Personal Data Protection Notice

This Privacy Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the "KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation. It explains how personal data is processed for people who visit the Müzik Hackathon website, create a membership account, or apply to a competition or event, as well as for their legal representatives where relevant.

This notice is not a request for explicit consent. The disclosure obligation and explicit consent are two separate legal steps. Where a processing activity must rely on explicit consent, that consent is obtained separately and only for the specific processing activity concerned.

1. DATA CONTROLLER

Under the KVKK, the data controller is Konya Büyükşehir Belediyesi, which runs the Müzik Hackathon event as part of Genç Kültür Kart (the "Municipality" or the "Data Controller"). Müzik Hackathon and Genç Kültür Kart operate within the Municipality and under its project framework when carrying out membership, application, and event processes.

Project contact address: Bosna Hersek, Osmanlı Cd. No: 2, 42250 Selçuklu/Konya.

Data subject requests under the KVKK must be submitted through the current official application channels published by the Municipality. The application address currently published is Konevi Mahallesi, Millet Caddesi No:14, Meram/Konya, and the registered electronic mail (KEP) address is konyabuyuksehirbelediyesi@hs01.kep.tr.

2. SCOPE OF THIS NOTICE AND CATEGORIES OF DATA SUBJECTS

This Privacy Notice covers the following groups of data subjects:

• People who visit the Müzik Hackathon website,
• Users who create a membership account on the Platform,
• Users and band members who apply to the Müzik Hackathon competition, workshops, or other events,
• Parents, guardians, or other legal representatives of users under the age of eighteen (18), where their knowledge or approval is required,
• People who send messages, support requests, or other enquiries through the Platform.

Where photographs and video footage taken at the physical event venue, stage and performance recordings, or processes involving works, performances, phonograms, and digital distribution require it, a separate event/participant notice and the relevant intellectual property documents also apply.

3. CATEGORIES OF PERSONAL DATA PROCESSED

When you use the Platform, create a membership account, or go through an application process, the following personal data may be processed depending on the nature of the activity:

• Identity data: full name, Turkish national ID number, date of birth, and age.
• Contact and location data: phone number, email address, and city.
• Membership and account data: account status, membership date, user verification records, SMS verification and session data, and account closure or suspension records.
• Music profile data: how long you have been involved in music, instrument, vocals, songwriting, composition, arrangement, production, recording/mixing, DJing, band experience, and any other music profile details you select or provide.
• Application and competition data: band name, band membership and role, band invitations, application form answers, demo link, application date and status, and application records created during evaluation and jury processes.
• User content: demos, audio, images, text, files, and similar content uploaded to the Platform, shared via a link, or submitted as part of an application.
• Transaction security data: IP address, transaction and access dates and times, browser and device information, session and security records, and error and system logs.
• Legal transaction and consent records: the version of the User Agreement or Competition Rules accepted, the record showing that this notice was presented, date and time stamps for approvals and preferences, and legal representative verification records where required.
• Legal representative data: only where necessary, the full name, contact details, and representation/approval records of the legal representative of a user under 18.
• Communication preferences: records showing when an optional preference for event announcements or commercial electronic messages was given, changed, or withdrawn.

The Platform is not designed to request health data, biometric data, criminal conviction records, or similar special categories of personal data for membership. Users should not share data of this kind in free-text or file upload fields unless it is genuinely necessary.

4. PURPOSES AND LEGAL BASES OF PROCESSING

Personal data is processed for the specific purposes below, each relying on the KVKK processing condition appropriate to that activity:

5. HOW PERSONAL DATA IS COLLECTED

Personal data is collected electronically, by fully or partly automated means, through membership and login screens, profile and application forms, band invitations, demo and link sharing fields, the SMS verification system, email and other electronic communication channels, requests and support messages sent by users, and the transaction and security records generated automatically while the Platform is running.

Legal representative data may be obtained from the user, from the legal representative, or through the electronic or physical approval process used for verification, and only where it is necessary for a user under 18. Where the data is not obtained directly from the legal representative, a separate notice is provided at the time required by the applicable legislation.

6. TRANSFER OF PERSONAL DATA

Personal data may be transferred to the following groups of recipients, limited to and proportionate with the processing purpose and in line with the conditions set out in Article 8 and, where applicable, Article 9 of the KVKK:

• Units and staff within the Municipality authorised to run Müzik Hackathon and Genç Kültür Kart processes: for the purpose of carrying out membership, application, event, security, and communication processes.
• Jury members and people authorised to take part in the evaluation: limited to the application, music profile, and demo/content data needed to evaluate an application.
• SMS verification, hosting, software, maintenance, information security, and similar technical service providers: for the purpose of operating the Platform and providing authentication, communication, and security services, within a data processor/service provider relationship.
• Where a prize is awarded, the authorised Municipality units involved in payment and the related legal, financial, and administrative procedures, along with banks and payment institutions to the extent required by legislation: for the purpose of carrying out prize and payment transactions.
• Courts, public prosecutors, law enforcement, supervisory authorities, and other competent public institutions: solely within the scope of statutory powers and obligations.

Personal data is never sold commercially to third parties or shared for independent marketing purposes outside the purposes set out above.

If the Platform's technical infrastructure comes to use a service or provider that involves transferring data abroad, the transfer conditions and appropriate safeguards set out in Article 9 of the KVKK will be put in place before that transfer begins, and the nature, recipient group, and purpose of the transfer will be explained to data subjects in an updated version of this notice.

7. RETENTION AND DISPOSAL OF PERSONAL DATA

Personal data is retained in line with the principles in Article 4 of the KVKK: relevance, limitation, and proportionality to the purpose, and retention only for as long as necessary. Closing an account means that active use of that account has ended; however, a limited set of records whose legal basis still applies does not have to be destroyed from every system at the same moment and automatically.

Where legislation expressly provides for a longer retention period, or where longer retention is required for an ongoing dispute, review, or investigation, or for the establishment, exercise, or protection of a right, only the necessary personal data is kept for as long as that legal basis lasts. Data whose processing reason no longer applies is deleted, destroyed, or anonymized in accordance with Article 7 of the KVKK and the relevant secondary legislation.

The two-year retention period is not a basis for using the data of a person whose account has been closed for any new purpose beyond active membership, profile creation, promotion, or storage.

8. SPECIAL NOTE ON PROCESSING THE TURKISH NATIONAL ID NUMBER

The Turkish national ID number is processed in order to correctly match a membership with the person behind it, prevent duplicate or false memberships, provide identity verification during competition and prize processes, and, where necessary, meet legal and financial obligations. It is never displayed openly in user interfaces and is protected by technical and administrative measures that limit access to authorised personnel.

The principles of necessity and proportionality are observed when processing the Turkish national ID number. Where the same purposes can be achieved with less data, or where storing the full ID number is no longer needed, data minimization and appropriate technical methods are assessed separately.

9. USERS AGED 15-17 AND LEGAL REPRESENTATIVES

The minimum age for membership on the Platform is fifteen (15). For users who have not yet turned eighteen (18), where membership or participation in a competition or event legally requires the consent of a legal representative, that approval may be requested, and limited personal data may be processed in order to verify it.

Legal representative data is used only to verify the authority to represent and the approval given, to protect user safety, to ensure the legal validity of the transaction, and to manage disputes where necessary. Legal representative data is never used for promotion or marketing outside the membership relationship.

10. EXPLICIT CONSENT AND COMMERCIAL ELECTRONIC MESSAGES

Presenting this Privacy Notice to a user and recording an "I have read and understood" acknowledgement does not mean that explicit consent has been given for the processing of personal data. No separate explicit consent is requested for processing activities in the membership and competition processes that can rely on one of the conditions in the second paragraph of Article 5 of the KVKK.

Where a separate processing activity does legally require explicit consent, that consent is obtained on a specific subject, based on information, and given freely, separately from acceptance of this notice and the User Agreement. Withholding consent is not on its own a reason to block core membership functions that do not require consent.

For commercial electronic messages such as event announcements, campaigns, or promotions, a separate message consent is obtained where the applicable electronic communications legislation requires it. Users can withdraw this optional preference through the relevant channels.

11. YOUR RIGHTS UNDER ARTICLE 11 OF THE KVKK

As a data subject, you may apply to the Data Controller to:

• Find out whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether your data is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom your personal data has been transferred,
• Request correction of your personal data if it has been processed incompletely or inaccurately,
• Request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• Request that any correction, deletion, or destruction be notified to the third parties to whom your data has been transferred,
• Object to any outcome to your detriment that results from your data being analysed exclusively by automated systems,
• Claim compensation if you suffer damage because your personal data has been processed unlawfully.

You have the rights listed above.

12. HOW TO APPLY TO THE DATA CONTROLLER

Requests under Article 11 of the KVKK can be submitted to Konya Büyükşehir Belediyesi using the methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. Applicants should clearly state their identity and their request, and may use the current data subject application form and channels published by the Municipality.

• Written application: to Konevi Mahallesi, Millet Caddesi No:14, Meram/Konya,
• KEP: to konyabuyuksehirbelediyesi@hs01.kep.tr,
• Via secure electronic signature, mobile signature, or the e-petition and electronic application channels announced by the Municipality.

Applications are concluded as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. If responding involves an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may apply. The Data Controller may ask for additional information or verification to confirm that the application belongs to the data subject.

13. PROVISION OF THIS NOTICE AND CHANGES TO IT

This Privacy Notice is made available to users on the membership and application screens where personal data is first collected. If the purpose of processing, the data categories, the legal basis, the transfers, or the collection method change, the notice is updated before the changed activity begins, and data subjects are informed again by an appropriate method.

The Data Controller may record the version of the notice, the date it was presented, and the related technical records in accordance with legislation, as evidence that the disclosure obligation has been fulfilled. The wording used on the membership screen may read: "I have read the KVKK Privacy Notice and have been informed about the processing of my personal data." This statement is not to be interpreted as explicit consent or as acceptance of a contract.