KVKK Clarification Notice

This Clarification Notice is prepared in accordance with Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the related Communiqué on Procedures and Principles to be Followed in Fulfilling the Clarification Obligation, in order to inform you about the personal data processed by DELWORK BİLİŞİM LTD. ŞTİ. in its capacity as Data Controller.

1. Identity of the Data Controller

2. Categories of Personal Data Processed

• Identity: first name, last name
• Contact: email, phone, country/city, address
• Professional Experience: CV content, work experience, education, certifications, SAP module information, projects, skills
• Customer Transaction: purchase, order number, payment status, invoice information, customer current records
• Finance: tax information required for invoicing (TCKN/VKN/tax office); card data is not stored
• Transaction Security: session data, IP address, password hash, log records, browser information
• Marketing (with consent): cookie/pixel data, campaign interaction information
• Visual/Audio: profile photo, company logos (if uploaded by the user)

3. Purposes of Processing

• Membership creation, identity verification, account security
• Provision of CV creation, sharing and consultant/firm matching services
• Credit package sales, payment processing and invoicing
• Fulfillment of legal obligations (tax, commercial law, consumer law)
• Platform security, fraud detection, prevention of abuse
• Marketing communications and product/service notifications with explicit consent
• Provision of AI-assisted features with explicit consent (CV import, translation, summary)

4. Legal Bases for Processing

Your personal data is processed on the following legal bases set forth in Articles 5 and 6 of KVKK:

• Performance of a contract (Art.5/2-c): membership, credit sales, service provision
• Legal obligation (Art.5/2-ç): Commercial Code, Tax Procedure Law, Consumer Law
• Legitimate interest (Art.5/2-f): system security, fraud prevention, service quality
• Explicit consent (Art.5/1, Art.9): marketing communications, optional cookies, transfer to overseas AI providers

5. Method of Data Collection

Your data is collected electronically via direct submission on the Platform — registration form, profile/CV creation flow, payment/checkout process, support and contact forms. Data may also be collected automatically via cookies and similar technologies; details are provided in the <a href="https://cv4sap.com/en/cerez-politikasi">Cookie Policy</a>.

6. Recipients of Data and Purposes of Transfer

• PayTR — payment processing (PCI-DSS compliant, Turkey)
• Hosting & infrastructure providers — server, database, email delivery (Turkey)
• OpenAI / Google (Gemini) — overseas AI providers — for AI features (USA); transfer occurs only with explicit consent under KVKK Art.9
• Accountants / tax authorities — invoice and financial record management (Turkey)
• Authorized public institutions — requests pursuant to court orders or law

Under no circumstances is your data sold to third-party ad networks or data brokers.

7. Cross-Border Transfer (KVKK Art.9)

When you use AI features such as CV import, translation or summary generation, the relevant data is processed on OpenAI (USA) or Google Gemini (USA) infrastructure. This transfer occurs only with the user's explicit consent; if no consent is given, no overseas transfer takes place and manual CV creation remains available. Consent can be withdrawn at any time from your profile page.

8. Retention Periods and Destruction Method (KVKK Art.7)

Pursuant to Article 7 of KVKK and the <strong>Regulation on Deletion, Destruction or Anonymization of Personal Data</strong>, your personal data is deleted, destroyed or anonymized — ex officio or upon request — when the processing purpose ceases or the statutory retention period expires. Retention periods by data category:

• Account and profile data: while the account remains active. Upon a deletion request, the account is anonymized after a 30-day statutory grace period; profile/CV content and session records are deleted.
• Invoice and financial records: 5 years pursuant to Tax Procedure Law Art.253 and 10 years pursuant to Turkish Commercial Code Art.82. Anonymized or destroyed at the end of the period.
• Contract and consumer transaction records: 10 years pursuant to Law No. 6502 and the Turkish Code of Obligations
• Security and access logs: 1 year on legitimate interest basis
• Support requests and correspondence: 3 years
• Marketing data and optional cookie records: until consent is withdrawn or after 1 year of inactivity

Destruction Method: Where statutory retention obligations conflict with KVKK, the legal obligation prevails; in such cases identifying fields (name, email, phone, etc.) are <strong>anonymized</strong>, while financial records subject to mandatory retention are kept until the period expires and destroyed thereafter. Anonymization replaces identifiers irreversibly so that the record can no longer be linked to any natural person. The Company's <strong>Retention and Destruction Policy</strong> details these processes and is reviewed periodically.

9. KVKK Article 11 — Data Subject Rights

Pursuant to Article 11 of KVKK, you may exercise the following rights by applying to the Data Controller:

• Learn whether your personal data is being processed
• Request information about such processing
• Learn the purpose of processing and whether it is used accordingly
• Learn the third parties (domestic/foreign) data is transferred to
• Request correction of incomplete/incorrect data
• Request deletion/destruction (except legally required retention)
• Request that correction/deletion be notified to recipients
• Object to adverse outcomes resulting from automated systems
• Claim compensation for damages from unlawful processing

10. Application Method

To exercise the rights above pursuant to the Communiqué on the Application Procedures and Principles to the Data Controller, you may submit a request — including identifying information and the substance of your request — through the channels below:

• Email: info@cv4sap.com
• Postal address (with wet signature): 15 Temmuz Mah. Gülbahar Cad. Nurol Park H Blok No: 45/5 İç Kapı No: 42 Bağcılar / İstanbul

Applications are concluded free of charge within at most 30 days from proper receipt. If a cost arises due to the nature of the request, the tariff set by the Personal Data Protection Board applies.

This Notice may be revised in case of regulatory changes or service updates; the current version is always published on this page. For broader information, please review our Privacy Policy and Cookie Policy.