KVKK Privacy Notice

1. Data controller

Data controller: Sakarya Mısırlı Öğrenciler Topluluğu

Address: Sakarya, Türkiye

Email: to be added

2. Personal data we process

Depending on your relationship with us, we process:

• Volunteer applicants: full name, phone, email (optional), university, faculty/department, committees of interest, availability, skills and your message.
• Businesses applying to partner: business name and category, address, contact person name, phone and email, proposed discount and notes.
• Membership applicants and members: full name, email, phone, university, department, student number, student certificate (öğrenci belgesi), portrait photo, member ID, membership start and end dates, application status and account password (stored only in irreversibly hashed form).
• Event participants: photos and videos taken at events.
• All visitors: a session cookie for signed-in users; IP addresses and request logs kept briefly by our hosting provider for security; your IP address used temporarily (at most 15 minutes, in memory only) to prevent form abuse.
• Consent records: the date and time you confirmed reading this notice in a form, and the language you used.

We don't ask for special categories of personal data (health, religion, ethnic origin, etc.); please don't include such information in message fields.

3. Purposes

• Reviewing volunteer and partner applications and contacting you,
• Reviewing membership applications, verifying student status, issuing the digital member card and its QR verification,
• Planning, announcing and running events,
• Verifying member discounts at partner businesses,
• Securing the site, preventing abuse and recording administrator actions,
• Meeting legal obligations and responding to requests from competent authorities.

4. Legal bases

• KVKK Art. 5/2-c: processing directly related to establishing or performing the membership, volunteering or partnership relationship,
• KVKK Art. 5/2-ç: compliance with a legal obligation of the data controller,
• KVKK Art. 5/2-e: establishing, exercising or protecting a right,
• KVKK Art. 5/2-f: our legitimate interest, provided it does not harm your fundamental rights and freedoms (site security, abuse prevention, action logs),
• KVKK Art. 5/1: your explicit consent, for processing not covered above, such as publishing event photos of you on our social media. You can withdraw consent at any time.

5. How we collect data

Through the volunteer, partner and membership forms on this site, your site account, email, WhatsApp and Telegram conversations and at events, by fully or partly automated means or non-automated means.

6. Transfers

• Partner businesses: scanning the QR code on a member card shows only your name, photo, member ID and whether your membership is valid.
• Universities and public authorities: only where a legal obligation requires it or at your request, to the extent necessary.
• Service providers (data processors): site and database hosting (Heroku / Salesforce, European Union region) and file storage (Cloudflare R2). As their servers are outside Türkiye, transfers are made under KVKK Art. 9 with appropriate safeguards such as the standard contracts announced by the Board.

We don't sell your personal data or share it for advertising.

7. Retention

• Volunteer applications: 1 year after a decision; if you start volunteering, for the duration and 1 year after.
• Partner applications: 1 year if no agreement is reached; 2 years after a partnership ends.
• Student certificate: at most 30 days after the membership application is decided.
• Membership records and card photo: for the duration of membership and 1 academic year after it ends.
• User account: until you ask us to delete it.
• Administrator action logs: 2 years. Hosting server logs: briefly, per the provider’s policy.

Data past its retention period is deleted, destroyed or anonymised.

8. Your rights under Article 11

• To learn whether your personal data is processed and request information about it,
• To learn the purpose of processing and whether data is used accordingly,
• To know the third parties in Türkiye or abroad to whom data is transferred,
• To request correction of incomplete or inaccurate data,
• To request deletion or destruction under the conditions of Article 7,
• To request that corrections, deletions or destructions be notified to recipients,
• To object to an outcome against you arising solely from automated analysis,
• To claim compensation for damage caused by unlawful processing.

9. How to apply

Under the Communiqué on Application Procedures to the Data Controller, you can send requests in writing to the address above, by registered email (KEP), secure electronic or mobile signature, or from the email address registered with us to to be added. Include your full name, a contact detail and the subject of your request.

We respond free of charge within 30 days at the latest; if the action involves an extra cost, the fee set by the Board may be charged.