Privacy Policy

1. Who we are

The Al Sharq Forum app (the "App") is operated by Al Sharq Forum — legally Şark Forum Derneği (Al Sharq Forum Association), tax number (VKN) 8000528707, Yenibosna Tax Office, registered address Yenibosna Merkez Mah. 29 Ekim Cad. No: 3, İstanbul Vizyon Park, A1 Blok, Kat 6, Daire 67, Bahçelievler, İstanbul, Türkiye ("we", "us", "the Forum"). For the purposes of the Turkish Personal Data Protection Law No. 6698 ("KVKK") we are the data controller of the personal data described here, and, where the European Union's General Data Protection Regulation ("GDPR") applies to you, the controller under the GDPR.

Contact for anything in this policy, including requests about your data:
forum@sharqforum.org

This policy explains what we collect through the App, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to the App on iOS and Android. It does not cover other websites or services that the App links to.

2. What we collect

We collect only what the App needs to run the conference with you. Most of it comes from you; some is created as you use the App.

Your account

• First and last name, email address, password, preferred language.
• Optional: phone number, organisation, job title, nationality.
• Your password is stored only as a one-way cryptographic hash; no one at the Forum can read it.

Your profile (optional, and only if you add it)

• Profile photo, short biography, topics of interest, social media links.
• Your directory settings: whether other participants can find you, and whether your organisation, country and email address are shown.

Your conference registration
When you register to attend, we ask for: date of birth, gender, nationality, country and city of residence, phone number, level and field of education, institution, job title, organisation and sector, how you will attend (in person or online), your preferred session language, your goals, topics and preferred session types, and how you heard about the conference. We also record the declarations you make on the form — that the information is accurate, that you agree to the processing of your data and to the Code of Conduct, that you accept being photographed or recorded at the conference, and, if you choose, that you want to receive news from us.

At the conference

• Your QR entry pass.
• Check-in and session scans: the time, the hall or session, and the staff member who scanned. We do not record your location.
• Your certificate of attendance, which is generated on request and not stored by us.

As you use the App

• Sessions you save to your schedule, speakers you follow, and "notify me" requests.
• The notifications you receive, whether you read them, and your notification preferences.

Messages
If you use messaging, we process the messages you send and receive, message requests, read receipts, your availability status (for example "Available" or "In a session"), and any users you block or reports you file.

Your device

• A push notification token, so we can send you notifications.
• The App version, your device platform (iOS or Android) and language, and short error reports when something goes wrong in the App.
• Crash reports, through Google Firebase Crashlytics, when the App closes unexpectedly or hits an error: the device model, operating system version, App version and the technical details of the error. They are not linked to your account (we never attach your name, email or user id) and are used only to find and fix faults.
• Your IP address is processed by our servers to deliver the service and to protect it against abuse (for example, limiting repeated sign-in attempts). It is not stored in our database.

What we do not collect
We do not collect your location, your contacts, or any advertising identifier. The App contains no advertising and no analytics tools; the only third-party diagnostic tool is the crash reporting described above. We do not track you across other apps or websites.

3. Device permissions

The App asks for these permissions only when you use the feature that needs them. You can refuse or withdraw any of them in your device settings; the rest of the App keeps working.

4. Why we use your data, and on what legal basis

5. Who can see your data

Other participants. If your directory visibility is on — it is on by default — registered participants can find you and see your name, photo, job title, organisation, nationality, interests and availability status. Your email is shown only if you choose. You can hide yourself or any of these details at any time in Profile → Directory visibility.

People you message. They see your messages, your name and photo, and — if you have them switched on — your read receipts and status.

Speakers. Speaker profiles in the App show what the speaker has agreed to publish.

Forum staff. Authorised staff see what they need to run the conference: registrations, check-ins and attendance. To keep the community safe, authorised staff can review conversations, for example to investigate a report. Every such review is recorded in our audit log.

Service providers. We use a small number of providers who process data on our instructions and only to run the App (section 6).

Authorities. We disclose data where the law requires us to.

We do not sell, rent or trade your personal data, and we do not use it for advertising.

6. Service providers and international transfers

Push notifications pass through Google and Apple. A message notification shows the sender's name and the beginning of the message, so that text passes through those services. You can turn off message notifications in the App's settings.

Some of these providers are outside Türkiye. Where personal data is transferred abroad, we do so in line with Article 9 of KVKK and, where it applies, Chapter V of the GDPR, using the safeguards those rules provide.

7. How long we keep your data

8. How we protect your data

All communication between the App and our servers is encrypted (HTTPS/TLS). Passwords are stored only as hashes. Your sign-in tokens are kept in your device's secure storage. Access to personal data inside the Forum is limited by role and recorded in an audit log. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

9. Your rights

Under Article 11 of KVKK — and, where it applies to you, the GDPR — you may:

• ask whether we process your personal data, and get a copy of it;
• learn why we process it and whether we use it accordingly;
• know the third parties, in Türkiye or abroad, to whom it is transferred;
• ask us to correct data that is incomplete or wrong;
• ask us to delete or anonymise it;
• ask us to tell the third parties we shared it with about any correction or deletion;
• object to a result that is against you and arises solely from automated processing (we do not make such decisions);
• claim compensation for damage caused by unlawful processing;
• withdraw any consent you gave, at any time, without affecting what was done before;
• under the GDPR, also object to processing based on our legitimate interests, ask for your data in a portable format, or ask us to restrict processing.

You can correct most of your data yourself in Profile → Edit profile, and delete your account yourself (section 10). For anything else, write to forum@sharqforum.org. We answer within 30 days. We may ask you to confirm your identity first.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Board of Türkiye (Kişisel Verileri Koruma Kurulu), or, if you are in the EU, to your local data protection authority.

10. Deleting your account

You can delete your account at any time, in either of these ways:

• In the App: Profile → Delete account, then confirm with your password.
• Without the App: follow the steps at https://crm.sharqforum.org/delete-account, or write to forum@sharqforum.org from the email address of your account.

When you delete your account:

• your profile — name, photo, biography, phone number, nationality, interests and links — is removed, and you disappear from the participant directory;
• your registration answers, saved sessions, followed speakers, notifications, push tokens and sign-in sessions are deleted, and any open registration is cancelled;
• the sign-in details stored for Face ID on your device are removed;
• messages you already sent stay in the other participants' conversations, but are shown from "Deleted user", without your name or photo;
• we keep only what the law requires us to keep (for example, records of attendance at an event you attended), and our backups roll off within the periods in section 7.

Deletion cannot be undone.

11. Children

The App is intended for people aged 18 and over, and you must be 18 or older to create an account. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it.

12. Changes to this policy

We will update this policy when the App or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the App before it takes effect.

13. Contact

Al Sharq Forum — Şark Forum Derneği, Yenibosna Merkez Mah. 29 Ekim Cad. No: 3, İstanbul Vizyon Park, A1 Blok, Kat 6, Daire 67, Bahçelievler, İstanbul, Türkiye
Email: forum@sharqforum.org
Website: www.sharqforum.org