Personal Data Protection Notice

Last updated: 5 October 2026

This is an English translation of the Turkish notice. In case of any discrepancy, the Turkish version prevails.

Under the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data are processed by the Istanbul Apparel Exporters’ Association (“İHKİB”) as data controller, within the scope of the activities of the Manufacturing Innovation Digital Advancement Services Hub (EDIH MIDAS), supported by the European Union under the Digital Europe Programme, for the purposes set out below and on the basis of the processing conditions laid down in Article 5 and, where necessary, Article 6 of the KVKK.

MIDAS is a European Digital Innovation Hub (EDIH) project that aims to strengthen the digital transformation capacity of manufacturing enterprises, SMEs in particular, through services such as digital maturity assessments, training and skills development, consultancy, Test Before Invest, access to finance and connection to the innovation ecosystem.

1. Personal Data Processed

Depending on the service provided, the application made or the interaction carried out, the following categories of personal data may be processed within the scope of the MIDAS website and project activities:

• Identity data: Name, surname and, where necessary, similar identity information,
• Contact data: Email address, telephone number and communication preferences,
• Professional and organisational data: Organisation or enterprise, position or title, sector, and contact and application details of the enterprise,
• Application and service data: Requests to benefit from MIDAS services, event and training registrations, information related to digital maturity assessments, referral and service records,
• Feedback data: Surveys, satisfaction assessments, opinions, suggestions and requests,
• Visual and audio data: Photographs and video recordings taken at events and recordings of online events,
• Transaction security and internet usage data: IP address, access and log records, device and browser information and data related to the cookies used, for the security and technical operation of the website.

As a rule, we do not ask for special categories of personal data through the website. Where the nature of a service requires the processing of special categories of personal data, such data will be assessed separately in line with the conditions set out in Article 6 of the KVKK.

2. Purposes and Legal Grounds of Processing

Your personal data may be processed for the following purposes and on the basis of the processing conditions set out in Article 5 and, where necessary, Article 6 of the KVKK.

A) Where processing is expressly provided for by law or is necessary for İHKİB to fulfil its legal obligations:

• Carrying out the MIDAS Project in line with the Grant Agreement, the Consortium Agreement, the rules of the Digital Europe Programme and applicable legislation,
• Preparing project information and reports requested by the European Commission, the European Health and Digital Executive Agency (HaDEA) and competent national or international bodies,
• Creating and keeping records of the activities, participation, services and performance indicators of the project,
• Carrying out the financial, administrative and technical audit processes of the project,
• Responding to data subject requests in accordance with the legislation,
• Fulfilling legal and contractual retention, archiving, audit and evidence obligations.

B) Where processing is necessary for the conclusion or performance of a contract, or for the legitimate interests of İHKİB provided that it does not harm the fundamental rights and freedoms of the data subject:

• Receiving, assessing and responding to contact, information, service and application requests sent through the website,
• Assessing the needs of enterprises and referring them to suitable services so that they can benefit from MIDAS services,
• Planning and coordinating digital maturity assessments, consultancy, training, Test Before Invest, access to finance, mentoring, B2B matchmaking and similar project services,
• Referring applications and beneficiary processes to the relevant MIDAS consortium partner or project unit,
• Planning and holding trainings, webinars, workshops, meetings, conferences, B2B meetings and other events within the project,
• Assessing the effectiveness of project activities, the quality of services and the experience of beneficiaries,
• Monitoring project outputs, performance indicators and impact results,
• Developing project activities and improving services according to the needs of beneficiaries,
• Ensuring the security, technical operation and accessibility of the website,
• Preventing unauthorised access and misuse and carrying out information security processes.

C) Where you have given your explicit consent or the relevant communication permission:

• Sending you events, trainings, webinars, workshops, project activities, news and announcements within MIDAS,
• Sending e-newsletters and similar information messages,
• Carrying out surveys, satisfaction assessments and voluntary feedback studies after events,
• Using photographs and videos taken at events on the websites and social media accounts of MIDAS and İHKİB, in project reports and publications and in project visibility activities,
• Carrying out other processing activities that require explicit consent.

For processing based on explicit consent, data subjects may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Method of Collecting Personal Data

Within the MIDAS Project, your personal data may be collected electronically or physically, by automated, partly automated or, where part of a data recording system, non-automated means, through:

• Contact, service request, application and event registration forms on the MIDAS website,
• E-newsletter or announcement subscription fields,
• Digital application and assessment tools used within the project,
• Messages and requests sent to MIDAS or İHKİB project email addresses,
• Registration and evaluation forms filled in at online or in-person trainings, webinars, meetings, workshops and events,
• Records created during digital maturity assessments and the use of other MIDAS services,
• Surveys, satisfaction assessments, feedback and application processes,
• Correspondence carried out within the project,
• Technical records created during the use of the website and the cookies used.

Personal data are processed only for specified, explicit and legitimate purposes, and in a manner that is relevant, limited and proportionate to the purposes for which they are processed.

4. Recipients of Personal Data and Purposes of Transfer

Your personal data may be shared with the parties below in line with the conditions set out in Article 8 of the KVKK and, in the case of transfers abroad, Article 9, and only to the extent required by the transfer.

A) Organisations and Units within the MIDAS Consortium

Your personal data may be shared with organisations and units within the MIDAS consortium, to the extent that they are responsible for the relevant activity or service, in order to provide MIDAS services, assess applications, refer beneficiaries to suitable services, carry out project activities and report project outputs.

Within this scope, personal data may be shared, limited to their duties, powers and project services, mainly with:

• Istanbul Apparel Exporters’ Association (İHKİB), Coordinator,
• İHKİB Digital Transformation Center (DDM),
• ARI Teknokent Proje Geliştirme Planlama A.Ş. (İTÜ ARI Teknokent),
• Sabancı University,
• Inovent A.Ş.,
• Istanbul Development Agency (İSTKA),
• Özyeğin University,
• Özyeğin University and BEYSAD Industry 4.0 Competence Center (OZUBEX),
• Fatih Sultan Mehmet Vakıf University / ALUTEAM,
• Marmara University,
• Turkish Exporters Assembly (TİM).

These transfers are limited to activities such as coordinating application and service processes, digital maturity assessments, training and consultancy services, Test Before Invest activities, access to finance and innovation services, holding events, following up beneficiaries, assessing feedback and project reporting.

B) European Union Institutions, Programme Authorities and Competent Public Bodies

The MIDAS Project is supported by the European Union under the Digital Europe Programme.

Within this scope, where required under the Grant Agreement and the relevant programme rules, personal data or project records that may contain personal data may be shared with:

• The European Commission,
• The European Health and Digital Executive Agency (HaDEA),
• Units assigned or authorised under the Digital Europe Programme and the EDIH network,
• European Union institutions and bodies with audit, monitoring or control powers over the project,
• Relevant national public bodies, audit authorities and programme authorities,

solely for the purposes of fulfilling project obligations, performance and activity reporting, financial or technical audits and meeting legal obligations.

As far as possible, reporting is based on aggregated or anonymised data that do not contain personal data.

C) Service Providers

Where necessary and only to the extent required by the service, personal data may be shared with authorised service providers for the operation of the website, the provision of IT infrastructure, data hosting, security, email, online meetings, event management or similar technical services.

Where these service providers have access to personal data, the necessary contractual, technical and administrative measures are applied.

5. Transfer of Personal Data Abroad

As MIDAS is a European Union project, and as the European Commission, HaDEA, the EDIH network, the project consortium and some of the IT and reporting systems used in the project may be located abroad, personal data may need to be transferred abroad in certain cases.

Under Article 9 of the KVKK and the related secondary legislation, any transfer of personal data abroad will be based on whichever of the following conditions applies:

• an adequacy decision exists for the country, sector or international organisation to which the data are transferred,
• where there is no adequacy decision, one of the appropriate safeguards provided for in the KVKK is in place, or
• one of the exceptional transfer cases provided for in the law applies.

Where appropriate safeguards are required, standard contracts or another suitable transfer mechanism provided for in the legislation will be used.

Transfers will be limited to the data necessary for the purpose of the transfer, and the necessary technical and administrative measures for the protection of personal data will be applied.

Where the EU General Data Protection Regulation (“GDPR”) applies to a specific processing activity, that processing will also be carried out with due regard to the provisions of the GDPR.

6. Retention and Deletion of Personal Data

Your personal data are kept for as long as necessary for the purpose for which they are processed, and within the retention and archiving obligations arising from the project agreements, European Union project rules, the relevant legislation and the obligations to which İHKİB is subject.

Once the purposes of processing and the related legal grounds no longer exist, personal data are deleted, destroyed or anonymised, either ex officio or at the request of the data subject, in accordance with Article 7 of the KVKK and the related secondary legislation.

7. Rights of the Data Subject

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data are processed,
• Request information if your personal data have been processed,
• Learn the purpose of processing and whether your data are used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom your personal data are transferred,
• Request the correction of your personal data if they are incomplete or inaccurate,
• Request the deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• Request that the correction, deletion or destruction be notified to third parties to whom your personal data have been transferred,
• Object to a result against you arising from the analysis of your data exclusively through automated systems,
• Claim compensation for damage suffered as a result of the unlawful processing of your personal data.

Where the GDPR applies to the relevant processing activity, the data subject rights granted under the GDPR are also reserved.

8. Requests and Contact

You may send your requests regarding your rights under Article 11 of the KVKK to İHKİB, clearly stating your identity and your request.

Data Controller: Istanbul Apparel Exporters’ Association (İHKİB)

Address: Yenibosna Merkez Mahallesi, Sanayi Cad. No:3 B Blok, Bahçelievler, İstanbul, Türkiye

Telephone: +90 (212) 454 02 00
Fax: +90 (212) 454 02 01
Email: kvkk@itkib.org.tr

Requests will be assessed in line with Article 13 of the KVKK and the related legislation and concluded within the legal time limit.