Privacy Notice (KVKK)
Version 2026-10-15 · Effective: 15 October 2026
Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Duty to Inform, this notice explains who processes your personal data on the Uniworksity platform, why and on what legal basis, who receives it, how long it is kept and what your rights are.
This English text is provided for convenience. If it differs from the Turkish text, the Turkish text prevails.
1. Data controller
The data controller is [to be decided: name of the data controller]. Address: [to be decided: postal address]. Contact: destek@uniworksity.com.
When you apply for a job, the employer is a separate data controller for the application data it receives, for its own hiring process; you can also ask the employer how it processes that data.
2. Personal data we process
All accounts
- Contact: e-mail address
- Account security: an irreversible hash of your password (the password itself is never stored), session records (hashes of session keys; when they were opened, last used and ended), whether your e-mail is confirmed, when confirmation and password-reset e-mails were sent
- Legal records: the version and time of the terms of use you accepted and the privacy notice you read, and your choice on marketing e-mails
- Preference: site language
We use your 18+ confirmation and (for students) your birth year only for the age check at sign-up; we do not store them.
Students
- Profile: full name, nationality, university, level and year of study, the city you live in, languages and levels, residence permit status and whether you hold a work permit (not asked of Turkish citizens)
- CV: your PDF file, if you upload one, and what it contains
- Applications: the listings you applied for, a copy of your profile at the time, your e-mail address, your note to the employer, a copy of your CV, the status and dates of the application
We do not ask for a passport / ID number, address or photo. We do not collect special categories of personal data (health, religion, ethnic origin, political opinions, biometric data and the like); please do not put them in your CV or notes.
Employers (company representatives)
- Company and contact details: company name, tax number, website, sector, city, size band, description, the company logo if you upload one; the contact person's name, phone number and contact e-mail
- Verification documents: the PDFs you upload, such as the tax certificate, signature circular, Trade Registry Gazette or chamber registration (they may contain identity details and signatures of authorised persons), and records of their review
- Listings and decisions: listing content, the work-permit declaration, review decisions and reasons, your decisions on candidates (shortlisted, rejected, hired)
Hire ratings: If an employer marks you as hired through the platform, they may record an assessment of your work period (scores from 1 to 5, start and end dates, days worked, whether they would hire you again and a short note). Our team reviews and approves it; it is never published on the site or shared with other employers or third parties. We process it on the basis of our legitimate interest in platform safety and service quality (KVKK art. 5/2-f). You can learn what ratings we hold about you under KVKK art. 11 (they are also in your account's data export) and ask for them to be corrected or deleted. They are deleted when you delete your account.
Two-way reviews: After a hire, employers and students can review each other (a score from 1 to 5 and a short comment). Reviews are published only after our team approves them, and an approved review stays hidden until the other side has written theirs too or 14 days have passed. An employer's review of a student is shown to employers the student applies to later. A student's review of an employer is shown on the company's public page with the student's first name, last initial and nationality. Reviews are included in your data export and are deleted when you delete your account. They are separate from the private hire rating above, which is never published.
Reports: the reporting account and its e-mail address, the listing / company / person reported, the category, the description, review notes and the outcome.
KVKK requests: the type of your request, how and when it reached us, a short summary, our answer and its history; your e-mail address if you have no account.
Activity log: who did what, when, to which record and why, for actions by our team and the system (such as approving a listing, suspending an account, downloading a document, deleting an account).
Technical data: the server hosting the site keeps access logs, such as IP address, date and time, the address requested and browser details. Our application does not store IP addresses in its databases.
We collect data electronically through the site's forms, file uploads and your e-mails to us; technical data is collected automatically by the server.
3. Purposes
- Creating your account, signing in, confirming your e-mail and resetting your password
- Publishing and searching listings and showing their work-permit information
- Forwarding your application to the employer, tracking applications and e-mailing decisions
- Verifying employers and companies and reviewing listings before they go live
- Preventing fake listings, fraud, requests for money from students and leading people to unpermitted work; handling reports and suspending accounts where needed
- Account and platform security and keeping an activity log
- Carrying out account deletion and KVKK requests, complying with the law and protecting rights in disputes
- Sending new-job and announcement e-mails if you consented
4. Legal bases
- Entering into and performing the contract (KVKK Art. 5(2)(c)): account, profile, CV, forwarding applications to employers, publishing listings and service e-mails
- Legal obligation (Art. 5(2)(ç)): answering requests from competent authorities, answering and recording KVKK requests
- Establishing, exercising or defending a right (Art. 5(2)(e)): accepted text versions, activity logs, report files
- Legitimate interest (Art. 5(2)(f)): employer verification, listing review and risk checks, preventing abuse, keeping the platform secure, hire ratings, and approving and showing two-way reviews, without harming your fundamental rights and freedoms
- Explicit consent (Art. 5(1)): only for the optional new-job and announcement e-mails (consent text) and for Google advertising cookies (the cookie notice on the site; section 10); not consenting does not affect your use of the platform
We do not knowingly process special categories of personal data (Art. 6). If you add such information to your CV yourself, it also reaches the employer when you apply, so we recommend leaving it out.
5. Who receives your data
- Employers: when you apply, a copy of your profile at that time, your e-mail address, your note and a copy of your CV go only to that listing's employer. Approved reviews from your earlier employers are also shown to the employers you apply to. Employers cannot see your profile otherwise; there is no candidate search or talent pool. If your account is suspended, your undecided applications are hidden from the employer while the suspension lasts; the employer is not told about the suspension.
- The public: listings, company names and company logos are public on the site and in search engines' job services (such as Google). Students' approved reviews of companies are public on the company's page with the student's first name, last initial and nationality. Employer contact details, tax numbers and documents are not published.
- Service providers (data processors): the hosting provider that stores the site, the databases and the files; e-mails are sent through that provider's mail server. An encrypted copy of the daily backup is kept on GitHub (GitHub, Inc.), which hosts our code; only we hold the key that decrypts it, so the provider cannot read its contents.
- Error monitoring: technical error reports go to Sentry (Functional Software, Inc., USA); section 6 has the details.
- Our team: moderators and support see only the data their task needs, limited by their role and recorded in the activity log. Our team cannot browse applications: it reaches them only while reviewing a report, limited to the applications that report concerns, and only moderators and administrators, who decide, can open an application's content and CV while the review is open. Every access is logged.
- Competent authorities: courts and public bodies that request data where the law requires it.
- Legal advisers: as far as needed to protect rights in a dispute.
Advertising partner (only if you allow it): if you allow Google ads, Google (Google Ireland Limited and Google LLC) receives data from your browser to show ads; section 10 has the details.
We do not sell your data. The information in your account (name, e-mail address, profile, CV, applications) is never given to advertisers or to Google; sponsored listings collect no data about you.
6. Transfers abroad
The site, the databases and the files are hosted on our hosting provider's servers in the European Union, and e-mails are sent through them, so all of the data above is transferred abroad. The encrypted copy of the daily backup is kept on the servers of US-based GitHub.
If you choose to open the map on a job page, or search for a workplace address in the job form as an employer, your browser connects directly to the servers of US-based Google (Google LLC); section 10 has the details.
Error monitoring: when the site or our servers hit a technical error, we send an error report to Sentry (Functional Software, Inc., USA) so we can fix it. The report contains the technical details of the error (page, browser and device type, the code that failed) and, if you are signed in, your internal account number. It does not contain your IP address, name, e-mail address, cookies or anything you typed into forms. Reports are kept for up to 90 days. This transfer abroad relies on our legitimate interest in keeping the service working (KVKK art. 5/2-f) and the safeguards under KVKK art. 9.
These transfers rely on the standard contract announced by the Turkish Personal Data Protection Board, one of the appropriate safeguards under Article 9 of the KVKK.
Google ads: if you accept Google ads in the cookie notice, your browser connects directly to the servers of Google (Google Ireland Limited and US-based Google LLC), and Google receives the data described in section 10. This transfer relies on your explicit consent, which you can withdraw at any time. If you do not accept, nothing is sent to Google for advertising.
7. How long we keep data
- Account and profile: for as long as your account is open.
- Deleting a student account: with "Delete account" on the profile page your account is anonymised at once and your sessions end; your profile, your CV and the personal data in your applications (profile copy, e-mail, note, CV) are deleted within minutes. Undecided applications are withdrawn; decided ones stay with the employer only as "deleted account" with the outcome. Reports you made stay without your e-mail address. After a last confirmation e-mail we also delete your address from our e-mail system.
- Withdrawn applications: the CV copy is deleted when you withdraw.
- Records without your name or e-mail (account number, role, language, sign-up and deletion dates, accepted text versions): for proof and the protection of rights, for the applicable limitation periods.
- Activity log: 2 years.
- KVKK requests: 3 years after the request is closed.
- Employer accounts and company details: for as long as the account is open.
- Deleting an employer account: with "Delete account" on the company page, or by our team at your request. Your account is anonymised at once and your sessions end; within minutes the company is closed: its listings go offline; the contact person, phone number, contact e-mail, website and description, the verification documents and the logo are deleted; undecided applications are closed and the candidates are told once; the candidate data in every application you received (profile copy, e-mail, note, CV) is deleted. To prevent abuse, the company name, tax number, sector, city, size band, verification level and check results, suspension history and team notes are kept for 2 years and then deleted; during that time a new sign-up with the same tax number goes to team review. After a last confirmation e-mail we also delete your address from our e-mail system.
- Verification documents: a rejected document is deleted 30 days after the rejection; when a newer document of the same type is accepted, the older one is deleted 30 days after that acceptance. Pending and valid documents are kept while the company is open. A suspended company's documents are not deleted while the suspension lasts, as evidence for the decision.
- Company logo: while the company is open; when you upload a new one or the logo is removed, the old file is deleted.
- Reports: for the applicable limitation periods. If the reporting account is deleted, the report stays without its e-mail address.
- Backups: the server takes an encrypted backup of the data and files every day and keeps it for 14 days; the copy kept off the server is also deleted after 14 days. Data we delete is therefore gone from the live system at once and from the backups within 14 days at the latest.
- Server access logs: for the hosting provider's log cycle.
Data that is no longer needed is deleted or anonymised under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
8. Your rights and how to use them
Under Article 11 of the KVKK you can ask the data controller to:
- tell you whether your personal data is processed and, if so, give you information about it
- tell you the purpose of the processing and whether the data is used accordingly
- tell you the third parties in Türkiye or abroad to whom it is transferred
- correct it if it is incomplete or wrong
- delete or destroy it under Article 7 of the KVKK
- notify the third parties who received it of a correction, deletion or destruction
- hear your objection if an analysis made only by automated systems has a result against you
- compensate damage caused by unlawful processing
How: state who you are and what you request, and write from the e-mail address registered on your account to destek@uniworksity.com; in writing to [to be decided: postal address]; or by registered e-mail (KEP), secure electronic signature or mobile signature (Communiqué on the Procedures for Applications to the Data Controller).
Students can correct their profile and employers their company details at any time; students can delete their account themselves on the profile page, employers on the company page.
We answer free of charge within 30 days at the latest; if the request involves an extra cost, the fee in the Board's tariff may be charged. If your request is refused, you find the answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board (KVKK Art. 14).
For application data sent to an employer you can also contact the employer directly.
9. Security
Passwords are stored irreversibly and the site is only served over an encrypted connection (HTTPS). CVs and company documents are kept outside the web server's public area and only authorised people can download them. Backups are encrypted as they are written. Team access is limited by role, and actions, including document and CV downloads, are logged.
11. Changes
When we update this notice we publish the new version with its date; earlier versions stay available through the links at the bottom of this page.