Privacy Notice (KVKK & GDPR)

1. Who is responsible for your data?

"We" in this notice means SilentFest Global. We are the data controller under the Turkish Personal Data Protection Law no. 6698 (KVKK) and under the EU General Data Protection Regulation (GDPR).

One address for any data request: silentfestglobal@gmail.com. For questions about your booking you can also write to silentfestglobal@gmail.com.

If you would rather ask in sign language, send us a video over WhatsApp. We do not require requests in writing.

2. What we collect

We collect only what the booking form asks for. Every field you see while filling it in appears in the list below; nothing is gathered in the background.

• The person making the booking: first and last name, the name to print on the festival badge, date of birth, gender, Turkish national ID or passport number, country, city, email, phone/WhatsApp, any health or accessibility need, an emergency contact and your photo for the festival badge.
• Other participants: the name, badge name, date of birth, gender, Turkish national ID or passport number, country and photo of each adult coming with you; the child's name, badge name, date of birth and photo. We need the child's date of birth to work out the price, and it may be checked against an ID card or passport.
• Booking details: the room your group's size gives you, your roommate preference, whether you asked to be told when extra activity prices are announced (which activities, and by WhatsApp or email), payment option (in full or by instalments), the price shown to you, how long that price is held, and the date your payment was received.
• If you fill in the extra activities form on the programme page: your name, your email address and/or phone number, the activities you chose, how you want to be told, the date of the request and your answer on whether to buy once prices are announced.
• After your booking is confirmed: your arrival details. We ask for these separately.
• Older applications: applications sent before this form asked for an ID/passport number, a hearing and language profile, an emergency contact and travel notes. These are kept until they are deleted on the schedule below.
• Consent records: which documents you accepted and when, plus the IP address and browser you used when accepting them.

3. Special category data

The booking form does not ask for your hearing status. If you write down a health or accessibility need, it is only so that we can support you properly at the festival; because it may count as health data, it is used for that purpose alone and shared only with the team members who need it.

Applications sent before this form asked for hearing status with your explicit consent (KVKK art. 6, GDPR art. 9). That information is used only to make the festival accessible and is deleted on the schedule below.

4. Why we process it, and on what legal basis

Each category of data has a purpose and a legal basis:

• Creating your booking, working out the price, matching your payment and keeping you informed — KVKK art. 5/2-c (making and performing a contract), GDPR art. 6(1)(b).
• Arranging accommodation, travel and programme once your booking is confirmed — KVKK art. 5/2-c, GDPR art. 6(1)(b).
• Using the hearing status given in older applications to make the festival accessible — your explicit consent, KVKK art. 6/2, GDPR art. 9(2)(a).
• Using the ID or passport number asked for on the form for the hotel and official registration — KVKK art. 5/2-c and 5/2-ç, GDPR art. 6(1)(b) and 6(1)(c).
• Using your photo and badge name to prepare your festival badge, and your emergency contact to reach someone in an emergency — KVKK art. 5/2-c, GDPR art. 6(1)(b).
• Telling you, if you asked, through the channel you chose when extra activity prices are announced, and taking your answer on whether to buy — your request, KVKK art. 5/2-c, GDPR art. 6(1)(b).
• Appearing in festival photographs and video — only with the separate consent you tick; if you do not, we keep you out of frame.
• Festival safety and emergency management — KVKK art. 5/2-f (legitimate interest), GDPR art. 6(1)(f).

5. Who we share it with

We do not sell your data and we share it with nobody for marketing. It goes only to the parties the festival cannot run without, and only as much of it as they need:

• The festival team: the people who handle bookings and payments, and the festival manager.
• The hotel: name, surname and the minimum needed for your stay.
• The insurer: name, surname, date of birth, ID or passport number.
• Our hosting and email providers: they store the data on our behalf and may not use it for their own purposes.
• WhatsApp (Meta): when you message us on WhatsApp to pay, that conversation runs through WhatsApp and is also subject to WhatsApp's own privacy terms.

6. Transfers outside your country

Bookings come from many countries; our servers and email provider are inside the European Economic Area.

If data has to leave the EEA, that transfer happens only with your explicit consent or where it is necessary to perform the agreement (KVKK art. 9, GDPR art. 49).

7. How long we keep it

Our retention periods are short and specific:

• Drafts that were never sent: deleted automatically 6 months after the last edit.
• Booking requests that are not confirmed or are cancelled: deleted 12 months after the 2027 festival ends. Ask us and we will delete them right away.
• ID and passport numbers: deleted 12 months after the festival ends.
• Names, dates of birth and countries of the adults and children coming with you: deleted within 30 days of the festival ending.
• Name, surname and year of attendance for participants in confirmed bookings: kept indefinitely for the archive and the alumni network. You can ask us to delete this too.
• Payment records we are required to keep by accounting and tax law: for the period that law prescribes.

8. How we protect it

• ID and passport numbers are stored encrypted in the database and are never held anywhere in the clear.
• Only authorised festival team members can reach the admin panel, and every sign-in and status change is logged.
• All site and form traffic is encrypted end to end (HTTPS).
• In the event of a breach we notify the authority within 72 hours under KVKK art. 12 and GDPR art. 33, and you without undue delay.

9. Your rights

Under KVKK art. 11 and GDPR arts. 15–22 you have the right to:

• Find out whether we process your data and get a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data erased ("the right to be forgotten").
• Receive your data in a structured, machine-readable format and take it elsewhere.
• Withdraw any consent you gave, at any time — withdrawal does not affect the lawfulness of what we did before it.
• Object to processing, and not be subject to automated decision-making. Bookings are not confirmed automatically; a person from the team always checks the payment and the confirmation.
• Claim compensation if you have suffered damage.

10. How to exercise them

Write to silentfestglobal@gmail.com. If you would rather send a sign language video over WhatsApp, that is equally fine — we do not insist on writing.

We answer within 30 days, free of charge. We may ask for something to confirm it is really you; that is to protect you, not to slow you down.

If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr). If you live in the EU you can also go to the data protection authority in your own country.

11. Cookies

The first time you open the site we ask about cookies. Refusing is exactly as easy as accepting: both options are the same size, on the same screen, one click each. If you refuse, nothing but the strictly necessary cookies is set.

There are three categories:

• Strictly necessary — keeping your session alive, keeping your answers when the booking form cannot be sent, and form security (CSRF). These cannot be switched off; they are technically required and they do not follow you across other sites. Your cookie choice itself and the language you used last are stored here. When you open the site's bare address, we guess only your country from your IP address to choose the language of the page; this happens on our own server, and your IP address is neither stored for it nor shared with anyone.
• Analytics — understanding how many people see which page. OFF by default; no analytics script loads until you turn it on. If you do, Google Analytics (Google Ireland Ltd.) is used; your IP address is shortened and the data is not used for advertising. Google may process the data outside your country.
• Marketing — advertising and retargeting. OFF by default. We use nothing in this category today; the category exists so that if we ever do, we have to ask you first.

You can change your mind at any time through the "Cookie preferences" link in the footer. We remember the choice for 6 months, then ask again.

We do not sell your personal information or share it for advertising. If you live in the United States, choosing "reject non-essential" is treated as a "do not sell or share my personal information" request under the CCPA/CPRA.

12. If this notice changes

When we update it, the version number and date at the top of this page change with it. If you have an open booking and the change affects you materially, we will email you as well.

The version in force on this page: 1.16 (26 October 2026).