Personal Data Protection

MAVİ MARMARA ASSOCIATION

GENERAL INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA

The Mavi Marmara Association, which carries out humanitarian aid activities in regions affected by war and its consequences, disaster areas, and countries and regions experiencing poverty, demonstrates the same level of sensitivity to the security of personal data as it does in its humanitarian work.

With this awareness, we attach great importance to the processing, storage, and deletion of all personal data—both special and general categories—belonging to our visitors across all platforms, in accordance with the Turkish Law No. 6698 on the Protection of Personal Data (“Law”), the secondary legislation enacted or to be enacted pursuant to the Law (regulations, communiqués, circulars), and the binding decisions issued or to be issued by the Personal Data Protection Board.

Acting with full awareness of this responsibility, and in our capacity as the “Data Controller” as defined under the Law, we process your personal data as explained below and within the limits prescribed by the applicable legislation.

INFORMATION REGARDING THE DATA CONTROLLER

Pursuant to the Law, the Data Controller is the Mavi Marmara Association, registered with the General Directorate of Foundations of the Republic of Türkiye – Istanbul 1st Regional Directorate under registry number 3772, and located at Büyük Karaman Street, Alikuşçu Neighborhood, No: 10/1, Fatih / Istanbul.

PURPOSES OF PROCESSING PERSONAL DATA

In the course of providing humanitarian aid services in regions affected by war, disasters, and poverty, Mavi Marmara Association (“MM”) needs to process personal data both to directly fulfill its legal obligations and to meet requirements indirectly arising from such obligations and services.

Accordingly, your personal data are processed by MM for the purposes of complying with, including but not limited to, the following legislation:

Public Procurement Law No. 4734
Public Procurement Contracts Law No. 4735
Labor Law No. 4857
Stamp Tax Law No. 488
Fees Law No. 492
Press Law No. 5187
Regulation on the Implementation of the Law on Private Security Services No. 5188
Turkish Penal Code No. 5237
Criminal Procedure Code No. 5271
Social Insurance and General Health Insurance Law No. 5510 and its secondary legislation
Corporate Tax Law No. 5520
Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications
Electronic Communications Law No. 5809
Turkish Code of Obligations No. 6098
Turkish Commercial Code No. 6102
Occupational Health and Safety Law No. 6331 and its secondary legislation
Tax Exemption Status Certificate No. 48107
Regulation on the Tendering of Foundation Cultural Assets dated September 2008
Law No. 6698 on the Protection of Personal Data and its secondary legislation

as well as for the purposes of:

Providing information requested by relevant public institutions and organizations, judicial or administrative authorities, and law enforcement agencies when required.

Your personal data are processed within the scope of the Law, in compliance with the principles of lawfulness and good faith, accurately and up to date, for specific, explicit, and legitimate purposes, and in a manner that is relevant, limited, and proportionate to these purposes.

TRANSFER OF PERSONAL DATA

Your personal data may be transferred, within the scope of the purposes stated above and in accordance with Articles 8 and 9 of the Law, to permitted real and legal persons, authorized public institutions and organizations, judicial and administrative authorities, law enforcement agencies, institutions and organizations with which we have business relationships, authorities related to humanitarian aid activities, relevant ministries, humanitarian aid associations pursuing the same objectives, and external service providers such as consultancy, technology, and training companies.

METHODS AND LEGAL GROUNDS FOR THE COLLECTION OF PERSONAL DATA

Your personal data are collected verbally, in writing, or electronically, through automatic or non-automatic methods, via channels such as email, telephone, website, various contracts, and paper-based forms and records, by real or legal persons authorized as data processors by MM.

Categories of Data Subjects and Collected Personal Data

Donors
Name and surname, Turkish ID number, gender, year of birth, phone number, email address, address, bank account information, log records.

Volunteers
Name and surname, ID/driver’s license/passport information, gender, nationality, place and date of birth, phone number, email address, address, blood type, bank account information, marital status, military service status, education information, log records, photograph, criminal record, emergency contact information, health data, certificates, work experience.

Beneficiaries
Name and surname, ID/passport information, gender, nationality, parents’ names, year and place of birth, marital status, education information, signature, criminal record, phone number, email address, photograph, address, blood type, bank account information, emergency contact information, population registry information of dependents, family status information, health data, documents required by judicial or administrative authorities.

Supplier Representatives
Name and surname, phone number, email address, address, tax number, signature, bank information.

Visitors
Name and surname, Turkish ID number, phone number, email address, address, entry-exit records, security records.

These personal data are processed in accordance with Article 5(2)(a)(c)(ç)(e)(f) and Article 6(3) of the Law, without harming fundamental rights and freedoms, and based on MM’s legitimate interests.

Personal data relating to volunteers’ memberships in associations or foundations, memberships in civil society organizations, and social media account information—other than the data types listed above—will be collected and processed based on explicit consent in accordance with Articles 5(1) and 6(2) of the Law. The explicit consent text signed by you shall constitute an integral part of this information notice.

RIGHTS OF DATA SUBJECTS UNDER THE LAW

By applying to the Mavi Marmara Association at any time, you may:

Learn whether your personal data are processed and, if so, request information regarding such processing,
Learn the purpose of processing and whether data are used in accordance with that purpose,
Learn the third parties to whom your data are transferred domestically or abroad,
Request correction of incomplete or inaccurate data,
Request deletion or destruction of your data within the framework of Article 7 of the Law,
Request notification of correction or deletion to third parties to whom data have been transferred,
Object to a result arising against you due to analysis by automated systems,
Request compensation if you suffer damage due to unlawful processing of your data.

If your application requires additional costs, the fee determined by the Communiqué on the Procedures and Principles of Application to the Data Controller issued by the Personal Data Protection Board may be charged. No fee will be charged for written responses up to ten (10) pages; for each additional page, a fee of 1 TRY will be charged. If the response is provided on a recording medium such as a CD or flash drive, the cost of the medium will be charged to you.

Applications will be concluded as soon as possible and at the latest within thirty (30) days, depending on the nature of the request.

To exercise your rights under the Law, you may submit your applications in Turkish, in writing, to MM. For further information, you may visit the website of the Personal Data Protection Authority.

Application Methods

You may submit your application by:

Completing the form available at mavimarmara.org and delivering a signed hard copy in person or via notary public to Büyük Karaman Street, Taylasan Street, No: 3, 34083 Fatih / Istanbul,
Completing the form at mavimarmara.org, signing it with a secure electronic signature in accordance with Law No. 5070, and sending it to info@mavimarmara.org via registered electronic mail.

Your application must clearly and explicitly state the requested right and concern your own personal data. If you are acting on behalf of another person, a notarized power of attorney must be submitted.

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must include name and surname, signature, Turkish ID number, residence or workplace address, email address, phone and fax number, and the subject of the request. Applications lacking these elements will be rejected.

The Mavi Marmara Association reserves the right to amend this information notice at any time due to changes in the Law, secondary legislation, or Board decisions. Any amendments shall become effective as of the date they are communicated to you.