Personal Data Protection Notice

Data Controller

Your personal data is processed by the Turkish Beyazay Association as data controller, within the framework described below.

• Address: Yalı Mah. Sinan Sok. No: 7/A İbrahim Ertaş Apt., 34873 Kartal – İstanbul, Türkiye
• E-mail: beyazay@beyazay.org.tr

Personal Data We Process

Only the data you send us and the technically necessary records are processed through this website:

• Contact form: full name, e-mail address, phone number (optional), subject and message content.
• Contact form submission record: your IP address, browser information (user agent) and the date and time of submission are stored together with your message in order to maintain security and prevent misuse.
• Feedback form (accessibility menu): your message, the topic you choose and any rating you give the page; optionally your name, e-mail address and an uploaded screenshot; the address and title of the page the feedback was sent from; and, to prevent misuse, your IP address, browser information and the date and time of submission. Metadata such as location and device details is removed from the screenshot on our server; the information shown in the image itself is processed as you send it. Please do not include information about other people, or anything you would rather not share, in the screenshot.
• Branch volunteer application: your full name, e-mail address, phone number and the branch you apply to, together with your IP address, browser information and the date and time of the application, kept to prevent misuse.
• Volunteer account and volunteer profile: full name, e-mail address, phone number, year of birth, gender, education and occupation, city of residence, the volunteering areas you are interested in, your availability, the skills you list, your preferred contact channels, the name, relationship and phone number of an alternative contact, and the documents and images you upload as part of volunteering work. Your e-mail address and password are used to sign in to your account; your password cannot be seen by the association.
• Alternative contact: the name, relationship and phone number of the person you list in the volunteer form, processed only so that we can call that person if we cannot reach you. Please let this person know that you have shared their details with the association and point them to this notice.
• Consent record: the date on which you gave your explicit consent to the transfer abroad on the forms and in your volunteer account, and the version of the Explicit Consent Notice you accepted.
• Server logs: technical records such as IP address, date and time, and browser information, kept by our hosting infrastructure for security and error tracking.
• Bot protection (Google reCAPTCHA v3): when you touch a field in one of our forms, your IP address, browser information and interaction data such as mouse and keyboard activity are sent to Google so that it can tell whether the submission comes from a real person. Google derives a security score from this data and only that score is returned to the association. If you merely read a page containing a form and touch no field, your browser does not connect to Google at all. The check runs in the background and requires nothing from you.
• Your accessibility preferences (text size, dark theme and similar) and the position you move the accessibility button to are stored only in your own browser and are never sent to the association. The magnifier works entirely on your device. The text reader uses your browser's built-in speech feature; some browsers may produce the speech on their provider's servers, in which case the text being read is sent to that provider by your browser. No data reaches the association in this context.
• Page summary (accessibility menu): when you ask for a summary, your browser sends our server only the address of the page you are viewing. Our server passes the publicly available text of that page to Google's Gemini AI service to produce the summary. No data about you (IP address, browser information and so on) is sent to Google.
• Rate-limit counters: to prevent misuse of the forms and the page summary, your IP address (and, in forms, your e-mail address) is converted into a one-way hash and used in counters that track the number of submissions; it is not stored in these counters in readable form.
• Usage measurement: to count how often each page is viewed, your IP address, browser information and language preference are used only to derive an irreversible visitor number, in memory, while the request is being handled. None of these three is recorded anywhere or sent to a third party. The secret value used to derive the number is generated at random each day, is never recorded anywhere and is discarded when the day ends, so numbers from earlier days cannot be linked to a person — not even by the association. Nothing is stored on your device for this purpose.

Purposes of Processing

• Assessing and answering the requests, questions or suggestions you send through the contact form,
• Assessing the feedback you send through the accessibility menu and improving the accessibility of the site,
• Contacting you by phone or e-mail where necessary,
• Assessing volunteer applications, keeping volunteer records and running volunteering work,
• Maintaining the security of the website and resolving technical faults,
• Producing aggregate statistics about use of the site and improving the site on that basis,
• Fulfilling obligations arising from legislation.

Legal Basis

The personal data you send through the contact form and the feedback form is processed so that your request or feedback can be assessed and answered, on the basis of the association's legitimate interest under Article 5(2)(f) of the KVKK. The data you send through the branch volunteer application and your volunteer account is processed under Article 5(2)(c), because it is directly necessary to establish and carry out the volunteering relationship with you. Server logs are processed on the basis of the association's legitimate interest under Article 5(2)(f) and, under Article 5(2)(a) and (ç), because this is provided for by law and required to meet our legal obligations.

Data processed through the Google reCAPTCHA service, which protects our forms against automated (bot) submissions, and data processed for usage measurement, are processed on the basis of our legitimate interest in keeping the website secure, preventing misuse and improving the site, under Article 5(2)(f) of the KVKK. Neither of these rests on your explicit consent. If you would rather stay out of usage measurement, use the button on the Cookie Policy page or turn on the “Global Privacy Control” setting in your browser.

The rate-limit counters kept to prevent misuse of the forms and the page summary rest on the same legitimate interest. The page summary feature does not transfer any personal data about you.

The transfer of this data to servers abroad, however, relies on your explicit consent under Article 9 of the KVKK. For this reason the Privacy Notice is presented on the forms as information and you are not asked to approve it; the tick box on the forms is only for consent to the transfer abroad. The details are set out in the “Explicit Consent Notice on the Transfer of Personal Data Abroad”.

For Google reCAPTCHA and usage measurement, no explicit consent is taken; both rest on the legitimate interest described above. With reCAPTCHA your browser connects directly to Google, so your IP address reaches Google. With usage measurement, only the irreversible visitor number and page information are sent to Google; neither your IP address nor your device and browser information is.

Transfer of Personal Data

Our website is hosted on Google's cloud infrastructure (Google Cloud / Firebase). Our application servers run in the Netherlands, while our database and the storage holding uploaded files run in data centres in the United States. The hosting provider processes the data solely for the purpose of delivering that service.

The data you send us through this site is therefore transferred abroad. The scope of that transfer, its recipients and your explicit consent to it are explained separately in the “Explicit Consent Notice on the Transfer of Personal Data Abroad”.

Beyond this, your data is transferred to the following recipients: Firebase Authentication, to verify the e-mail address and password used to sign in to the admin panel and the volunteer area; and Google Analytics 4, for usage measurement. In measurement, Google receives only the irreversible visitor number — renewed daily — together with the address (without the query string), title and language of the page you viewed; your IP address and your device and browser information are not sent.

Submissions from the forms (contact form, feedback form and branch volunteer application) are also forwarded as notifications to the association's institutional e-mail address so that they can be reviewed. Our institutional e-mail runs on Google Workspace (Google LLC); these notifications, including any screenshot attached to feedback, are processed and stored in Google's data centres, including those in the United States.

When you use the page summary feature, the text of the page you are viewing, as publicly published on our site, is sent by our server to Google's Gemini API service (Google LLC, United States) to produce the summary. This transfer contains no personal data about you.

When you view embedded content such as Google Maps on the contact page, YouTube on the gallery page or FlipHTML5 on the e-magazine page, your browser connects directly to the provider, and your IP address and browser information are sent to it. This content is subject to the providers' own policies.

The forms on our site are protected against automated submissions by Google reCAPTCHA v3. When you touch a field in a form, your browser connects directly to Google; your IP address, browser information and interaction data are transferred to Google Ireland Limited and Google LLC (United States). Opening the page alone does not create that connection: if you never start filling the form, none of your data reaches Google. The service is subject to Google's privacy policy and terms of service; Google states that this data is not used for personalised advertising.

Your personal data is not shared with or sold to third parties for advertising, marketing or profiling purposes. Otherwise it may only be transferred to authorised public institutions where legislation requires it.

Retention Period

Contact form and feedback form records, together with any screenshot, are kept for two years from the date of submission, and branch volunteer applications for one year; at the end of that period they are deleted automatically. The same periods apply to the notification e-mails sent to our corporate e-mail address.

The records of your volunteer account and the documents you upload are kept for as long as your volunteering relationship continues. If your application is not accepted or your volunteering ends, your records are kept for two years from that date and then deleted, together with your sign-in account, the documents you uploaded and your name on tasks.

If you withdraw your consent to the transfer abroad, your data is deleted without delay, because it is held on servers abroad. For your volunteer account you can do this yourself with the “Hesabımı sil” (Delete my account) button on the “Bilgilerim” (My details) page of the volunteer area.

Your Rights as a Data Subject

Under Article 11 of the KVKK you may apply to the association to exercise the following rights:

• To learn whether your personal data is being processed,
• To request information about the processing if it has taken place,
• To learn the purpose of the processing and whether the data is used accordingly,
• To know the third parties in Türkiye or abroad to whom your data is transferred,
• To request correction of incomplete or inaccurate data,
• To request erasure or destruction of your data within the conditions set out in the law,
• To request that correction, erasure or destruction be notified to the third parties to whom the data was transferred,
• To object to an adverse outcome arising from the analysis of your data solely by automated systems,
• To claim compensation if you suffer damage due to unlawful processing of your data.

How to Apply

You may send your requests, together with information verifying your identity, by e-mail to beyazay@beyazay.org.tr or in writing to the postal address above. Depending on their nature, requests are concluded free of charge as soon as possible and within thirty days at the latest.

Changes

This notice may be revised in line with changes in legislation or in the association's practices. The current text is always published on this page.