GDPR Compliance
Meet2Be's commitment to GDPR and KVKK compliance. This page explains our technical and organisational measures, your rights, and how we handle personal data as both controller and processor.
Last updated
January 1, 2026
1 Overview
The General Data Protection Regulation (GDPR) (EU) 2016/679 is the primary legal framework governing the protection of personal data for individuals within the European Union and European Economic Area. In Turkey, Law No. 6698 on the Protection of Personal Data (KVKK) establishes an equivalent framework. Pinet Bilişim A.Ş. ("we", "our", "the Company"), the operator of Meet2Be, is fully committed to compliance with both GDPR and KVKK in all aspects of our data processing activities.
This page provides a detailed account of our GDPR and KVKK compliance framework, including our roles as data controller and data processor, the legal bases we rely on, the rights available to data subjects, our technical and organisational security measures, our sub-processor framework, and our data breach response procedures.
This page is complementary to our Privacy Policy. While the Privacy Policy explains what data we collect and why, this page explains how we comply with the law. In the event of any conflict, this page governs for GDPR-specific matters.
2 GDPR & KVKK Alignment
Turkey's KVKK, enacted in 2016, was modelled on the EU's Data Protection Directive 95/46/EC and substantially aligns with the principles of GDPR. Both frameworks share the same foundational principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Where differences exist, we apply the stricter of the two standards. This means EU/EEA users benefit from full GDPR protection, while all users — including Turkish users — benefit from rights equivalent to or exceeding those in KVKK. Our compliance programme is designed to satisfy both frameworks simultaneously, without requiring separate data handling processes for different user populations.
As Turkey's KVKK Kurumu pursues an adequacy decision from the European Commission, we continue to monitor developments and will update our compliance procedures accordingly. Our Standard Contractual Clauses (SCCs) for cross-border data flows are already in place to address any gap in the interim.
3 Our Role: Controller & Processor
Meet2Be operates in a dual capacity under GDPR and KVKK, depending on the nature of the data processing activity:
Data Controller
We act as the data controller when processing personal data of our registered users (event organisers, administrators, and platform subscribers). In this capacity, we determine the purposes and means of processing — for example, when managing user accounts, processing subscription payments, sending service communications, and operating our website.
Data Processor
We act as a data processor when we process personal data on behalf of event organisers in the context of their events — for example, processing attendee Q&A responses, survey submissions, keypad votes, or paper track submissions. In this capacity, the organiser is the data controller; we process the data solely according to their instructions under a Data Processing Agreement (DPA).
Event organisers using Meet2Be to process participant data are required to enter into a Data Processing Agreement (DPA) with us. Our DPA is compliant with GDPR Article 28 and KVKK Article 12, and sets out the subject-matter, duration, nature, purpose, and categories of personal data involved. To request a DPA, contact legal@meet2be.com.
4 Lawful Basis for Processing
Under GDPR Article 6 and KVKK Article 5, every processing activity must have a lawful basis. We document the applicable basis for each processing activity in our Records of Processing Activities (RoPA). The six available bases and their application to our operations are:
Consent (Art. 6/1-a)
Where we rely on consent, it is obtained freely, specifically, informedly, and unambiguously — for example, for marketing communications and non-essential cookies. Consent records are maintained with a timestamp, method of collection, and the text of the consent request. You may withdraw consent at any time via your account settings or by contacting privacy@meet2be.com.
Contract Performance (Art. 6/1-b)
Processing necessary to perform the subscription agreement — including account creation, service delivery, billing, and support — is based on contract performance. This basis does not require separate consent.
Legal Obligation (Art. 6/1-c)
We process data to comply with applicable laws, including Turkish tax law (invoicing and accounting records), anti-money laundering requirements, and mandatory responses to court orders or regulatory requests.
Vital Interests (Art. 6/1-d)
This basis may apply in exceptional circumstances where processing is necessary to protect life — for example, disclosing information to emergency services. We do not rely on this basis for routine processing.
Public Task (Art. 6/1-e)
We do not currently rely on this basis, as we are a private company and do not exercise official authority or perform tasks in the public interest.
Legitimate Interests (Art. 6/1-f)
We rely on legitimate interests for fraud detection and prevention, network and information security, internal analytics and product improvement, and B2B marketing to existing customers. We conduct and document a Legitimate Interests Assessment (LIA) for each processing activity relying on this basis, ensuring that our interests do not override data subjects' rights.
5 Data Subject Rights
Under GDPR Articles 15–22 and KVKK Article 11, you have comprehensive rights over your personal data. These rights are absolute in some cases and qualified in others (subject to legal exceptions). Submit all rights requests to privacy@meet2be.com with proof of identity. We respond within 30 days; complex requests may be extended by up to two further months with notice.
Right of Access (Art. 15)
The right to obtain a copy of all personal data we hold about you, information about how it is used, the categories involved, recipients, retention periods, and the safeguards for any international transfers. We provide responses in a commonly used electronic format (PDF or JSON on request).
Right to Rectification (Art. 16)
The right to have inaccurate data corrected and incomplete data completed without undue delay. Many data points can be corrected directly via your account settings.
Right to Erasure / "Right to be Forgotten" (Art. 17)
The right to request deletion of your data where it is no longer necessary for its original purpose, where you withdraw consent, where you object and there are no overriding legitimate grounds, or where data has been unlawfully processed. Note that we may retain data where required by law (e.g. financial records under Turkish tax law).
Right to Restriction of Processing (Art. 18)
The right to request that we restrict (but not delete) processing — for example, while the accuracy of data is disputed, while an objection is being considered, or where you need the data for legal claims even though we no longer need it.
Right to Data Portability (Art. 20)
Where processing is based on consent or contract and carried out by automated means, the right to receive your data in a structured, commonly used, machine-readable format (e.g. JSON or CSV) and, where technically feasible, to have it transmitted directly to another controller.
Right to Object (Art. 21)
The right to object at any time to processing based on legitimate interests or for direct marketing. For direct marketing objections, we cease processing immediately with no further justification required. For legitimate interest objections, we cease unless we demonstrate compelling legitimate grounds overriding your interests.
Rights in Automated Decision-Making (Art. 22)
The right not to be subject to decisions based solely on automated processing that produce significant effects on you. Meet2Be does not currently make solely automated decisions with significant effects on users. Where profiling is used (e.g. platform analytics), it does not produce legal or similarly significant effects.
Right to Withdraw Consent (Art. 7/3)
Where processing is based on consent, the right to withdraw at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We implement withdrawal mechanisms that are as easy as the original consent mechanism.
We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive. We may suspend the response period once to verify your identity. If we refuse a request, we will explain our reasons and your right to complain to a supervisory authority.
6 International Data Transfers
We operate globally, which means your data may be stored or processed in countries outside Turkey and the EEA — including countries without an EU adequacy decision. We ensure that all international transfers comply with GDPR Chapter V and KVKK Article 9 through the following mechanisms:
Standard Contractual Clauses (SCCs)
For transfers from the EU/EEA to third countries, we use the European Commission's approved Standard Contractual Clauses (Module 1: Controller-to-Controller; Module 2: Controller-to-Processor) as updated by Commission Implementing Decision (EU) 2021/914. We supplement SCCs with a Transfer Impact Assessment (TIA) where required.
Adequacy Decisions
Where available, we transfer data to countries with a European Commission adequacy decision without requiring additional safeguards. We monitor adequacy decisions and adjust our transfer mechanisms if an adequacy decision is withdrawn.
KVKK Compliance
For transfers from Turkey, we comply with KVKK Article 9, requiring either explicit consent, a KVKK Board adequacy determination, or a written undertaking by the recipient. Where a KVKK Board adequacy decision is unavailable, we obtain written undertakings from recipients committing to equivalent protection.
We maintain an up-to-date list of all third countries to which we transfer personal data, together with the applicable transfer mechanism. This list is available upon request at privacy@meet2be.com.
7 Sub-Processors
When acting as a data processor for event organisers, we engage sub-processors who may access personal data submitted through the platform. We maintain a complete and up-to-date list of our sub-processors, available at privacy@meet2be.com.
All sub-processors are engaged under a written sub-processing agreement imposing data protection obligations equivalent to those in our DPA (GDPR Article 28/4). We conduct due diligence on all sub-processors prior to engagement and at regular intervals thereafter.
We notify data controller customers (event organisers) of any intended changes to sub-processors with at least 30 days' advance notice, providing an opportunity to object. If a customer objects and the disagreement cannot be resolved, the customer may terminate the relevant services without penalty.
Categories of Sub-Processors
- Cloud infrastructure and hosting providers (servers, databases, storage)
- Email delivery and transactional messaging services
- Payment processing and fraud detection services
- Customer support and helpdesk platforms
- Error monitoring, performance, and security services
- Analytics and product improvement tools (only where anonymised/aggregated)
8 Privacy by Design & Default
Pursuant to GDPR Article 25 and the principle of data protection by design and by default, we integrate data protection considerations into all system development, feature design, and business process activities from inception, rather than as an afterthought.
Our privacy by design commitments include: collecting only the minimum personal data necessary for each specific purpose (data minimisation); pseudonymising and encrypting personal data by default where technically feasible; ensuring that, by default, only personal data strictly necessary for each purpose is processed (privacy by default settings); conducting privacy impact reviews before launching new features involving personal data; and maintaining documented records of all data processing activities (ROPA) as required by GDPR Article 30.
Our engineering practices include code review requirements for features touching personal data, privacy-aware security testing protocols, and mandatory data protection training for all engineering staff.
9 Data Protection Impact Assessments
Under GDPR Article 35, a Data Protection Impact Assessment (DPIA) is required before undertaking processing that is likely to result in a high risk to the rights and freedoms of natural persons. We conduct DPIAs for all new processing activities involving: large-scale processing of special category data; systematic profiling with significant effects; use of new technologies with uncertain privacy implications; or processing that could result in high risk by any other means.
Each DPIA includes: a description of the processing and its purposes; an assessment of necessity and proportionality; identification of the risks to data subjects; and the measures envisaged to address those risks. Where a DPIA indicates a high residual risk that cannot be mitigated through technical or organisational measures, we consult the relevant supervisory authority prior to commencing processing (GDPR Article 36).
DPIA documentation is retained for the life of the processing activity and for a minimum of five (5) years thereafter. DPIAs are reviewed whenever there is a change in the nature, scope, context, or purposes of the processing.
10 Data Breach Response
We have implemented a documented Personal Data Breach Response Procedure compliant with GDPR Articles 33 and 34 and KVKK requirements. Our procedure ensures that breaches are detected, contained, assessed, and reported in a timely and systematic manner.
In the event of a personal data breach: (1) We will detect and contain the breach as quickly as possible. (2) We will carry out an internal risk assessment to determine the likelihood and severity of harm to data subjects. (3) Where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority (KVKK Kurumu and/or the competent EU/EEA DPA) within 72 hours of becoming aware. (4) Where the breach is likely to result in a high risk to data subjects, we will also notify affected individuals without undue delay, providing all information required by GDPR Article 34.
Breach notifications will include: the nature of the breach; the categories and approximate number of data subjects affected; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. All breaches — regardless of whether notification to a supervisory authority is required — are recorded in our internal breach register.
11 Data Retention & Minimisation
In accordance with the storage limitation principle (GDPR Article 5/1-e; KVKK Article 4/2-ç), we retain personal data only for as long as necessary for the original purpose and any applicable legal obligation. Our data retention schedule is documented and reviewed annually.
Key retention periods: Account data — retained for the duration of the subscription and for 3 years post-termination to handle any dispute or claim. Financial and billing records — retained for 10 years as required by Turkish Tax Procedure Law (VUK). Event and participant data — retained for the duration of the organiser's subscription and deleted within 90 days of subscription termination; we do not retain participant data after account closure for any longer than necessary. Server logs — retained for 90 days for security purposes. Marketing consent records — retained for the duration of the consent and for 3 years thereafter as evidence of consent.
When retention periods expire, personal data is securely deleted using industry-standard deletion methods (overwriting or cryptographic erasure for encrypted data) or irreversibly anonymised. We do not archive personal data in a form that permits identification beyond the applicable retention period.
12 Technical & Organisational Measures
We implement appropriate technical and organisational measures (TOMs) under GDPR Article 32 and KVKK Article 12, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. Our current TOMs include:
- Encryption of all personal data in transit using TLS 1.2 or higher with HSTS and certificate pinning.
- Encryption of sensitive personal data at rest using AES-256.
- Pseudonymisation of personal data where full identification is not required for the processing purpose.
- Role-based access controls (RBAC) ensuring that employees access only the personal data necessary for their specific duties.
- Multi-factor authentication (MFA) required for all administrative and privileged access to systems containing personal data.
- Regular vulnerability assessments, penetration testing, and security code reviews.
- Comprehensive audit logging of all access to and modifications of personal data.
- Mandatory annual data protection training for all staff with access to personal data.
- A formal vendor due diligence process for all suppliers processing personal data.
- An incident response plan tested at least annually through tabletop exercises.
14 Contact & Data Processing Requests
For all GDPR and KVKK related enquiries — including data subject rights requests, DPA requests, DPIA consultations, sub-processor queries, and general data protection matters — please contact us:
Legal Entity
Pinet Bilişim A.Ş.
Brand
Meet2Be
Website
meet2be.comPrivacy Email
privacy@meet2be.comLegal Email
legal@meet2be.comPhone
+90 (312) 911 9113Address
Bahçelievler Mah. 323/1 Cadde 10/50C No: 65, Gölbaşı / Ankara, Turkey — 06830
Regulatory & Registration Information
web/gdpr_compliance.s14_response
Note: Pinet Bilişim A.Ş. does not currently meet the thresholds requiring a mandatory Data Protection Officer (DPO) under GDPR Article 37 or KVKK. However, our Privacy Team performs equivalent oversight functions and is available to respond to all data protection enquiries.