Privacy Policy for the “Spring Conference 2026”
Information is hereby provided on the processing of personal data carried out by the Turkish Personal Data Protection Authority (hereinafter – the Organizer) for the purpose of organization and proceeding of the “Spring Conference 2026” (hereinafter – event).
1. Identity and contact details of the controller
Name: Turkish Personal Data Protection Authority
Address: Nasuh Akar Mah. 1407. Sokak No:6, Çankaya / Ankara
Phone: +90 312 216 50 00
E-mail address: springconference@kvkk.gov.tr.
Website address: www.kvkk.gov.tr.
3. Purpose of processing and the categories of data processed
Processing related to the invited speakers
| Categories of personal data | Purpose of the processing of personal data |
| Name, surname, organisation represented, position, e-mail address | Maintaining communication with the conference participants and ensuring the provision of up-to-date information |
| Name, surname, organisation represented, position, e-mail address, photo, brief description | Maintaining communication with the event participants and ensuring the provision of up-to-date information; promotion of the event, publication of information on the website www.dpaspringconference.org |
Sending out invitations
| Categories of personal data | Purpose of the processing of personal data |
| Name, organisation represented, position, e-mail address | Calling attention to the event, providing information to potential participants |
Processing related to webpage visitors
| Categories of personal data | Purpose of the processing of personal data |
| IP address, date and time of the visit, device type, browser type |
Preventing cyber threats and ensuring the security of the website. |
There will be no processing based on automated decision-making and profiling in the course of processing.
4. Legal basis for processing
Your personal data processed in accordance with Article 5(1) -regarding the open consent- and the paragraphs listed below of 5 (2) of the Turkish Personal Data Protection Law numbered 6698:
ç) It is necessary for compliance with a legal obligation to which the data controller is subject.
e) Data processing is necessary for the establishment, exercise or protection of any right.
f) Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
If a participant does not wish their picture and/or other information about their participation in the event to be published, they shall have the right to object by contacting the Organizer.
If the Organizer shares the data during an audit to a government authority responsible for monitoring the spending of public funds, the legal basis the Organizer will rely on is the necessity for compliance with a legal obligation.
The legal basis for processing when sending out satisfaction survey questions after the event is the legitimate interest of the Organizer to gather feedback that helps in assessing how successful the event was and identifying areas for improvement.
If a participant does not wish to receive satisfaction survey questions, they shall have the right to object by contacting the Organizer.
5. Period of retention of personal data
Personal data collected during online and in-person registration will be retained until the end of 2027.
Names, surnames, information about organisations represented, positions, e-mail addresses, photos and brief descriptions of the invited speakers, as well as photos and videos of the event will be archived as part of the annual report for the public interest.
Information about the IP addresses of the visitors of the website, dates and times of visits, device types and browser types will be retained for 1 month.
6. Recipients or categories of recipients of personal data
Personal data at the disposal of the Processors and the Organizer shall be considered as restricted access information and shall be disclosed to third parties only in the cases, procedures and amounts specified in legal acts or concluded agreements.
Upon your request, the Organizer is obliged to provide you with detailed information about the recipients of your personal data, unless the disclosure of such information is prohibited by law. For detailed information, please contact the Organizer with a reasoned application concerning the recipients or categories of recipients of your personal data.
7. International data transfers
Personal data mentioned in this policy will be stored only in Türkiye or the EU and will not be transferred to any other jurisdiction.
8. Data subject’s rights related to processing
· The right to access
Data subjects have the right to request information from the Organizer concerning whether the processing of their personal data is in progress and if so, they have the right to learn.
· The right to rectification
Data subjects may request the Organizer to rectify any inaccuracies in their personal data.
· The right to blocking (restriction of processing)
Data subjects may request the Organizer to restrict the processing of their personal data (by unambiguously indicating the restricted nature of processing and ensuring that processing is kept separate from other data).
· The right to object
Data subjects may object to the processing, if in their view, the Organizer is processing their personal data inappropriately in relation to the purpose indicated in this Privacy Policy. In this case, the Organizer has to verify that the processing of the personal data is warranted by legitimate reasons of compelling force, which override the interests, rights and freedoms of the data subject, or which are related to the establishment, enforcement or defence of legal claims.
· The right to withdraw consent
Where consent is the legal basis for processing their data, data subjects may withdraw their consent at any time by contacting the Organizer.
The right to erasure
Data subject have the right to request the erasure of their personal data.