IUIBP

1. Data Controller

Under Turkish Personal Data Protection Law No. 6698 (the "KVKK"), your personal data is processed by the International Union of Islamic Book Publishers (the "Union"), acting as data controller, within the scope described below.

Address: Akşemsettin Mah. Akdeniz Cad. No: 99-101 Fatih / Istanbul / Türkiye

Email: [email protected]

Website: https://islamicpublishers.org

This notice applies to publishers, distributors, booksellers, authors, academics, associations and other candidates applying for membership or preliminary membership through the website, their representatives, and reference persons whose details are included in an application.

2. Personal Data We Process

Depending on the type of application and the information you provide, we may process the following categories of personal data:

Identity data: first name, surname, signature or application declaration serving as a signature, and other information used to identify you.

Contact data: email address, telephone and business telephone numbers, postal address, country, city and preferred contact details.

Institutional and professional data: the name and legal or trade name of the represented institution or publishing house, year of establishment, countries of operation, title and position, education, publishing activities, types and number of publications, publication languages, distribution network, bookselling information, academic work, authored works, awards, fair participation, areas of cooperation and membership motivation.

Images and documents: passport-style or identity photograph, representative photograph, institution or publishing house logo, digital catalogue and supporting documents uploaded with the application. Photographs are used for visual identification within membership processes and are not processed as biometric data unless technical biometric identification or verification methods are used.

Website and social media data: website address and social media profiles voluntarily provided in the application.

Reference data: the name, institution and contact information of persons named as references. Before providing another person's details to the Union, the applicant is responsible for informing that person about the disclosure.

Application and transaction security data: application date, type and status, acknowledgement records, user and membership account information, system records, IP address, access and security logs, and correspondence with the Union.

The application does not request special categories of personal data. Please do not include health, religious or sectarian belief, political opinion, criminal conviction or other sensitive data that is not required to assess your application in free-text fields or supporting documents.

3. Purposes of Processing

Your personal data may be processed to receive your application; verify the applicant and authority to represent an institution; assess eligibility under the membership criteria; request additional information or documents; notify you of the outcome; create and administer membership records and user accounts; manage the membership relationship, fees and administrative processes; provide member directory and profile services; support member communications and cooperation; and plan and conduct the Union's activities, meetings, fairs, training programmes and international events.

We may also process the data to arrange invitations, travel, accommodation, accreditation and event operations; manage institutional communications and application correspondence; respond to requests and complaints; maintain information security and service continuity; prevent misuse; establish, exercise or defend legal claims; respond to competent public authorities; and comply with the Union's legal obligations.

Introductory text, logos, representative photographs, websites and similar information that you separately provide for publication on a member profile may become visible in the member directory after membership is approved. Public profile data is limited according to the nature of the membership service and your selections in the relevant fields. Passport photographs, identity documents, private contact details and supporting documents are not published publicly.

4. Collection Methods and Legal Grounds

Personal data is collected through membership and preliminary membership forms on the website, uploaded files, email and other electronic communication channels, online or in-person meetings, event and membership processes, and technical records generated by information systems. Collection may be automated, partially automated, or non-automated where the data forms part of a filing system.

Data necessary to assess the application and establish or perform the membership relationship is processed under Article 5(2)(c) of the KVKK because processing is directly related to the establishment or performance of a contract. Processing required by law or by a competent authority is based on the Union's legal obligations under Article 5(2)(ç). Records needed to establish, exercise or protect legal rights are processed under Article 5(2)(e).

Limited processing needed for information security, service improvement, orderly institutional records, supervision of application processes and effective management of member relations is based on the Union's legitimate interests under Article 5(2)(f), provided that the processing does not harm your fundamental rights and freedoms. Where none of these legal grounds applies, processing takes place only after obtaining your separate, specific, informed and freely given explicit consent.

Selecting "I have read and understood the notice" records that this notice was made available to you. It is not an explicit consent statement. Separate consent is requested where processing requires explicit consent.

5. Transfers Within Türkiye

Your data may be shared, only to the extent necessary for the relevant purpose, with the Union's authorised bodies, personnel and officers; membership assessment committees; legal and financial advisers; suppliers providing IT infrastructure, hosting, security, archiving, email or communication services; and partners providing event and organisational services.

Data may also be disclosed to courts, enforcement offices, law enforcement authorities and other competent public bodies where necessary to comply with a legal obligation or establish, exercise or defend a right, limited to duly issued requests and the authority's statutory remit.

6. International Transfers

Because the Union operates internationally, identity, contact, institution, role, travel and participation details required for an overseas fair, meeting, training programme, trip or other event in which you participate or request to participate may be transferred to event organisers, partners, accreditation units, transport operators and accommodation providers. Profile information that you choose to publish in the member directory may also be regarded as transferred abroad because the website can be accessed from outside Türkiye.

Where website, email, cloud, security or technical support services are provided using servers or support teams located abroad, data required to provide those services may be transferred to the relevant provider. The Union assesses providers for data security, confidentiality and legal compliance and limits each transfer to the data necessary for the service.

Regular international transfers are made in accordance with Article 9 of the KVKK where an adequacy decision covers the destination country, sector or international organisation. In the absence of an adequacy decision, transfers are made only where an applicable processing condition exists and an appropriate safeguard, such as a standard contract, binding corporate rules or another safeguard recognised by law, has been put in place. Where no appropriate safeguard is available, an occasional transfer may take place only if one of the exceptional transfer conditions in Article 9 applies and only to the extent permitted by that condition. If a transfer must rely on explicit consent, you will be informed of the possible risks and your separate explicit consent will be requested before the transfer.

7. Retention and Deletion

Personal data is retained for as long as necessary for the purpose for which it was collected, taking account of statutory limitation, record-keeping and retention periods. If an application is rejected or withdrawn, the data is deleted, destroyed or anonymised after the reasonable period needed to manage possible objections, requests and legal disputes. If membership is approved, the data is retained throughout the membership relationship and afterwards for the period required to meet the Union's legal obligations and protect its rights.

Retention periods are determined by considering whether the processing purpose continues, the nature of the data, legal obligations, limitation periods and security requirements. When all processing conditions cease to apply, personal data is deleted, destroyed or anonymised under periodic disposal processes, either automatically or following a valid request from the data subject. Data held in backups is isolated from operational access and deleted in the next applicable disposal cycle in line with backup cycles and technical capabilities.

8. Data Security

The Union takes technical and organisational measures appropriate to the nature of the data to prevent unlawful processing and access and to ensure secure storage. These measures include restricting access permissions, maintaining user and transaction logs, secure file transfer, keeping systems and software current, backups, confidentiality obligations, service-provider controls and relevant administrative procedures.

9. Your Rights

Under Article 11 of the KVKK, you may apply to the Union to learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used for that purpose; learn the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notification of correction, deletion or destruction to third parties to whom the data was transferred; object to a result arising against you through analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

10. Exercising Your Rights and Contacting Us

You may submit a request concerning your rights, including sufficient information to verify your identity and request, by email to [email protected] with the subject "KVKK Data Subject Request" or in writing to Akşemsettin Mah. Akdeniz Cad. No: 99-101 Fatih / Istanbul / Türkiye. Your request should state your full name, the subject and details of your request, and the contact information through which you wish to receive our response.

Requests are answered free of charge as soon as possible and no later than thirty days, depending on their nature. Where processing a request creates an additional cost, the fee specified in the tariff set by the Turkish Personal Data Protection Board may be charged. The Union may request additional information to verify the applicant's identity before responding.

11. Effective Date and Updates

This notice took effect on July 14, 2026. It may be updated when our processing activities or applicable law changes. The current version is published at https://islamicpublishers.org/kvkk, and material changes may also be communicated through appropriate contact channels.