DESTEK OL İNSANİ YARDIM VE KALKINMA DERNEĞİ
Last updated:
1. Purpose and scope
This Policy governs the confidentiality of information and the protection of personal data obtained through destekol.org and Destek Ol’s web forms, email, volunteering and cooperation applications, complaints and feedback channels, digital campaigns and online donation channels.
2. Core principles
Personal data are processed lawfully and fairly for specific, explicit and legitimate purposes.
Data processing is relevant, limited and proportionate to its purpose; unnecessary data are not collected.
Reasonable steps are taken to keep data accurate and, where necessary, up to date.
Personal data are retained for the period required by the processing purpose and relevant legislation.
Personal data are not sold, rented or marketed to third parties for data trading purposes.
Appropriate technical and organizational measures are applied against unauthorized access, loss, alteration, disclosure and misuse.
Stricter confidentiality and access restrictions apply to information about children, beneficiaries, complainants and people at risk.
3. Categories of data that may be processed
| Category | Examples |
|---|---|
| Identity and contact | Full name, email, telephone, country/city, application and contact details. |
| Applications and transactions | Information concerning volunteering, cooperation, projects, complaints, feedback and donation transactions. |
| Finance and payments | Donation amount, currency, transaction reference and limited transaction information supplied by the payment provider. Full card details are not stored by Destek Ol. |
| Technical records | IP address, date and time, device/browser information, session and security records. |
| Preferences | Cookie preferences and permissions for communications and newsletters. |
| Sensitive content | Health, disability, child protection or safeguarding information submitted voluntarily by the user is processed only as necessary and with appropriate security measures. |
4. Purposes of processing
Operating the website and ensuring its security, accessibility and technical performance.
Assessing and responding to questions, applications and requests concerning volunteering, projects, partnerships, press and communications.
When donation channels are active, processing donations and managing reconciliation, accounting, records, refunds and disputes.
Preventing forgery, unauthorized access, misuse, money laundering, terrorist financing, sanctions violations and fraud risks.
Handling complaints, ethics reports, safeguarding/protection from sexual exploitation and abuse (PSEA), and child protection reports securely.
Meeting legal obligations and establishing, exercising or defending rights.
Sending newsletters, announcements and campaign communications where there is an explicit choice or another valid legal basis.
5. Data sharing
Personal data may be shared only to the extent necessary and where an appropriate legal basis exists, with competent public authorities, banks and payment service providers, IT, hosting and security service providers, legal and financial advisers, auditors and contracted partners. Data minimization, confidentiality and access authorization govern each disclosure.
6. Transfers abroad
Where cloud, email, hosting, security, analytics, communication or payment services located abroad are used, personal data are transferred abroad in accordance with Law No. 6698 and the secondary legislation in force, subject to the required transfer conditions and appropriate safeguards.
7. Cookies and similar technologies
Essential cookies are used for core site functions and security. Non-essential cookies for analytics, personalization or marketing are used with the required preference mechanism and in compliance with legal conditions. Details are set out in the Cookie Policy.
8. Data security
Authorization and access controls, strong authentication and segregation of duties are applied.
System and account access is limited to what is needed; unnecessary access is removed.
Backup, logging, security updates and incident response measures are implemented.
Confidentiality and data security obligations are contractually agreed with service providers.
Personal data are not unnecessarily requested by email or forms; passwords, CVVs and one-time verification codes are not requested.
9. Retention and deletion
Personal data are retained for the period required by the processing purpose and by relevant legislation, contracts, audits or dispute procedures. When the conditions for processing cease to apply, data are deleted, destroyed or anonymized.
10. Rights and requests
To exercise your statutory rights concerning personal data or raise a privacy question, contact Destek Ol at info@destekol.org. Requests are assessed in accordance with current legislation after verification of identity and the request.
11. Updates
This Policy may be updated when legislation, services, technologies or data processing practices change. The current version is published on destekol.org.
Beneficiary images and explicit consent
Prior information and explicit consent procedures apply when beneficiaries are photographed or recorded on video or audio, and when this material is published in promotional or donation campaigns. Details are set out in the “Beneficiary Images, Video Recordings and Explicit Consent” section of the KVKK Disclosure Notice.