KVKK disclosure notice

Data controller

Under Law No. 6698 on the Protection of Personal Data (KVKK), your personal data is processed by MeetUp Business Club as data controller. Address: ⁨SKYLAND B BLOK — Giriş katı, Huzur, Azerbaycan Cd. No:4, 34415 Sarıyer/İstanbul⁩. Data protection contact: ⁨privacy@meetupbusinessclub.com⁩.

The club's Turkish company registration is not yet complete. Once it is, the registered trade name, registered address, tax office and tax number will be published in a new version of this notice. We are not subject to VERBİS registration, because we stay below the employee-count and balance-sheet thresholds and processing special categories of personal data is not our main activity.

Personal data we process

Our processing is limited to the list below. We collect no health data, no biometric data and no other special category of personal data.

• Identity: first and last name, title, preferred language and, if you add one, a profile photo.
• Contact: mobile number, WhatsApp number and email address.
• Professional: the companies you work with, your role, city and country, industry and markets.
• Customer transaction: your membership application, your needs and what you can offer, the topics you choose, introductions and meeting requests.
• Relationship graph: who you know and how, the history of introductions, and relationships you record yourself.
• Third-party data: the name and business field of someone a member has recorded as one of their own relationships. It is kept at category level only, with no free text.
• Physical premises security: QR check-in records at events and the lounge, lounge entry and exit records, and lounge closed-circuit television (CCTV) footage.
• Transaction security: sign-in records, IP address, and audit records of sensitive actions and of staff reads of contact details.
• Financial: the order number, amount, currency and status of membership and lounge payments. Your card or bank account number never reaches us.
• Marketing: your channel preferences and consent history.
• Derived data: information extracted with AI. It is stored with its origin, shown under a separate label and open to human review.

Purposes of processing

• Reviewing membership applications, and establishing and performing the membership.
• Making introductions with mutual consent, and matching members with tables, sessions and events.
• Organising events and lounge access, and checking entry by QR code.
• Scheduling lounge visit appointments and managing capacity.
• Keeping the lounge and our offices secure, and creating and following visitor records.
• Verifying the business a member states and a company-page request.
• Sending transactional messages and, with your explicit consent, news and offers.
• Information security, access control, audit and preventing misuse.
• Following collection, handling refunds and running financial affairs.
• Meeting legal obligations, answering requests of competent authorities and resolving legal disputes.

Legal grounds (articles 5 and 6)

Your personal data is processed on the grounds below. Because we process no special categories of personal data, there is no processing within the scope of article 6 of the KVKK; if such processing ever became necessary, it would not begin before a new version of this notice is published and, where required, your explicit consent is obtained.

• Article 5(2)(a): the processing is expressly provided for by law.
• Article 5(2)(c): processing is necessary to establish or perform the membership contract.
• Article 5(2)(ç): processing is necessary for us to meet a legal obligation.
• Article 5(2)(e): processing is necessary to establish, exercise or protect a right.
• Article 5(2)(f): our legitimate interest — such as invitation-based vetting, introductions and security — provided it does not harm your fundamental rights and freedoms.
• Article 5(1): your explicit consent, for marketing messages and wherever the law requires explicit consent.

Method of collection

We collect data partly by automated and partly by non-automated means: through the website and member app, through the public forms on the site, from the member who invited you, from business cards and event lists that staff enter with a recorded legal basis, from QR scans at entry, from the lounge CCTV system, from paper forms and face-to-face conversations at the lounge, by post and courier, and through AI-assisted processing whose results are labelled separately.

Call-centre recording, fax, e-invoicing and similar electronic documents, and cheque and promissory-note records are not used at all, and no data is collected through those channels.

Who we transfer your data to

We do not sell personal data. Transfers are made only to the recipient groups below, and only as far as each task requires:

• Suppliers and business partners that run the service on our behalf: hosting, sign-in, email, WhatsApp, AI processing and payment providers.
• Company officers and authorised staff: only as far as their role requires, with sensitive reads written to the audit log.
• Service partners — our legal, financial and technology advisers: they see only the brief of a session you requested, never your contact details or the member pool.
• Our independent auditor, tax adviser and lawyers: to meet legal obligations and to establish, exercise and defend our rights.
• Judicial authorities and public bodies: where the law requires it, to answer incoming requests and resolve legal disputes.
• Other members: only the parts of your profile you have opened yourself. Your contact details are given to no member without mutual consent.

Transfer of personal data (articles 8 and 9)

Within Türkiye, data may be shared with competent public authorities when the law requires it. Your contact details are transferred to no member without mutual consent.

Data is transferred abroad to the providers that run the service: Supabase (Frankfurt, Germany) for the database and sign-in; Vercel for delivering the site itself; Google (Gemini API, United States) or Anthropic (Claude API) for AI processing and translation; UltraMsg and Meta for WhatsApp; Brevo (France) for email; and Trawili for payment. These transfers are made under article 9 of the KVKK: on appropriate safeguards such as a standard contract notified to the Personal Data Protection Authority, or in the exceptional cases the law allows, with your explicit consent.

Retention periods

We keep data only as long as the purpose and the statutory retention periods require:

• Sign-in codes: at most 24 hours.
• Check-in QR codes: about 90 seconds; a used code is not accepted again.
• Lounge CCTV footage: at most 30 days, then overwritten.
• In-app notifications: 90 days after they are read, 365 days if unread.
• Raw contact details from public forms: erased once linked to your record, or after 90 days at the latest.
• Profile, company, needs and attendance records: for the duration of the membership and 10 years after it ends — the limitation period in article 146 of the Turkish Code of Obligations.
• Audit records: 10 years. Append-only; nobody can edit or delete them.
• Financial records: 10 years — article 82 of the Turkish Commercial Code.

Your rights as a data subject (article 11)

Under article 11 of the KVKK you have the following rights regarding your personal data:

• to learn whether your personal data is processed;
• to request information if it has been processed;
• to learn the purpose of processing and whether it is used accordingly;
• to know the third parties in Türkiye or abroad to whom it is transferred;
• to request correction if it has been processed incompletely or inaccurately;
• to request erasure or destruction within the conditions of article 7;
• to request that correction, erasure or destruction be notified to the third parties it was transferred to;
• to object to a result against you that arises exclusively from automated analysis;
• to claim compensation if you suffer damage from unlawful processing.

Where these rights do not apply (article 28)

Under the second paragraph of article 28 of the KVKK, in the cases below you cannot exercise the rights above apart from the right to claim compensation for damage. This is not a practice of ours; it is the boundary the law itself draws:

• the processing is necessary for the prevention of crime or for criminal investigation;
• the personal data processed has been made public by the data subject themselves;
• the processing is necessary, on the authority given by law, for competent public institutions and professional bodies with public-institution status to carry out supervisory or regulatory duties, or for disciplinary investigation or prosecution;
• the processing is necessary to protect the State's economic and financial interests in matters of budget, tax and public finance.

How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request to ⁨privacy@meetupbusinessclub.com⁩ by registered electronic mail (KEP), secure electronic signature, mobile signature, or from the email address you registered with us earlier. This is the fastest route.

A written, wet-signed application is also possible: send it to the address above through a notary, or deliver it by hand yourself or through your proxy.

Your application must include documents verifying your identity, any documents supporting your request, and — if you wish to exercise your right through a proxy — a copy of a power of attorney containing the special authority.

We reply free of charge within 30 days at the latest. If the reply involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is refused, if you find the reply insufficient, or if you receive no reply in time, you may complain to the Board within the periods set in article 14 of the KVKK.

Incomplete information, a request that is not clear enough, or a missing copy of a power of attorney can delay the handling of your application. In that case we do not refuse it: we write to you saying what is missing, and once you complete it the period continues from where it stopped.