Data Protection Notice for Mobile Application Users

How Turuncu Deneyim Organizasyon ve Teknoloji Limited Şirketi, as data controller under Türkiye’s Law No. 6698 on the Protection of Personal Data, processes the personal data of Society mobile application users.

Turuncu Deneyim Organizasyon ve Teknoloji Limited Şirketi (“Society” or the “Company”), as data controller under Law No. 6698 on the Protection of Personal Data (the “PDPL/KVKK”) and related legislation, processes certain personal data of the users who use the mobile application named Society (the “Application”). The purpose of this notice is to inform the relevant data subjects, pursuant to Article 10 of the PDPL, about the processing and transfer of their personal data.

1. Information on the Data Controller

2. Purposes, Legal Grounds and Methods of Collection of Your Personal Data

Identity Data

• Personal Data Processed: First name, last name, date of birth, gender.
• Purposes of Processing: Carrying out contractual processes (e.g. fulfilling our service obligation under the distance sales agreement), conducting the sale of goods/services, carrying out finance/accounting processes (e.g. issuing invoices), and ensuring compliance with legal obligations as required or mandated by legislation (e.g. taking the necessary steps where the right of withdrawal is exercised).
• Legal Ground for Processing: Processed on the grounds that the processing of personal data is necessary for the establishment and performance of a contract, for the fulfilment of legal obligations, and for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Contact Data

• Personal Data Processed: Email address, mobile phone number, address.
• Purposes of Processing: Carrying out contractual processes (e.g. fulfilling our service obligation under the agreement), conducting the sale of goods/services, carrying out finance/accounting processes (e.g. issuing invoices), ensuring compliance with legal obligations as required or mandated by legislation (e.g. taking the necessary steps where the right of withdrawal is exercised), and carrying out marketing activities.
• Legal Ground for Processing: Processed on the grounds that the processing of personal data is necessary for the establishment and performance of a contract, for the fulfilment of a legal obligation, and for the legitimate interests of the data controller. In addition, contact data processed in connection with certain marketing activities (e.g. sending commercial electronic messages) is processed based on your explicit consent.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Membership Data

• Personal Data Processed: Username, password (in encrypted form), user identification number, account creation and login information obtained when the user creates a membership on the Application, and identifying data relating to the membership account.
• Purposes of Processing: Enabling users to log in to the Application and ensuring compliance with legal obligations as required or mandated by legislation.
• Legal Ground for Processing: Processed on the grounds that the processing of personal data is necessary for the establishment and performance of a contract, for the fulfilment of a legal obligation, and for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Financial Data

• Personal Data Processed: Subscription payment information, bank account information, digital payment information, credit card information, invoice information, payment transaction records.
• Purposes of Processing: Conducting our Company’s activities in compliance with legislation, carrying out the sale of goods/services, and carrying out finance and accounting operations.
• Legal Ground for Processing: Processed on the ground that the processing of personal data is necessary for the performance of a contract and for the fulfilment of legal obligations.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Social Media Data

• Personal Data Processed: Profile information, username, profile photo and social media account information that users share via social media platforms or grant access to in connection with the application, together with communication and connection data carried out over social media.
• Purposes of Processing: Making matches based on shared interests, event preferences and social circles, displaying a social media account link on the user profile, fulfilling legal obligations and, where necessary, conducting dispute resolution processes.
• Legal Ground for Processing: Processed on the ground that the processing is necessary for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Professional Experience Data

• Personal Data Processed: Data relating to users’ career history, such as profession, title, employer, work experience, area of expertise, education and certification information, and data relating to their professional competencies.
• Purposes of Processing: Enabling connections based on shared sector, area of expertise or career interests, providing professional networking and community interaction, and personalising the user experience.
• Legal Ground for Processing: Processed on the ground that the processing is necessary for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Hobby (Interest) Data

• Personal Data Processed: Interests, leisure activities, likes, events attended, types of content followed and similar personal interest and hobby information that users hold in line with their personal preferences.
• Purposes of Processing: Creating and enriching user profiles, matching users with shared interests, offering suitable events, communities and content recommendations, personalising and improving the user experience, increasing community interaction, ensuring application security, carrying out statistical analysis and reporting, and fulfilling legal obligations.
• Legal Ground for Processing: Processed on the ground that the processing is necessary for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

User Interactions

• Personal Data Processed: Data conveyed by users when introducing themselves during registration on the Application, and usage data relating to their usage habits and activity on the Application such as search history, viewed content, click and navigation information, in-app purchases, favourite and preference records, notification interactions, session activity, user feedback and similar usage data.
• Purposes of Processing: Improving and personalising the user experience, offering content, events and user recommendations in line with user preferences, analysing and improving application performance, ensuring application security and preventing misuse, carrying out user support processes, performing statistical analysis and reporting, and fulfilling legal obligations.
• Legal Ground for Processing: Processed on the ground that the processing is necessary for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Users are responsible for the content they share when introducing themselves during registration on the Application. Users should refrain, unless strictly necessary, from sharing special categories of personal data and personal data belonging to third parties.

Legal Transaction Data

• Personal Data Processed: Data used in correspondence with judicial authorities and data contained in files relating to legal disputes.
• Purposes of Processing: Fulfilling our Company’s legal obligations and exercising the right of defence in potential disputes.
• Legal Ground for Processing: Processed on the grounds that the processing is necessary for the fulfilment of a legal obligation and for the establishment, exercise or protection of a right.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

Data Processed within the User-to-User Messaging Feature

• Personal Data Processed: Messaging content exchanged between users through the application, the texts, images, links and files sent, message records, timestamp information, user interaction information and other personal data shared by users in messaging areas.
• Purposes of Processing: Providing and maintaining communication between users, offering messaging services, improving the user experience, carrying out community safety and moderation processes, preventing misuse, fraud, spam and unlawful activities, carrying out information security processes, carrying out user support processes, improving service quality, conducting the Company’s activities, fulfilling legal obligations and using the data as evidence in potential disputes.
• Legal Ground for Processing: Processed on the grounds that the processing is directly related to the establishment or performance of a contract, is mandatory for the data controller to fulfil its legal obligations, and is mandatory for the legitimate interests of the data controller. Where users share special categories of personal data in messaging areas, such data is processed only where the conditions set out in the Law are met.
• Methods of Collection: Collected through the Application.

Users are responsible for the content they share in messaging areas. Users should refrain, unless strictly necessary, from sharing special categories of personal data and personal data belonging to third parties.

Visual Data

• Personal Data Processed: User profile photos, images uploaded by users, photos included in event posts, images shared within messaging, and other visual content shared by users through the application.
• Purposes of Processing: Creating and personalising user profiles, enabling interaction between users, providing and improving application services, improving the user experience, monitoring compliance with community rules and carrying out moderation processes, preventing fake accounts and misuse, carrying out user support processes, ensuring information security, fulfilling legal obligations and using the data as evidence in potential disputes.
• Legal Ground for Processing: Processed on the grounds that the processing is directly related to the establishment or performance of a contract, is required for the data controller to fulfil its legal obligations, and is mandatory for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application.

Online Identifiers and Transaction Security Data

• Personal Data Processed: IP address, MAC address, IMEI number, device identifier, session information, cookie records, network and connection information, device and operating system information and similar online identifier data.
• Purposes of Processing: Carrying out user authentication processes, ensuring the security of the application, preventing unauthorised access and misuse, carrying out system and network security processes, detecting errors and resolving technical problems, improving the user experience, analysing and improving application performance, recording user transactions, performing statistical analysis, fulfilling legal obligations and using the data as evidence in potential disputes.
• Legal Ground for Processing: Processed on the grounds that the processing is required for the data controller to fulfil its legal obligations, is directly related to the establishment or performance of a contract, and is mandatory for the legitimate interests of the data controller.
• Methods of Collection: Collected through the Application.

Marketing Data

• Personal Data Processed: Shopping history information, surveys, cookie records, information obtained through campaign activities, etc.
• Purposes of Processing: Carrying out marketing activities (e.g. sending commercial electronic messages) and conducting advertising/campaign/promotion processes.
• Legal Ground for Processing: Processed on the ground that the processing is necessary for the legitimate interests of the data controller. In addition, data processing carried out in connection with certain marketing activities (e.g. sending commercial electronic messages) is performed based on your explicit consent.
• Methods of Collection: Collected through the Application or other electronic channels (e.g. email).

3. To Whom and for What Purposes May Your Personal Data Be Transferred?

The personal data we process may be transferred to third parties resident in Türkiye for the purposes and on the legal grounds set out below:

• For the conduct of our legal processes and to respond to the information requests of competent authorities, your identity, contact, legal transaction and transaction security data is transferred to competent authorities (e.g. courts) based on the fulfilment of a legal obligation.
• For the performance of our contractual obligations, your identity and contact data may be transferred to our business partners and third parties from whom we receive services.
• For the conduct of marketing activities, your identity, contact and marketing data is transferred to our business partners and third parties from whom we receive services, based on the legitimate interests of the data controller.
• All of the personal data we process is transferred to our cloud service provider located abroad, provided that it does not harm the fundamental rights and freedoms of the data subject, based on the legitimate interests of the data controller and by way of the standard contract announced by the Personal Data Protection Board.

4. How Long Do We Retain Your Personal Data?

Pursuant to Article 7/1 of the PDPL, where the purpose requiring the processing of your personal data ceases to exist and/or the statutory retention periods for which we are obliged to retain your data under relevant legislation expire, your personal data will be deleted, destroyed or anonymised by us.

5. What Are Your Rights Regarding Your Personal Data as a Data Subject?

Regarding your personal data, you have the right to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing and whether the data is used in accordance with that purpose,
• know the third parties to whom your personal data is transferred, whether domestically or abroad,
• request rectification of your personal data where it has been processed incompletely or inaccurately,
• request the erasure or destruction of your personal data within the conditions set out in the PDPL,
• request that the rectification of incomplete or inaccurate data and the erasure or destruction of your personal data be notified to the third parties to whom the data has been transferred,
• object to the emergence of a result against you through the analysis of the processed data exclusively by automated means, and
• claim compensation for damage arising from the unlawful processing of your personal data.

You may exercise the rights above by physical post in writing to Merkez Mah. Abide-i Hürriyet Cad. Sibel Apt. Door No: 161, Flat No: 3, Şişli/İstanbul, or by email to privacy@societyapp.org.

Your requests regarding your personal data will be evaluated and answered as soon as possible and within 30 days at the latest from the date they reach our Company. If your request is accepted, or refused with a stated justification, our response will be sent to the address you specified in your application, primarily by post or email, and, where possible, by the same method in which the request was made.