GDPR Notice

As the Association for Combating Crimes Against Humanity and Genocide (in short "S.O.S.der" or the "Association"), we attach great importance to the confidentiality and security of the personal data we obtain within the scope of our activities. This Disclosure Text has been prepared by the Association in its capacity as data controller, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("PDPL") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

1. Purpose and Scope

This text covers all natural persons whose personal data is processed, including our members, membership applicants, donors, volunteers, visitors to our website, persons using our contact forms, and victims, witnesses and rights holders who apply to the Association. Our aim is to inform you transparently about the conditions and purposes under which your personal data is processed.

2. Categories of Personal Data Processed

Depending on the nature of our activities, the following categories of personal data may be processed:

• Identity data: First name, surname; and, where required by legislation in membership and donation processes, information such as national identity number and date of birth.
• Contact data: E-mail address, telephone number, address and city information.
• Membership data: Membership application and dues information, and duties within the Association's bodies.
• Donation and financial data: Information on the donation amount, date and payment instrument (your card details are not stored by the Association and are processed only by the payment institution).
• Volunteering data: Volunteer application information, areas of interest and the work contributed to.
• Application and case-file data: Violation reports submitted to the Association, victim/witness statements, and related documents and content.
• Transaction-security data: IP address, browser and device information, log records.
• Marketing and communication data: E-newsletter subscription and preference information.

3. Special Categories of Personal Data

Owing to the Association's work in the field of human rights and the fight against genocide and crimes against humanity, special categories of personal data such as health, ethnic origin, religion or political opinion may be shared by you within the scope of violation reports and victim and witness statements. Such data is processed only within the conditions set out in Article 6 of the PDPL; relying on your explicit consent or on cases provided for by law, and with all necessary administrative and technical measures taken. We kindly ask that you share information of this nature only to the extent strictly necessary for the relevant work.

4. Purposes of Processing and Legal Grounds

Your personal data is processed for the following purposes, relying on the legal grounds set out in Articles 5 and 6 of the PDPL:

• Conducting the Association's membership processes and dues tracking — express provision by law and performance of a contract.
• Conducting donation processes and recording them in accordance with legislation — legal obligation and legitimate interest.
• Evaluating volunteer applications and organising volunteer work — explicit consent and legitimate interest.
• Responding to communication requests and applications — legitimate interest.
• Examining and documenting reports of rights violations and conducting legal processes — being necessary for the establishment, exercise or protection of a right.
• Sending the e-newsletter and announcements — explicit consent.
• Ensuring website security and legal obligations — legal obligation and legitimate interest.

5. Transfer of Personal Data

Your personal data may be transferred to the following groups of recipients, limited to the above purposes and in accordance with Articles 8 and 9 of the PDPL:

• Suppliers from whom we receive services such as hosting, e-mail and payment infrastructure (in their capacity as data processors, within the framework of contractual safeguards).
• Public institutions and organisations and judicial and administrative authorities legally empowered to do so.
• Where your explicit consent exists or where necessary for the protection of a right, and owing to the nature of our work, national and international rights-based institutions, organisations and mechanisms.

Apart from the cases stated above, your data is not shared with third parties. Transfer abroad is carried out only where the conditions provided for in the PDPL are met.

6. Method of Collection

Your personal data is collected through the membership, donation, volunteer and contact forms on our website, e-mail correspondence, event registrations and automatic technical records (cookies and log files); by wholly or partly automated means or by non-automated means.

7. Retention Periods

Your personal data is retained for the period required by the purpose of processing and for the statutory limitation and retention periods provided for in the relevant legislation. When the period expires or the purpose of processing ceases, your data is deleted, destroyed or anonymised.

8. Rights of the Data Subject (PDPL Art. 11)

Pursuant to Article 11 of the PDPL, by applying to the data controller you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in accordance with that purpose,
• Know the third parties to whom it is transferred domestically or abroad,
• Request correction if it has been processed incompletely or inaccurately,
• Request its deletion or destruction within the conditions of Article 7 of the PDPL,
• Request that correction, deletion and destruction operations be notified to third parties to whom the data has been transferred,
• Object to a result arising against you through analysis exclusively by automated systems,
• Claim compensation if you suffer damage due to unlawful processing.

9. Exercising Your Rights and Applications

You may submit your requests regarding the above rights, together with information verifying your identity and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels:

Your applications are concluded free of charge within 30 days at the latest, depending on the nature of the request. However, if the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. If your request is rejected, you reserve the right to file a complaint with the Personal Data Protection Board within 30 days of the notification of our reasoned response.

Last updated: June 2026