KVKK Disclosure Notice

Your personal data is processed by Halil İbrahim Örkcü (Kelyvaro) as data controller, within the scope described below. Seller identity and contact details are at the top of this page; contact: info@kelyvaro.com

Processing of your profile data begins when you open an account, and listings that fit you are found from it. Per-listing CV generation and application sending run only when you use those features; no application is ever sent without your approval.

When you open an account: - Identity and contact data: your email address - Transaction security data: IP address, browser information and the time of signup - Marketing data: any campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term)

When you fill in your profile, additionally: - Identity data: first name, last name, year of birth, nationality - Contact data: email address, phone, LinkedIn/portfolio URLs - Location data: the country and city you live in - Professional experience data: education records, work history, language levels and certificates, skill tags, short summary - Legal status data: passport country, EU work permit status, degree recognition (Anerkennung) status - Transaction data: target countries, target job titles, preferred working arrangement - Image data: your CV photo, if you upload one - Professional assessment data: the German CV text generated at your request - Consent data: the moment you accepted the Privacy Policy and Terms of Use, and the version of the text - Transaction security data: session cookie, rate limit counters, irreversible hash of your password

When the related features open, CV files you upload, per-listing cover letter text, application records and — if you choose to connect it — the permission to send mail on your behalf from your Google account (gmail.send) will also be processed.

We do not request special categories of personal data. No field in your profile asks for health, religion, ethnic origin or any other special category, and we advise you not to enter such information in free text fields.

• Creating your account and providing the service to you
• Finding job listings that fit and matching them to your profile
• Preparing a CV and cover letter for each listing
• Getting the application ready to send with your approval and showing the process in your dashboard
• Keeping the service secure and preventing abuse and automated requests
• Responding to your requests and complaints
• Measuring the effect of our advertising (only with your explicit consent)
• Meeting our legal obligations

Your data is processed on the following grounds: - Your explicit consent (Art. 5/1): receiving announcements from us, connecting your Google account, and cookie-based measurement - Directly related to the conclusion or performance of a contract (Art. 5/2-c): processing of profile, CV and application data once you open an account - Compliance with a legal obligation of the controller (Art. 5/2-ç): retention and disclosure duties required by legislation - Legitimate interests, provided your fundamental rights are not harmed (Art. 5/2-f): transaction security logs, prevention of abuse and continuity of the service

Where processing rests on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before then.

Your personal data is shared only with the suppliers required to run the service. They act as data processors and may not use your data for their own purposes: - Vercel Inc.: hosting and serving the application - Supabase Inc.: database and authentication - Upstash Inc.: rate-limit records; only a short-lived derivative of the IP address is held - Email infrastructure provider: sending notification emails - AI model provider: producing CVs and cover letters; content sent is not used for model training - Google LLC and Meta Platforms, Inc.: only if you gave explicit consent, for advertising and measurement

Application emails are not transferred to any third party; they are sent through your own Google account.

Some of these providers may host servers abroad. International transfers are made under Article 9 of the KVKK, based on your explicit consent or on an undertaking or standard contractual clauses. Data may also be shared with competent public authorities where legally required.

Your personal data is collected by wholly automated means, in electronic form: - Directly from you: the email address you enter when signing up, the information you enter in the profile form and the CV you upload - Automatically: IP address, browser information and timestamp, needed to operate the service securely - From the referring address: if you arrived through an ad or a link, the campaign parameters in that address

We do not collect data on paper. We do not buy data or obtain lists from third parties.

Your personal data is retained for as long as the processing purpose requires and for the statute-of-limitation periods prescribed by applicable law.

• Waiting list registration, if you joined the list earlier: retained no longer than twenty-four months; you may ask for its deletion at any time.
• Account and profile data: Retained while your account is active. When you delete your account, your data is permanently erased within 30 days; this window allows those who started the deletion by mistake to reverse it.
• Security-of-processing logs (IP address, browser information): Retained for a reasonable period to prevent misuse.

Personal data whose retention period has expired is deleted, destroyed, or anonymised.

Under Article 11 of the KVKK you have the right to: - Learn whether your personal data is being processed - Request information if it has been processed - Learn the purpose of processing and whether the data is used in line with that purpose - Know the third parties within or outside Türkiye to whom the data has been transferred - Request correction if the data is incomplete or inaccurate - Request erasure or destruction under the conditions set out in Article 7 - Request that correction, erasure and destruction be notified to the third parties the data was transferred to - Object to a result against you arising from analysis carried out solely by automated systems - Claim compensation for damage arising from unlawful processing

No application is ever sent from Kelyvaro without your approval; the decision in the process always remains yours.

Send requests concerning your rights to info@kelyvaro.com, stating the information required by the Communiqué on Application Procedures to the Data Controller (your name, contact details and the subject of your request).

Your request is concluded within thirty days at the latest. If the process requires additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, you find the response insufficient, or you receive no response in time, you may file a complaint with the Personal Data Protection Board.