KVKK Privacy Notice

1. Data controller

Your personal data is processed by the operator of the herity platform at herity.space, as data controller.

You can write to merhaba@herity.space about this notice and anything to do with your personal data.

2. The personal data we process

• Identity and contact: your first and last name, e-mail address and username.
• Profile: your photo, short bio, city, interests and the social links you add.
• Events and registrations: the events you host; the events you register for or apply to, your registration status, your answers to the host's questions, your ticket, your check-in time and the invites you receive.
• Messages and what you share: your messages with hosts, your carpool posts and the contact detail you write there, the feedback you give, the event photos you share.
• Safety records: the reports you make, the members you block and admin actions concerning your account.
• Consent records: the texts you accepted, their versions, the time, and your browser details at that moment.
• Technical data: the cookies that keep you signed in, irreversible digests derived from your IP address to prevent abuse, and the access logs kept by the hosting provider.

Special categories of data: herity does not ask you for special category data such as health information. If you choose to answer a host's question (about an allergy, diet or health condition, for example), that answer is shown only to the hosts of that event and is processed on the basis of your explicit consent.

Invitees who are not members: if a host invites you to an event by your e-mail address, the address is processed only to deliver that invite.

3. Purposes and legal grounds

• Creating your account, signing you in, letting you host and attend events, and sending tickets, reminders and notifications: necessity for the conclusion and performance of a contract (KVKK art. 5/2-c).
• Keeping the community safe, reviewing reports, preventing abuse and unsolicited messages, and measuring and improving the service with numbers that contain no personal data: the controller's legitimate interest (art. 5/2-f).
• Meeting legal obligations, answering duly made requests of competent authorities and protecting a right: legal obligation and the establishment, exercise or protection of a right (art. 5/2-ç and 5/2-e).
• Special category data you choose to share, and the processing of your data by service providers abroad: your explicit consent (art. 5/1, 6/2 and 9).

4. Who we share your data with

• The hosts of an event: the hosts of an event you register for or apply to see your name, profile photo, registration status and your answers to their questions. Your e-mail address is not shared with hosts.
• Other guests: your name and photo appear in the guest list where the host has opened it; you can turn this off in your privacy settings. The contact detail in your carpool post is shown only to the person whose reply you accept.
• Door staff: see your name and ticket code at the event's door.
• Our service providers: they process data only on our behalf and on our instructions (listed in section 5).
• Competent authorities: where the law requires it, and only as far as required.

We do not sell your personal data or share it with third parties for advertising or marketing.

5. Transfers abroad

We use the following service providers to run herity:

• Supabase: database, sign-in and file storage. Servers in Germany (Frankfurt).
• Vercel: hosting of the application. Based in the United States; pages are served from its servers around the world.
• Resend: sending e-mails (sign-in codes, registration notices, announcements). Based in the United States.
• Mapbox: the text a host types when searching for an event's venue. Based in the United States.

Because these providers' servers are outside Türkiye, their processing of your data is a transfer abroad under Article 9 of KVKK, and rests on the explicit consent you give separately when you sign up. You can withdraw that consent at any time; since we cannot provide the service without these providers, your account then has to be closed.

6. How data is collected

We collect your data electronically, by automatic or partly automatic means, through the sign-up and profile forms, the registration and application forms, your messages, and your use of the application.

7. Retention periods

• Account and profile details: for as long as your account is open. When you delete your account they are erased for good at the end of the 30-day waiting period.
• Your answers to registration questions: erased one year after the event.
• Notifications and e-mail delivery records: erased after one year.
• The digests used for counting visits and preventing abuse: erased within two days at the latest.
• The record of the texts you accepted: for as long as your account is open.
• Where a law requires longer retention, the data concerned is kept for that period.

8. Your rights

Under Article 11 of KVKK you have the right to:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of the processing and whether the data is used accordingly.
• Know the third parties, in Türkiye or abroad, to whom your data is transferred.
• Ask for incomplete or inaccurate data to be corrected.
• Ask for your data to be erased or destroyed under the conditions the law sets out.
• Ask that third parties to whom your data was transferred be told of corrections, erasure and destruction.
• Object to a result against you that arises from your data being analysed solely by automated systems.
• Claim compensation if you suffer damage because your data was processed unlawfully.

9. How to apply

To exercise your rights, write to merhaba@herity.space from the e-mail address registered to your account. We answer within 30 days at the latest, free of charge.

You can download a copy of your data yourself from Settings → Account, and delete your account from the same page.

If you find our answer insufficient or receive none in time, you can lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

10. Changes

When we update this notice we publish the new version on this page. We tell you separately about updates that materially change how your data is processed.