E-BULLETIN INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA
İstanbul Kültür ve Sanat Vakfı (İstanbul Foundation for Culture and Arts) (“İKSV”), with its affiliated commercial enterprise İstanbul Kültür ve Sanat Vakfı Tur. Paz. Org. İktisadi İşletmesi, is the Data Controller. Your personal data are processed by İKSV within the framework explained below and always in compliance with the Law numbered 6698 on the Protection of Personal Data (“the Law numbered 6698”) and (Reg. EU 2016/679) (General Data Protection Regulation (GDPR)). For further information on the purposes of the processing of your personal data by us, please see İKSV’s Policy on the Protection and Processing of Personal Data on the publicly accessible here.
In accordance with Article 4 (2) of the GDPR and Article 3 (1) (e) of the Law numbered 6698, we inform you about the processing of your personal data with this text.
1. Purposes of the Processing of Your Personal Data:
We, as Data Controller according to the GDPR article 4(7) and the Law numbered 6698 article 3(1) (ı), İKSV, may analyze your personal data such as:
- full name,
- contact information,
- information obtained through social media accounts,
- events you attended,
- hobbies and personal interests,
- e-bulletin reading habits,
- favorite trends,
and process them for the following various purposes with the compliance the Law numbered 6698 article 5. and GDPR articles 6. and 13/2.1-f (“Purposes”):
- improving and informing about our events, activities and services,
- carrying out corporate/field research, analysis and reporting activities,
- planning and carrying out operations aimed at potential contractual relationships and / or advertisement, sales and marketing purposes,
- holding events, meetings, parties and activities,
- sending exclusive announcements and promotions for you,
- publishing commercials, ads and promotions that includes on the social media, that may contain supporter / sponsor information and visuals,
- sending commercial e-mails, carrying out the works aimed at sending exclusive ads and announcements for you on social media,
- optionally reminding you of the contents and opportunities you enjoy and may wish to have access again,
- planning and carrying out actions aimed at promoting the institution, its activities and its brand value,
- planning, developing and performing institutional management and communication activities,
- planning and carrying out activities aimed at developing, monitoring and controlling the businesses, works and operations of the Foundation,
- carrying out activities aimed at evaluating received complaints and requests, and storing data accurately and up-to-date.
2. The Method and Legal Reason of Collecting Your Personal Data
Your personal data are obtained and processed by İKSV through İKSV website and its affiliated websites, through ticket sales companies provided that you consent to such sharing, using communication forms that you are asked to sign during the events, with entirely or partly automatic methods, or non-automatic/physical methods provided that it is part of a data recording system, depending on your type of communication with İKSV.
Your personal data are processed with your explicit consent as per Article 5/1. of the Law numbered 6698 and GDPR article 6/1/a. Additionally, should conditions provide, your personal data may be processed in order to conclude, execute and terminate a support contract with you, if any, as per Article 5/2/c of the Law numbered 6698 and GDPR article 6/1/b.; in order for İKSV to be able to perform its legal obligations such as storing commercial electronic communications as per Article 5/2/ç of the Law numbered 6698 and GDPR article 6/1/c; in case data processing is mandatory for the establishment, exercise, or protection of any right as per Article 5/2/e; and in case data processing is mandatory for the legitimate interests of the data controller provided that this processing shall not violate the fundamental rights and freedoms of the data subjects as per Article 5/2/f of the Law numbered 6698 and GDPR article 6/1/d, e and f.
3. To Which Parties and For What Purposes Your Personal Data May Be Transferred
Your personal data may be shared with and transferred to ongoing business partners, intermediary service providers, real or legal entities that provides various services, suppliers and consultants, for purposes such as fulfilling the abovementioned data processing Purposes, sending electronic mails, processing, storing and protecting data, in line with legal limitations and to the extent of the necessity and purpose of such transfer, in line with the abovementioned Purposes and in accordance with the Articles 8 and 9 of the Law numbered 6698 and GDPR article 44 and 45.
Personal data may be transferred to real or legal entities residing in Turkey as well as abroad on the condition that they shall be processed in Turkey or processed and stored outside Turkey (to countries that have sufficient measures regarding the protection of personal data and/or to countries falling short of such measures provided that the conditions specified by the Personal Data Protection Law shall be satisfied).
Furthermore, personal data may be shared with public bodies or institutions authorized to demand and obtain such data out of legal necessity.
4. Rights of Data Subject under the Law numbered 6698 Article 11
As personal data owners, you are entitled
- To learn whether your personal data are processed or not,
- In case your personal data are processed, to request information,
- To learn the purpose of processing your data and whether they are used for the intended purposes or not,
- To learn the third parties at home or abroad to whom your personal data are transferred,
- If your personal data are processed incompletely or inaccurately, to request correction, and, accordingly, to request that third parties to whom your personal data were transferred be notified of such action,
- Even if your personal data are processed in compliance with the Law numbered 6698 and other applicable provisions, if the reasons requiring data processing are no longer valid, to request erasure or destruction of your personal data, and, accordingly, to request that the third parties to whom your personal data were transferred be notified of such action,
- To raise objections against the analyzing of your processed data exclusively by automatic means if it leads to an unfavorable consequence for you, and
- To request compensation for the damage arising from the unlawful processing of your personal data.
Your Rights as Data Subject According to the GDPR;
the Right to Object according to Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.
Your Rights as the Data Subject
Under the EU General Data Protection Regulation (Reg. EU 2016/679) you have the rights below:
- Right of access
- Right to rectification
- Right to erasure („right to be forgotten“)
- Right to the restriction of processing
- Right to data portability
- Right to Withdraw
- Right to object as above (see information above)
As personal data owners, in case you deliver your claims related to your rights on an application form with wet-ink signature to the postal address İstanbul Kültür Sanat Vakfı Nejat Eczacıbaşı Binası Sadi Konuralp Caddesi No:5 Şişhane 34433 İstanbul, or to the email address kisiselveriler@iksv.org with secure electronic signature/mobile signature or from the email address submitted beforehand to İKSV and registered in İKSV's system, your claim will be concluded as soon as possible or, at the latest, within 30 (thirty) days depending on the nature of the claim.
In case this transaction brings an extra cost, a compensation will be requested from you as per the rates determined by the Personal Data Protection Board.