Explicit Consent Notice on the Transfer of Personal Data Abroad

Why We Ask for Explicit Consent

Our website and volunteer area run on Google's cloud infrastructure (Google Cloud / Firebase). Our application servers are in the Netherlands; our database and the storage holding uploaded files are in data centres in the United States. The personal data you send through this site is therefore transferred outside Türkiye and stored there.

The transfer of personal data abroad is governed by Article 9 of Turkish Law No. 6698 on the Protection of Personal Data. The data you send through this site is transferred to servers abroad on the basis of your explicit consent under that article. This notice sets out the scope of the transfer and asks for your consent.

Data Covered by Your Consent

Your consent covers only the transfer abroad of the data you choose to send us through this site, together with the technical records kept to keep that data secure. The legal basis for processing this data is explained in the Personal Data Protection Notice:

Google reCAPTCHA, used for bot protection on the forms, and the site's usage measurement fall outside the scope of this consent: they rest on our legitimate interest rather than on explicit consent, and are explained in the Personal Data Protection Notice. The page summary feature is also outside the scope of this consent, as it does not transfer personal data.

• Contact form: your name, e-mail address, telephone number (optional), subject and message, along with the IP address, browser information and submission time recorded with it.
• Feedback form: your message, topic and any rating, optionally your name, e-mail address and screenshot, together with the page the feedback was sent from, the IP address, browser information and submission time.
• Volunteer application and volunteer account: name, e-mail address, telephone number, year of birth, education and occupation, city of residence, the volunteering areas you are interested in, your availability, the skills you list, alternative contact details and any documents you upload.

Recipients and Countries

• Google Cloud / Firebase (Google Ireland Limited and Google LLC): hosting, database and file storage. The application server is in the Netherlands; the database and uploaded files are in the United States.
• Firebase Authentication: verification of e-mail address and password when signing in to the admin panel and the volunteer area. Operated on Google infrastructure in the United States.
• Embedded content: Google Maps on the contact page, YouTube on the gallery page and FlipHTML5 on the e-magazine page. When you view this content your browser connects directly to the provider, and your IP address and browser information are sent to it.
• Google Workspace (Google LLC): forwarding submissions from the forms as notifications to the association's institutional e-mail address and storing them there; any screenshot sent with feedback is attached to the e-mail. Operated in Google's data centres, including those in the United States.

Possible Risks of the Transfer

Under Article 9(6) of the Law, you must be informed of the possible risks before you give explicit consent to a transfer abroad. The Personal Data Protection Board has not issued an adequacy decision for the United States or the Netherlands, where your data is transferred, and this transfer relies on your explicit consent rather than on the appropriate safeguards listed in Article 9(4) of the Law. The possible consequences are:

• Your data is processed and stored under a legal system that the Board has not found to offer protection equivalent to that in Türkiye.
• The authorities of these countries may, under their own laws, request access to your data from the service provider, and you may not be told about such access.
• Exercising your rights against a service provider abroad, or before the authorities of a foreign country, may be harder than doing so in Türkiye.
• A data security breach at the service provider may occur in systems outside the association's direct control.
• To reduce these risks, your data is encrypted in transit and at rest, can be accessed only by the association's authorised staff, and is deleted when the periods stated in the Privacy Notice expire.

Purpose of the Transfer

• Recording and answering your requests, questions and applications,
• Assessing the feedback you send through the accessibility menu and improving the accessibility of the site,
• Assessing volunteer applications and running volunteering processes,
• Keeping the website running and secure, preventing abuse and fixing technical faults.

What If You Do Not Consent?

You are not obliged to give consent. Because the forms and the volunteer account run on servers abroad, you cannot submit them without consent; this does not, however, prevent you from benefiting from the association's services. You can also reach us by phone or by writing to the postal address below. Please note that e-mails sent to beyazay@beyazay.org.tr are also processed abroad on the Google Workspace infrastructure.

Withdrawing Your Consent

You may withdraw your consent at any time without giving a reason. For your volunteer account you can do this yourself with the “Hesabımı sil” (Delete my account) button on the “Bilgilerim” (My details) page of the volunteer area. For other records, write to beyazay@beyazay.org.tr or to the postal address below.

Withdrawal takes effect for the future: from then on your data is no longer processed or transferred on the basis of this consent and, unless another legal ground requires it to be kept, it is deleted or anonymised.

Retention and Your Rights

Retention periods, processing purposes and your rights under Article 11 of the Law are explained in detail in the Personal Data Protection Notice. You can submit requests concerning your rights, together with information verifying your identity, through the contact channels below.

Declaration of Consent

Having been informed of the possible risks described above, I give my explicit consent to my personal data being transferred, for the stated purposes, to servers in the Netherlands and the United States over the Google Cloud / Firebase infrastructure and to the Google Workspace e-mail infrastructure.

This consent is obtained when you tick the transfer-abroad consent box on the forms on this site and submit the form; the date of consent and the version of this notice are recorded. If you do not tick the box, the form is not submitted and no data of yours is transferred under this notice.

Data Controller and Contact

You can reach us with any question or request about this notice:

• Turkish Beyazay Association
• Address: Yalı Mah. Sinan Sok. No: 7/A İbrahim Ertaş Apt., 34873 Kartal – İstanbul, Türkiye
• E-mail: beyazay@beyazay.org.tr