3. In addition, photographs of the event taken with the prior consent can also be used for the association's annual report or reports prepared for funding institutions. These reports can be announced to the public through social media tools. The data obtained in this way can be obtained and processed for the purposes specified in this text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK in accordance with the basic principles stipulated by the KVKK in order to provide the services of the association within the determined legal framework. Transfer of the data can only be possible if the laws and decrees of the Republic of Turkey require, on legal or contractual justifications of the funding organization.

Purpose of the Association

The purpose of the association is to contribute to the construction of an equal and free society by carrying out scientific, cultural, social, artistic and educational activities to combat all kinds of discrimination at the individual or social level, as well as by conducting social work, advocacy, awareness and human rights monitoring, documentation and reporting in the field of sexual orientation, gender identity, sexual expression and sexual characteristic based discrimination.

Processed Personal Data and Purpose of Personal Data Processing

4.1. Processed Personal Data:

Your personal data, provided by you during the event and/or for the fulfillment of the service, which may be subjected to the processing as an example, is as follows:

Identity Data	Name-surname, Republic of Turkey ID number, Date of Birth, Place of Birth,
Communication Data	Phone number, e-mail address (internal phone number, corporate e-mail address), contact address
Audiovisual Data	Photo
Financial Data	Bank account information
Occupation	Title

4.2. Purpose of Personal Data Processing: Based on your express consent, in accordance with Articles 4, 5 and 6 of the KVKK, your personal data will be processed and kept by the association, to ensure accountability to fund organizations, state institutions and association audit bodies, in compliance with the following principles,

a) Lawfulness and conformity with rules of bona fides.

b) Accuracy and being up to date, where necessary.

c) Being processed for specific, explicit and legitimate purposes.

d) Being relevant with, limited to and proportionate to the purposes for which they are processed.

e) Being retained for the period of time stipulated by relevant legislation or the purpose for which they are processed to be used only within the purpose and scope specified in this Text and with necessary data security measures.

4.3. Conditions Where Personal Data May Be Processed Without Consent

Your personal data may be processed without seeking explicit consent in accordance with paragraph 2 of Article 5 of the Law only in cases where one of the following conditions is met:

a) It is clearly provided for by the laws.

b) It is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving their consent or whose consent is not deemed legally valid.

c) Processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfillment of that contract. For example, non-specific personal data may be processed within the scope of this article for the establishment and execution of magazine subscriptions, service/exception/work/commitment agreements, and other atypical agreements,

d) It is mandatory for the data controller to be able to perform their legal obligations. For example, if you are elected to the organs of the association, the compulsory information requested by the relevant organ of the state, and the information to be collected according to the relevant regulation for official membership may be processed without consent.

e) The data concerned is made available to the public by the data subject themselves.

f) Data processing is mandatory for the establishment, exercise or protection of any right.

g) It is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject. In the cases that our institution has covered expenses for personal accommodation and transportation for participation in events; fulfillment of internal audit procedures stated in our association's statute; audits of fund providers; external financial audits; depending on the audits arising from the accountability to the central and provincial organizations of the Ministry of Internal Affairs, Governorships, District Governorships and General Directorate of Civil Society, expenditure records and related non-private data and documents may be processed.

Transferring and/or Sharing Personal Data

The data specified in Article 4, which are mandatory for transportation and accommodation, are taken and transferred to the travel agency that undertakes the service procurement of the May 17 Association for the purpose of preparing flight tickets and accommodation reservations.

Communication data will be stored for the purpose of the association to reach you in line with its activities and for this purpose only.

The association does not transfer your personal data abroad.

Data Storage Durations

Identity Data Requested for the Event	May 17 Association carries out keeps signature books during the events. Participation records of the activities, which include name and surname are available to the independent audit firms and the funding agency for ten years to document that the expenses are made in accordance with the project objectives. Following this duration records are destroyed.
Communication Data Obtained During the Event	May 17 Association does not request the contact information of individuals, but if the person has shared their contact information such as e-mail, telephone number in order to be informed about the upcoming events, this contact information is not shared with third parties. However, if the event is being held together with another association, bar association, government agency, etc., this means that the relevant institution can also access that information. This information is kept at the May 17 Association for ten years in order to communicate with the relevant person. If the person has notified their consent to communicate before this ten year period, the ten-year period will re-start after this last notification.
Accommodation or transportation-related identity data	May 17 Association requests the information necessary for the accommodation and transportation contracts from the out-of-town participants, who request to participate in its events. During the use of this information, the provisions of the KVKK are complied with and relevant data is destroyed after the end of the business process.
Photos	Although the website of the May 17 Association is subject to the press organizations laws as a media portal, employees of the May 17 Association do not take photographs of the individuals without their explicit consent and employees make the necessary explanations in collective photo shoots. This rule does not apply to photographs taken in a manner that keeps the individuals' identities anonymous.
Shared Data for the Subscription Contracts	If the legal regulations do not require a longer storage period, subscription data is stored with the explicit consent of the subscriber for the purpose of inviting the subscriber to re-subscribe one more year after the end of the contract. However, invoices arising from the subscription agreement and the documents to which they are attached are kept for ten years since the economic enterprise of the association has obligations according to the Tax Procedure Law and the Turkish Commercial Code.
Contract Data of Service Providers to the May 17 Association	Ten years, unless legal regulations require a longer storage period.
Other Contracts	Ten years, unless legal regulations require a longer storage period.
Data Obtained During Online Consultancy	May 17 Association does not request personal information or identity information of individuals in its web-based consultancy. Also, regardless of the scope of the personal information provided by the consultee, the e-mail content will be deleted in the first month of the year following the last correspondence.
Personnel Information	Stored for 15 years

Measures Regarding Protection of Personal Data

The protection of personal data is an important issue for the association. The association takes the necessary measures to protect personal data against unauthorized access or loss, misuse, disclosure, alteration or destruction of this information. The Association guarantees to keep your personal data confidential, to take all necessary technical and administrative measures and to show the necessary care to ensure privacy and security. Although the association takes the necessary data security measures, in the event that personal data is damaged as a result of attacks on the website and the system or is obtained by third parties, the association immediately notifies you and the Personal Data Protection Board of Turkey.

Rights of Personal Data Owner Listed in Article 11 of KVKK

As personal data owners, if you submit your requests regarding your rights to the association using the methods set out in this Text, the association will finalize the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board of Turkey, the fee determined by the association will be charged. In this context, personal data owners have the following rights;

to learn whether their personal data are processed or not,

to request information if their personal data are processed,

to learn the purpose of their data processing and whether this data is used for intended purposes,

to know the third parties to whom their personal data is transferred at home or abroad,

to request the rectification of the incomplete or inaccurate data, and to inform third parties regarding the inaccurate data,

To request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, despite the fact that it has been processed in accordance with the provisions of the KVKK and other relevant laws, and to request notification of the transaction made within this scope to third parties to whom the personal data has been transferred,

to object to the processing, exclusively by automatic means, of their personal data, which leads to an unfavorable consequence for the data subject,

to request compensation for the damage arising from the unlawful processing of their personal data.

In addition, if you have incompletely or incorrectly processed personal data, or if there is any change in your processed personal data, you can submit a written application to the association to inform the association if you wish to change, update and withdraw your explicit consent.

According to Article 13/1 of the KVKK, to use your above-mentioned rights you can submit your request to the association in writing or by other methods determined by the Personal Data Protection Board of Turkey. Within this framework, the channels and procedures you will use to submit your application in writing to the association within the scope of Article 11 of the KVKK are explained below.

In order to use your rights stated above, you can fill in the Application Form in ANNEX-1, which includes the necessary information identifying your identity and your explanations about your request to use the rights specified in Article 11 of KVKK; submit a signed copy of the form to “Mithatpaşa Cd. 10/11 Kızılay/Ankara/Turkey ”address by hand together with your identification documents, or send it via other methods specified in KVKK, or send the relevant form to info@17mayis.org with a secure electronic signature.

Changes

The Association can make changes in this text at any time. These changes become effective immediately upon the posting of the new, modified Information Text on Processing and Protection of Personal Data on the www.17mayis.org website. You will be informed about the changes in this text.

Applicable Law, Authorized Courts, and Enforcement Offices

About this Information Text on Processing and Protection of Personal Data is subject to the laws of the Republic of Turkey. Ankara Central Court and Enforcement Offices are authorized to resolve any disputes that may arise from the implementation of this text.