Privacy policy

1. Identity of Miaventi and the capacities in which it acts

Miaventi ("Miaventi" or the "Company") operates the Miaventi event platform and the website at miaventi.com.

Miaventi acts in two distinct capacities. (1) Data controller: in respect of website visitors, persons who contact Miaventi or request a demonstration or quotation, and users who sign in to manage events on Miaventi. (2) Data processor: in respect of personal data of attendees, speakers, exhibitor representatives and other persons collected by an event organizer through Miaventi. In the latter case the organizer is the data controller and determines the purposes and means of processing; this Policy does not replace the organizer's own privacy notice. Enquiries relating to an event should be addressed in the first instance to the relevant organizer.

2. Personal data processed

Depending on the manner in which Miaventi is used, the following data are processed:

• Contact and request details submitted through forms: name, surname, business email address, telephone number, company, event type, number of events and attendees, modules of interest and message content.
• Account details of organizer users: name, email address, role, language preference, sign-in and security logs.
• Billing details of customers: company name, tax details, invoice address and payment status. Payment card data are processed by payment service providers and do not reach Miaventi's servers.
• Technical data: IP address (stored for form submissions solely as a one-way hash), browser and device type, referring page, and the page and action records necessary to keep the service secure and operational.
• Communication data: correspondence and support conversations.

No special categories of personal data (such as health or religion) are requested through the website.

3. Purposes of processing and legal bases

• Responding to requests, preparing proposals and conducting demonstrations: steps taken at the data subject's request prior to entering into a contract, and Miaventi's legitimate interest in conducting its business.
• Providing, securing and supporting the platform for customers: performance of the contract and legitimate interest in the security of the service (prevention of fraud and abuse, rate limiting, security checks).
• Issuing invoices, keeping accounting records and complying with legal obligations.
• Sending news and event tips: solely on the basis of explicit consent, which may be withdrawn at any time. (Service-related notifications do not require consent.)
• Improving the website and platform using aggregated or minimal usage data: legitimate interest or, where required by law (for example, for non-essential cookies), consent.

Where the legal basis is consent, withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Recipients of personal data

Personal data are disclosed only to the extent necessary and under written terms imposing confidentiality and security obligations:

• Infrastructure and service providers (processors): hosting and database, file storage, email delivery, bot protection, payment services, customer support, video streaming and mapping tools.
• Professional advisers (legal, audit and accounting) and insurers, subject to confidentiality obligations.
• Competent public authorities, where required by law, court order or a valid request.
• A purchaser or successor in the event of a merger or sale, subject to the same level of protection.

Personal data are not sold or shared for the purposes of third-party advertising.

5. International transfers

Certain service providers may process data outside Türkiye and the European Economic Area. In such cases, the safeguards provided by law are applied, including adequacy decisions, standard contractual clauses and other mechanisms accepted under Article 9 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the General Data Protection Regulation ("GDPR"), together with supplementary technical and organizational measures. Information on the safeguards in use may be requested.

6. Retention periods

Data are retained only for as long as required by the purpose of processing and are thereafter deleted, destroyed or anonymized.

• Form submissions (quotation, demonstration and contact requests): retained for 24 months from the date of the request and deleted automatically thereafter.
• Customer account and contract records: retained for the duration of the contract and thereafter for the periods required by accounting, tax and limitation legislation.
• Security and access logs: retained in encrypted form for 24 months.
• Attendee data processed on behalf of an organizer: retained in encrypted form in accordance with the organizer's instructions and the Data Processing Agreement. The retention period is determined by the organizer, who may delete an event at any time, whereupon the event data and files are removed in full. Upon termination of the agreement, data are returned and subsequently deleted.

7. Data security

Technical and organizational measures appropriate to the risk are applied, including encryption in transit, role-based access control, strict separation of organizers' data, session and sign-in protections, rate limiting and bot protection, audit logs and staff confidentiality undertakings.

8. Data subject rights

Pursuant to Article 11 of KVKK and, where applicable, the GDPR, data subjects have the right to learn whether their personal data are processed, to request information and a copy, to request rectification or erasure, to object to processing, to withdraw consent and to request data portability.

Requests may be submitted to [email protected]. The identity of the applicant will be verified, and requests will be answered within 30 days at the latest. Where a request relates to an event, it may be forwarded to the organizer that controls the relevant data.

9. Cookies

Cookies are used to the minimum extent possible. Details and choices are set out in the Cookie Policy.

10. Children

The website and platform are intended for business use and are not directed at children under the age of 16. Where it is considered that a child's data has been submitted to Miaventi, the relevant data will be deleted upon contact with Miaventi.

11. Amendments and contact

Miaventi may update this Policy in response to changes in its services or in applicable law. The current version is published on this page together with its date, and material changes are notified to users by email. Contact: [email protected].