Türkçe metin

COP31 VOLUNTEER MOBILE APP
PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This privacy notice has been prepared pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about your personal data processed through the COP31 Volunteer mobile application ("App"), which you use as part of the COP31 Volunteer Programme ("Programme"). In this notice, "Summit" means the COP31 Summit taking place in Antalya from 9 to 20 November 2026.

1. Data Controller

1.1. Your personal data are processed by UKX Danışmanlık Ticaret Anonim Şirketi ("UKX"), acting as the data controller, whose details are set out below.

1.2. The Programme is run by UKX under the auspices of the Ministry of Environment, Urbanisation and Climate Change of the Republic of Türkiye. This notice covers volunteers who use the App.

2. Your Personal Data, Purposes of Processing and Legal Bases

2.1. Your first name, surname, e-mail address and telephone number are processed to create your account in the App, verify your identity when you log in and communicate with you about the Programme. These data are processed on the basis of Article 5(2)(c) of the Law (processing necessary for the establishment or performance of a contract), as they are directly related to the establishment and performance of your volunteering relationship with us under the Programme.

2.2. Your task and role preferences, skills, languages you know and the interface language you select in the App are processed to identify a suitable task for you, plan teams and shifts, and provide the App in your preferred language. Your accommodation and shuttle stop assignments are processed to organise accommodation and transport. These data are processed on the basis of Article 5(2)(c) of the Law.

2.3. Your attendance check-in and participation records (whether you attended your task in the daily attendance taken by your team leader, any note on it, and the date) are processed to monitor shifts and tasks, ensure safety by identifying the volunteers present in task areas, document your participation, and administer certificates of participation. Authorised personnel may scan the QR identity code shown in your App with their own device's camera to verify your identity; no camera image or photograph is recorded, and no record is kept of the scan. These data are processed on the basis of Article 5(2)(c) and Article 5(2)(f) of the Law (necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed).

2.4. Your in-app messages (message content, sender and recipient details, and the times of sending and reading) are processed to enable operational communication between coordinators, team leaders and volunteers, and to investigate a problem where necessary, on the basis of Articles 5(2)(c) and 5(2)(f) of the Law. Please do not share information about your health in your messages. If you report a message or conversation, the reason and description you give are also processed, on the same legal bases, to review the conversation concerned and take the necessary action.

2.5. The interview assessment made by coordinators in the App (scores, language level, notes and decision), notes kept about you by coordinators, performance reviews by coordinators and team leaders, your team leader's daily team evaluations and other internal assessment records are processed to allocate tasks, monitor volunteer participation and performance, determine entitlement to certificates of participation, and report on the Programme, on the basis of Articles 5(2)(c) and 5(2)(f) of the Law.

2.6. Your notification record (push notification token, device name and the time the App was last used) and the history of notifications sent to you are processed to deliver announcements about tasks, shifts, accommodation, transport, safety and emergencies to your device and to ensure session security, on the basis of Articles 5(2)(c) and 5(2)(f) of the Law. No notifications containing promotional, advertising or sponsor content are sent through the App; if such notifications are planned, your permission will be requested separately. You may disable notification permission in your device settings; in that case, announcements will continue to be displayed within the App.

2.7. Error and crash logs (device model, operating system version and technical logs relating to the time the error occurred) and logs of sign-ins and of changes made in the App (IP address, the account performing the action and its time) are processed to identify and resolve errors in the App and ensure information security, on the basis of Article 5(2)(f) of the Law.

2.8. Your support requests (the subject, category and description of the request, correspondence on the request, internal notes by authorised personnel and records of the request being transferred to another unit) are processed to handle your request, refer it to the relevant unit where necessary and monitor service quality, on the basis of Articles 5(2)(c) and 5(2)(f) of the Law. Please do not include health details such as diagnoses, illnesses or medication in your support requests; in a medical emergency, call 112.

2.9. The time of the record confirming that you have read this notice and the date of the notice you read, any records of consents you gave in earlier versions of the App, and records of your requests and account deletion requests are processed to demonstrate compliance with obligations under the Law, on the basis of Article 5(2)(ç) of the Law (necessary for compliance with a legal obligation) and Article 5(2)(e) of the Law (necessary for the establishment, exercise or protection of a right).

3. Method of Collecting Personal Data

3.1. Your personal data are collected electronically, by partly automated means, through the forms you complete, actions you take and messages you send when registering for and using the App.

3.2. Your notification record, last usage time and error logs are collected automatically from your device while the App is running. Attendance records, the interview assessment, coordinator notes, performance reviews and daily team evaluations are created in the App by the relevant coordinators and team leaders; your support requests are entered into the App by you.

4. Transfer of Personal Data

4.1. Your first name, surname, contact details, task and assignment information and participation records may be transferred to the Ministry of Environment, Urbanisation and Climate Change of the Republic of Türkiye and other public authorities responsible for organising COP31 to coordinate the Programme, carry out accreditation and site security procedures, and report on the Programme, under Articles 5(2)(c) and 5(2)(f) of the Law.

4.2. Your personal data may be transferred to suppliers from whom we obtain services for hosting, technically operating and maintaining the App, sending verification e-mails and notifications, and keeping error logs, and to our group company UKX Tech Danışmanlık A.Ş., which carries out the technical operation of the App, only to the extent required for these services and within the limits of UKX's instructions, under Articles 5(2)(c) and 5(2)(f) of the Law.

4.3. Your personal data may be transferred to legally authorised public institutions and bodies and judicial authorities to the extent required by their requests and applicable legislation, and to our lawyers and advisers in connection with a dispute or the protection of a right, under Article 5(2)(a) of the Law (expressly provided for by law) and Articles 5(2)(ç) and 5(2)(e) of the Law. Any transfer of special category personal data under this paragraph is limited to what is expressly provided for by law or necessary for the establishment, exercise or protection of a right, under Article 6(3)(b) or 6(3)(d) and Article 8 of the Law, with the required safeguards.

4.4. In an emergency, where you are unable in the circumstances to give consent, or your consent is not legally valid, information strictly necessary to protect your or another person's life or physical integrity may be disclosed to medical and emergency response teams under Article 5(2)(b) of the Law (necessary to protect the life or physical integrity of a person who is unable in the circumstances to give consent or whose consent is not legally valid), Article 6(3)(c) of the Law where special category data are involved, and Article 8 of the Law.

4.5. Your personal data are not shared with the Programme's sponsors. Sponsors are provided only with anonymous, aggregate statistics that do not allow you to be identified. Within the App, your team leader may access only the information about volunteers in their own team that is necessary for task management.

5. Transfer of Personal Data Abroad

5.1. The App's data (including backups) are hosted on servers in Türkiye; no separate service is used for error and crash logs. To deliver notifications to your device, the push notification token and a generic notification text are transmitted through the Apple Push Notification service operated by Apple Inc. on iOS devices and the Firebase Cloud Messaging service operated by Google LLC on Android devices; the servers of these services are located abroad, primarily in the United States of America. On Android devices, the notification infrastructure and the Google ML Kit component used when authorised personnel scan QR codes may send technical device identifiers and usage information to Google LLC for the service to function. Verification code, password reset and request outcome e-mails are sent through the Google Workspace service provided by Google Cloud EMEA Limited (Ireland); within this service, data are processed abroad by Google group companies, including Google LLC.

5.2. These transfers are carried out under Article 9(4)(c) of the Law by signing the standard contract published by the Personal Data Protection Board with the relevant service providers and notifying the Personal Data Protection Authority. Notification content does not include your name, health information or similar details; these details are displayed within the App.

6. Retention Periods

6.1. Your personal data are retained for as long as required for the purposes for which they are processed and are deleted, destroyed or anonymised at the end of that period. The main retention periods are shown in the table below. In the table, "the end of the Programme" means the completion of the closure and reporting phase following the Summit and is expected to be 31 December 2026. If you delete your account, your data are deleted without waiting for these periods to expire, except for the records specified in Section 7.

7. Deleting Your Account

7.1. You may delete your account at any time by following "Profile > Settings > Delete My Account" in the App. If you cannot access the App, you may submit your request through the web form at www.cop31volunteers.com/uygulama/hesap-silme or through the request channels set out in Section 8.

7.2. As soon as you confirm your deletion request, your account is closed, your sessions are terminated, your notification record is deleted and your profile is removed from the lists viewed by team leaders and coordinators. Deleting your account during the Summit results in the cancellation of your task assignments.

7.3. Your personal data, other than the records of notice, requests and deletion retained for the periods specified in Section 6, are deleted or anonymised within no more than 30 days of your request, so that relevant users cannot access or reuse them, including copies in backups. For this purpose, "relevant users" excludes persons or units responsible for the technical storage, protection and backup of the data. The outcome is communicated to your registered e-mail address. The conversations you took part in are deleted entirely, together with the other participants' messages. Deletion also covers other copies, such as export files taken out of the App; these copies are tracked through the persons who obtained them and deleted. Technical copies remaining in backups are not used in ordinary operations and are destroyed within no more than 7 days of your request; if a backup is restored during this period, the deletion is re-applied before the system is made available for use.

7.4. The record of your deletion request (your e-mail address, the request and completion dates, the categories of data deleted and records of the Privacy Notice versions you read) is retained with restricted access for the period specified in Section 6, to demonstrate compliance with obligations under the Law, under Article 5(2)(ç) of the Law. The e-mail address in this record is irreversibly hashed 30 days after the outcome is communicated to you.

7.5. If your personal data have previously been transferred to the recipients specified in Sections 4 and 5, those recipients are notified of the deletion and we ensure that the necessary action is also taken by them. If there is a legal ground preventing your request from being fulfilled in full (e.g. an ongoing dispute or a request from a competent authority), the deletion of your data other than the data that must be retained on legal grounds continues. If your request is partially fulfilled, you will be informed of the retained data, the reason for retention and the retention period within no more than 30 days.

8. Your Rights and How to Submit a Request

8.1. Under Article 11 of the Law, you have the right to learn whether your personal data are being processed, request information, learn the purpose of processing and the persons to whom your data have been transferred, request rectification or deletion, object to a result that is to your detriment arising from analysis carried out exclusively through automated systems, and seek compensation if you suffer damage due to unlawful processing.

8.2. You may submit your requests through "Profile > Settings > Privacy > Data Request" in the App; by sending an e-mail from the e-mail address registered in the App to kvkk@ukxperience.com; from your registered electronic mail (KEP) address to ukxdanismanlik@hs01.kep.tr; by signing your request with a secure electronic signature or mobile signature and sending it to kvkk@ukxperience.com; or in writing to the address in Section 1.1. Your request must include the information listed in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller. A request to delete your account, however, is fulfilled through the method described in Section 7 by verifying your identity through your account, without requiring that information separately.

8.3. Your requests will be concluded free of charge within no more than 30 days. We accept requests in Turkish and English. As the Communiqué requires formal applications to be made in Turkish, we will, on request, help you prepare a Turkish application and provide the required information. We will not delay handling your English-language request or your simplified account deletion request for this reason. If your request is rejected, you consider the response insufficient or no response is provided within the required period, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law.

9. Changes

9.1. This notice is updated if our data processing activities change. If your personal data are to be processed for a new purpose, you will be informed separately before that processing begins. You can access the current version of this notice in the App's "Privacy" section and at www.cop31volunteers.com/uygulama/privacy.

This notice was last updated on 8 October 2026.