KVKK Disclosure Notice

Your personal data is processed by Kelyvaro as data controller, within the scope described below. Contact: info@kelyvaro.com

Kelyvaro is currently pre-launch. At this stage only waitlist data is collected. The product-related processing described below applies once the service opens and only to users who create an account.

Pre-launch, when you join the waitlist: - Identity and contact data: your email address - Transaction security data: IP address, browser information and the time of signup - Marketing data: your language preference, the country you are interested in, the page the signup came from and any campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term)

Once the service opens, if you create an account, additionally: - Professional experience data: work history, education, language level and CV content - Legal status data: your declared visa and residence status - Transaction data: application records and their statuses - Authorisation data: if you choose to connect your Google account, only the permission to send mail on your behalf (gmail.send)

We do not request special categories of personal data.

• Running the waitlist and notifying you when the service opens
• Finding job listings that fit and matching them to your profile
• Preparing a CV and cover letter for each listing
• Getting the application ready to send with your approval and showing the process in your dashboard
• Keeping the service secure and preventing abuse and automated requests
• Responding to your requests and complaints
• Measuring the effect of our advertising (only with your explicit consent)
• Meeting our legal obligations

Your data is processed on the following grounds: - Your explicit consent (Art. 5/1): joining the waitlist, receiving announcements from us, and cookie-based measurement - Directly related to the conclusion or performance of a contract (Art. 5/2-c): processing of profile, CV and application data once you open an account - Compliance with a legal obligation of the controller (Art. 5/2-ç): retention and disclosure duties required by legislation - Legitimate interests, provided your fundamental rights are not harmed (Art. 5/2-f): transaction security logs, prevention of abuse and continuity of the service

Where processing rests on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before then.

Your personal data is shared only with the suppliers required to run the service. They act as data processors and may not use your data for their own purposes: - Vercel Inc.: hosting and serving the application - Supabase Inc.: database and authentication - Upstash Inc.: rate-limit records; only a short-lived derivative of the IP address is held - Email infrastructure provider: sending notification emails - AI model provider: producing CVs and cover letters; content sent is not used for model training - Google LLC and Meta Platforms, Inc.: only if you gave explicit consent, for advertising and measurement

Application emails are not transferred to any third party; they are sent through your own Google account.

Some of these providers may host servers abroad. International transfers are made under Article 9 of the KVKK, based on your explicit consent or on an undertaking or standard contractual clauses. Data may also be shared with competent public authorities where legally required.

Your personal data is collected by wholly automated means, in electronic form: - Directly from you: the email address and country preference you enter in the waitlist form; once the service opens, the information you enter in the profile form and the CV you upload - Automatically: IP address, browser information and timestamp, needed to operate the service securely - From the referring address: if you arrived through an ad or a link, the campaign parameters in that address

We do not collect data on paper. We do not buy data or obtain lists from third parties.

Under Article 11 of the KVKK you have the right to: - Learn whether your personal data is being processed - Request information if it has been processed - Learn the purpose of processing and whether the data is used in line with that purpose - Know the third parties within or outside Türkiye to whom the data has been transferred - Request correction if the data is incomplete or inaccurate - Request erasure or destruction under the conditions set out in Article 7 - Request that correction, erasure and destruction be notified to the third parties the data was transferred to - Object to a result against you arising from analysis carried out solely by automated systems - Claim compensation for damage arising from unlawful processing

No application is ever sent from Kelyvaro without your approval; the decision in the process always remains yours.

Send requests concerning your rights to info@kelyvaro.com, stating the information required by the Communiqué on Application Procedures to the Data Controller (your name, contact details and the subject of your request).

Your request is concluded within thirty days at the latest. If the process requires additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, you find the response insufficient, or you receive no response in time, you may file a complaint with the Personal Data Protection Board.