This privacy notice explains, under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), for what purposes personal data of visitors to iklimfinansman.org are processed, with whom they may be shared, and what rights you have.
1. Data controller
This website is operated under the Strengthening the National Capacity of Climate Finance Project, funded by the European Union. The data controller is the project contractor, NIRAS IC Sp. z o.o. The company is established in Poland; the processing therefore falls under both the KVKK and the GDPR.
| Details | |
|---|---|
| Data controller | NIRAS IC Sp. z o.o. (consortium leader) |
| Address | Project Office · Çankaya Mahallesi, Ebuziya Tevfik Sokak No: 21/4, Çankaya / Ankara, Türkiye |
| [email protected] |
At the end of the project, the website and the data it holds will be transferred to the Directorate of Climate Change. This transfer constitutes a change of data controller; this notice will be updated and data subjects informed before it takes place.
2. Personal data processed, purposes and legal bases
This website has no membership, subscription or newsletter sign-up, and no form that collects personal data directly on the site.
| Data category | When it is collected | Purpose | Legal basis |
|---|---|---|---|
| Name, surname, e-mail address, message content | Only if you write to us directly by e-mail | Responding to questions, requests and applications | Legitimate interest — KVKK Art. 5/2-f · GDPR Art. 6(1)(f) |
| Name, organisation, job title, contact details | For training, workshop and event applications. Applications are not collected on this site but through an external Google Forms form; the site only links to it. | Participant registration, issuing certificates of attendance, project reporting | Performance of a contract and legitimate interest — KVKK Art. 5/2-c, 5/2-f · GDPR Art. 6(1)(b), 6(1)(f) |
| IP address, browser and device information, time of visit, pages viewed | Automatically, in server logs and the site statistics tool | Information security, detection of errors and misuse, aggregated visitor statistics | Legitimate interest — KVKK Art. 5/2-f · GDPR Art. 6(1)(f) |
| Strictly necessary cookie data | Automatically | Operation of the site, remembering your language choice, cache management, storing your cookie preference | Legitimate interest — KVKK Art. 5/2-f · GDPR Art. 6(1)(f) |
| Cookies set by embedded third-party content, and the IP address disclosed to those providers | Only if you give consent in the cookie banner | Displaying video, social media feed, map and share buttons | Explicit consent — KVKK Art. 5/1 · GDPR Art. 6(1)(a) |
Site statistics are kept on our own server. No third-party analytics service such as Google Analytics is used; these data are not transferred to anyone else.
Training and event applications do not request special categories of personal data such as health data or identity numbers. Please do not enter such data into the forms.
3. Third-party content and cookie consent
The site includes content loaded from the servers of other organisations. When such content loads, the organisation concerned sees your IP address and may set cookies in your browser:
- YouTube (Google Ireland Ltd. / Google LLC) — the project video on the home page
- Instagram (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) — the social media feed
- Google Maps (Google Ireland Ltd. / Google LLC) — the map on the Contact page
- AddToAny — the share buttons on news pages
This content does not load until you consent. If you do not accept non-essential cookies in the banner shown on your first visit, you will see only a placeholder notice in place of that content and no connection to any third party is made.
You can change or withdraw your cookie preference at any time. For details and the current list of cookies, see the Cookie Policy.
4. Transfer of personal data
Your personal data may be shared with the following parties, only to the extent necessary for the purposes above:
- Hosting provider — for the technical operation of the site
- Google LLC / Google Ireland Ltd. — only for training and event applications, under the Google Forms service
- Embedded content providers you have consented to — those listed in section 3, only where explicit consent has been given
- Contracting Authority and beneficiary institution — for project reporting, as a rule in aggregated and anonymised form; event participant lists are the exception
- Competent public authorities — within the framework of statutory obligations
Some of these providers operate servers outside Türkiye (in the European Union and/or the United States). For embedded content, transfers take place solely on the basis of your explicit consent. Other transfers are made under the mechanisms set out in Article 9 of the KVKK — an adequacy decision, appropriate safeguards, or the exceptional cases listed in the Law.
5. Retention periods
| Data | Retention period |
|---|---|
| E-mail correspondence | 2 years from the conclusion of the request |
| Event and training application records | Until project closure; retention periods required by EU financial control rules are reserved |
| Server access logs | 1 year |
| Site statistics data | In aggregated form, for the duration of the project |
| Cookie data | The periods stated in the Cookie Policy |
6. Your rights
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- learn whether your personal data are being processed,
- request information if they have been processed,
- learn the purpose of processing and whether the data are used accordingly,
- know the third parties to whom the data are transferred, in Türkiye or abroad,
- request rectification if the data are incomplete or inaccurate,
- request erasure or destruction under the conditions set out in the Law,
- request that rectification, erasure and destruction be notified to third parties to whom the data were transferred,
- object to a result adverse to you arising from analysis solely by automated systems,
- claim compensation for damage suffered as a result of unlawful processing.
Under the GDPR you additionally have the right to:
- restriction of processing (Art. 18),
- data portability — to receive your data in a structured, commonly used format or have them transmitted to another controller (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal (Art. 7(3)).
7. How to apply, and complaints
You may send your requests by e-mail to [email protected] or in writing to the project office address above. Your application will be concluded within 30 days at the latest.
If your application is rejected or no reply is given:
- in Türkiye, you may lodge a complaint with the Personal Data Protection Board;
- if you are in the European Union, you may lodge a complaint with the supervisory authority of your member state, or with UODO in Poland, where the data controller is established.
8. Changes
This notice may be revised in line with changes in legislation or updates to the website. The current version is always published on this page.
Last updated: 24 September 2026