As Bizim Lösemili Çocuklar Vakfı (“BLÇV” or the “Foundation”), processing and protecting the personal data of our donors, prospective donors, supporters, patients and their relatives, volunteers, prospective volunteers, employees, job candidates, visitors, suppliers, business and solution partners, users visiting our website, persons who contact us through our electronic communication channels and other third parties in accordance with the applicable legislation, in particular the Personal Data Protection Law No. 6698 (“PDPL”), is one of our fundamental priorities.
In this context, we attach importance to processing the personal data obtained in the course of the Foundation’s activities in accordance with the law and the principles of good faith, ensuring the security of personal data and enabling data subjects to exercise their rights under the PDPL effectively.
Protecting personal data and safeguarding the fundamental rights and freedoms of the natural persons whose personal data is collected is the core principle of our policy on the processing of personal data. For this reason, we carry out all of our activities involving the processing of personal data with due regard to the protection of privacy, the confidentiality of communications, freedom of thought and belief and the right to an effective remedy.
In order to protect personal data, we take all administrative and technical protective measures required by the nature of the relevant data, in accordance with the legislation and current technology.
This Policy describes the methods we follow for processing the personal data collected in the course of our activities (for example, storing, transferring and deleting or anonymising it) within the framework of the principles set out in the PDPL.
This Policy covers the following persons whose personal data is processed within the scope of the Foundation’s activities:
Our Policy applies to all processing activities involving personal data within BLÇV and the commercial enterprises affiliated with BLÇV, and has been drawn up with due regard to the PDPL, other legislation on personal data and the international standards in this field.
For the purposes of this Policy:
BLÇV: Bizim Lösemili Çocuklar Vakfı and the commercial enterprises affiliated with the Foundation,
Explicit Consent: Consent relating to a specific subject, based on information and expressed by free will,
Anonymisation: Rendering personal data impossible to link with an identified or identifiable natural person under any circumstances, even by matching it with other data,
Data Subject: The natural person whose personal data is processed,
Personal Data: Any information relating to an identified or identifiable natural person,
Anonymisation: Rendering personal data impossible to link with an identified or identifiable natural person under any circumstances, even by matching it with other data,
Employee: BLÇV personnel,
Special categories of personal data: Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data,
Processing of personal data: Any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automated means or by non-automated means provided that the data forms part of a data filing system,
Data processor: The natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller,
Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system,
PDP Board: The Personal Data Protection Board,
PDPL: The Personal Data Protection Law published in the Official Gazette No. 29677 dated 7 April 2016.
Board: The Personal Data Protection Board,
PDPL: The Personal Data Protection Law No. 6698,
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system,
Foundation / BLÇV: Bizim Lösemili Çocuklar Vakfı.
BLÇV acts in accordance with the principles set out in Article 4 of the PDPL when processing personal data.
In this context, personal data is processed:
Personal data is retained and processed in accordance with these principles.
When obtaining personal data, BLÇV, as data controller, informs data subjects about:
Data subjects are informed on these matters.
Where necessary, separate privacy notices may be prepared for specific data processing activities.
Within the scope of the Foundation’s activities, all or some of the following categories of personal data may be processed depending on the data subject’s relationship with the Foundation.
Name, surname, date of birth, Turkish ID number and other identity information that must be obtained under the legislation or due to the nature of the relevant transaction.
Telephone number, e-mail address, postal address and other contact details.
Bank account and IBAN details, donation and payment details, transaction and receipt details and financial information that must be kept under the legislation.
IP address, website access and traffic records, log records and technical records kept to ensure the security of information systems.
Information contained in correspondence with judicial and administrative authorities, information relating to court and enforcement files, and records relating to legal claims and disputes.
Information relating to donations, applications, requests, complaints, communications, event participation and other transactions carried out with the Foundation.
For employees and job candidates: education, profession, CV, employment history, salary, leave, performance and other personnel records.
Photographs, video and audio recordings.
Health information relating to patients, their relatives or other data subjects, to the extent legally required for carrying out the Foundation’s activities.
Volunteering preferences, event participation details, communication preferences and other information submitted to the Foundation by the data subject in request and description fields.
Depending on the data subject’s relationship with the Foundation, personal data may be processed for the following purposes:
BLÇV processes personal data on the legal grounds set out in Article 5 and, where applicable, Article 6 of the PDPL.
In this context, personal data may be processed on the following legal grounds:
Personal data may be processed on the basis of these legal grounds.
Where explicit consent is required under the PDPL and the applicable legislation, personal data is processed on the basis of the data subject’s explicit consent.
Due to the nature of BLÇV’s activities, special categories of personal data, in particular health data, may be processed.
Special categories of personal data are processed where one of the processing conditions set out in Article 6 of the PDPL is met and by taking the adequate measures determined by the Board.
The principle of data minimisation is observed when processing special categories of personal data, and care is taken to process only the data necessary for the relevant activity.
Personal data may be obtained through:
by fully or partially automated means or by non-automated means provided that the data forms part of a data filing system.
Provided that the conditions set out in Articles 8 and 9 of the PDPL are met and limited to the purpose of the transfer, personal data may be transferred to:
Transfers are made only within these limits.
Transfers are carried out with due regard to the principle that personal data must be relevant, limited and proportionate to the purpose of processing.
Where personal data is transferred abroad, the conditions and safeguards set out in Article 9 of the PDPL are taken into account.
While BLÇV’s website is being used, cookies and similar technologies may be used to ensure that the website operates securely, to improve the user experience, to remember preferences and to analyse the use of the website.
Detailed information on the personal data processing activities carried out through cookies is provided to data subjects in the separately published Cookie Policy/Privacy Notice.
Where required by the applicable legislation, the user’s preference or explicit consent is obtained for the use of non-essential cookies.
If data subjects so choose, they may be informed about the Foundation’s activities, projects, events, campaigns and announcements by e-mail and other electronic communication tools.
In this context, personal data is processed in accordance with the legal grounds set out in the applicable legislation. Data subjects may change their communication preferences or opt out of such communications through the methods made available to them.
Personal data processed by BLÇV is retained for the periods prescribed by the applicable legislation or for as long as required by the purposes for which it is processed.
When the reasons requiring the processing of personal data cease to exist, the data is deleted, destroyed or anonymised, either ex officio or upon the request of the data subject, in accordance with the provisions of the applicable legislation and the Foundation’s retention and destruction procedures.
Under Article 12 of the PDPL, BLÇV takes the necessary technical and organisational measures to:
and to provide an appropriate level of security for these purposes.
In this context, authorisation and access control, staff training, confidentiality obligations, information security practices, secure data storage and transfer methods and other necessary technical and organisational measures are applied.
Under Article 11 of the PDPL, data subjects have the right to:
Data subjects may exercise these rights by applying to the Foundation.
You may submit your requests under the PDPL to Bizim Lösemili Çocuklar Vakfı together with the information and documents required to verify your identity and your request.
Applications may be submitted to:
Bizim Lösemili Çocuklar Vakfı
Hacı Beşir Ağa Medresesi
Alemdar Mahallesi, Hükümet Konağı Caddesi No: 1
Fatih / Istanbul
in writing at the address above, or through other application methods announced by the Foundation.
Applications are concluded as soon as possible depending on the nature of the request and, in any case, within the period prescribed by the PDPL.
This Policy enters into force on the date of its publication.
BLÇV reserves the right to update the Policy in line with changes in legislation, decisions of the Personal Data Protection Board, the Foundation’s activities or its personal data processing processes.
The current version of the Policy is made available to the public on the Foundation’s website.
BİZİM LÖSEMİLİ ÇOCUKLAR VAKFI
Data Controller