GDPR NOTICE

This notice tells students who use the a2 Fairs (Akare) mobile app and the mobile.a2fairs.com website how their personal data is processed, as Article 10 of Türkiye's Personal Data Protection Law No. 6698 ("KVKK") requires. When you sign up you confirm that you have read it; that is not a consent, only a record that you were informed.

Data controller

• Company: Akare Fuarcılık A.Ş.
• Address: Gümüşsuyu Mah. Miralay Şefik Bey Sk. Hayrun Apt. No:13 Daire:6, Beyoğlu / İstanbul, Türkiye
• Email: info@akare.com.tr
• Phone: +90 212 244 00 95

The personal data we process

• Account: your first and last name, email address, password (stored only as an irreversible hash), language and fair country.
• Profile: your phone number, birth year, city, education status and school.
• Study plans: the level, fields and countries you're aiming for, your budget band, start term, English level and score.
• Fairs and events: your registrations, pass codes, fair check-ins, seminar entries and exits, the stands where your pass was scanned, and your certificates.
• a2 Club and ambassadors: your points, reward requests, quiz answers and badges; your ambassador application (university, department, year, city, social media handles, why you applied), task proofs (a link, a text or a photo) and who joined with your invite code.
• Device and app: the app's installation ID, your device model, operating system and app version, notification permission and push token, and your sessions.
• Usage: the pages you open and the features you use (never the text you type, and sent only to Akare's server), error counts and crash reports (crash reports aren't linked to your name, email or student ID).
• Security and records: your IP address, server request logs, and which version of which text you accepted and when.
• Requests and messages: your data protection requests, and the emails and notifications we send you.

Why we process it

• To create and run your account and keep you signed in securely;
• to take your fair, seminar and event registrations, issue your pass, and record your fair entry and seminar attendance;
• to issue certificates for the seminars and events you attend, and let them be verified;
• to suggest schools, programmes and scholarships that fit your plans;
• to let an institution whose stand scanned your pass tell you about its programmes;
• to run the a2 Club and the ambassador programme;
• to send you messages about your account, registrations and fairs, and, if you agree, about campaigns and offers;
• to keep the app secure, prevent misuse, find and fix faults and improve the service;
• to meet our legal obligations and protect our rights in a dispute.

How we collect it and the legal grounds

Your data is collected electronically through the app, the website and scans at the fairs, mostly from what you enter yourself. It is processed on these grounds of KVKK Article 5:

• it is needed to set up or perform a contract (your account, registrations, pass, certificates, the a2 Club, the ambassador programme);
• it is necessary for us to meet a legal obligation;
• it is necessary to establish, exercise or protect a right (for example, records of consent);
• our legitimate interests, provided your fundamental rights and freedoms are not harmed (security, crash reports, improving the service);
• only for campaign and offer messages, your optional explicit consent and your consent under Law No. 6563.

Who receives it

• Exhibiting institutions: when you have your pass scanned at a stand, that institution (a university, school or education agency) sees your name, city, education status, study plans, English level, email address and phone number, may add a note about you, may download these details and its notes as a list (an Excel file), and uses them to tell you about its programmes. Most institutions are outside Türkiye.
• Our service providers: servers and hosting (Akamai Technologies / Linode), email delivery (Google), notification delivery (Google Firebase Cloud Messaging) and crash reports (Google Firebase Crashlytics). They process the data only on our behalf; their servers are outside Türkiye.
• Certificate verification: anyone who has a certificate's code can see the name, title, date and place on it on the verification page.
• Authorities: public bodies and courts with legal authority, when they ask and as far as the law allows.

Transfers abroad

The app's and the website's servers are outside Türkiye. So when you create an account and use the app, your personal data is transferred abroad; the service can't be provided without these transfers. They are made in line with KVKK Article 9, on the standard contracts published by the Personal Data Protection Board. A contract is signed with each recipient and reported to the Personal Data Protection Authority within 5 business days of signing.

• Servers: your account and all the app's data are stored on the servers of our hosting provider, Akamai Technologies (Linode).
• Emails: your name, email address and the email's content are sent through Google's email service.
• Notifications: your device's push token and the notification's text are delivered to your phone through Google Firebase Cloud Messaging.
• Crash reports: when the app crashes, device and app details are sent to Google Firebase Crashlytics; these reports aren't linked to your name, email or student ID.
• Exhibiting institutions abroad: when you have your pass scanned at the stand of an institution based abroad, the details listed above are transferred to it.

How long we keep it

• Your account data is kept while your account is open; if you don't use it for 3 years, it is deleted after a notice.
• Your fair registrations, check-ins and stand scans are deleted or anonymised after 2 years.
• Records of the emails we send are kept for 90 days, usage records for 13 months and server logs for 30 days.
• Your consents and data protection requests are kept as proof: consents for up to 10 years, requests for 3 years after they are closed.
• When you delete your account, your data is deleted or anonymised and your certificates are revoked.

Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed and, if so, to get information about it; to learn why it is processed and whether it is used for that purpose; to know the third parties in Türkiye or abroad it is transferred to; to have it corrected if it is incomplete or wrong; to have it deleted or destroyed under the conditions of KVKK Article 7, and to have these corrections or deletions passed on to those third parties; to object to an outcome against you that results solely from automated analysis; and to claim compensation if you suffer damage from unlawful processing.

How to apply

• In the app, Settings › Privacy and consents lets you request a copy of your data and change your consents. You can delete your account in Settings › Delete account or at mobile.a2fairs.com/en/delete-account.
• For anything else, write to info@akare.com.tr from the email address on your account, or send a letter to the address above.

Requests are answered free of charge within 30 days at the latest.