Datenschutzerklärung (VAE)

UAE supplement

This is Crewla's Privacy Policy for work that takes place in the United Arab Emirates (UAE). It consists of this supplement and the general Privacy Policy below; where the two differ, this supplement prevails. We keep the EU General Data Protection Regulation (GDPR) as our baseline everywhere.

Who is the controller

For work in the UAE the controller is Crewla's EU company: [PLACEHOLDER: EU company (proposed Estonian OÜ) — name, registry number and address once incorporated]. Nivorbit Teknoloji Limited Şirketi is not the controller of this work's data; Turkey's KVKK and its notice apply only where your account or the work is in Turkey.

UAE data protection law

• Where the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies to our processing, we process your data in line with it as well, with the rights it gives you (access, correction, erasure, restriction, objection, portability and to stop processing) alongside those in section 13 below. We answer within the time the law allows, and never later than one month.
• You can complain to the UAE Data Office as well as to the authorities named in section 13.

What we also process for the UAE

• Right-to-work documents: a Worker's UAE work permit, residence visa or freelance permit, and a tour guide's Dubai tour guide licence: the photo of the document, its number (stored encrypted) and the date it ends. We use them only to check that the Worker may provide the service in the UAE (a legal obligation and our legitimate interest in not brokering unlawful work). The photos are never public; staff open them through short-lived links and every opening is recorded. They are deleted as the general policy says for licence documents.
• Payments and payouts: for work in the UAE, payments are collected by Stripe (EU company's account; card details stay with Stripe) and Workers are paid by Wise, to the Worker's AED bank account (IBAN). These replace iyzico and Nilvera in the table of section 6 for this work.

Transfers

Our servers are in the EU (Frankfurt), so data of work in the UAE is transferred out of the UAE. We rely on the PDPL's transfer rules (a country with adequate protection, or appropriate safeguards such as contractual clauses), and on section 7 below for transfers out of the EU.

Language

This policy is published in English, with its title also in Arabic; for the UAE the English text is the original, and the closing line of the general policy about the Turkish text prevailing does not apply. An Arabic text (and a right-to-left layout for it) is an open question.

The general Privacy Policy follows.

This policy explains how Crewla processes your personal data. Crewla is a global service, so we take the EU General Data Protection Regulation (GDPR) as our baseline and, for work in Turkey, also apply Turkey's Law No. 6698 on the Protection of Personal Data (KVKK). The short notice KVKK requires is in the Privacy Notice (KVKK); this policy completes it.

1. In short

• We do not sell your data, use it for advertising or build advertising profiles.
• Your card details never reach Crewla; you pay on the provider's own page.
• Your phone number is not shown to the other side; you talk through the app.
• Your location is read only at check-in and check-out, once, to measure the distance from the meeting point; the position itself is not kept.
• Your tax number and IBAN are stored encrypted.
• An automated system never decides to restrict or close your account.
• You can delete your account and download a copy of your data at any time.

2. Who is the controller?

Each booking on Crewla is sold by one Crewla company, chosen by the market where the work is done, and that company is responsible for that work's data:

For your account, sign-in and consent records, the controller is one of these companies depending on your country of residence. Which company a booking is made with is shown in the booking summary and on the invoice.

• Data protection officer (DPO): [PLACEHOLDER: name and contact once appointed]
• EU representative (GDPR Art. 27): [PLACEHOLDER: if required, once appointed]
• Contact: [PLACEHOLDER: privacy@crewla.app — once the address is set up]

3. What data we process

We do not ask for special category data (health, religion, ethnic origin and the like). The face match during identity verification is done by the provider and may count as biometric data.

4. Why, and on what legal basis?

You can always object to processing based on legitimate interest (GDPR Art. 21). You can withdraw consent at any time; this does not make earlier processing unlawful and does not stop you using the service. For marketing see Marketing Communications Consent; for analytics see Analytics Consent.

5. Location

Location is the data we use most carefully:

• A worker's service area: the centre and radius the worker chooses. The centre shown in search is shifted from the real centre by a secret offset; the real centre is shown to no one.
• Check-in and check-out: when a worker checks in and out, with their permission, the phone's position is read once and the distance from the meeting point is measured. Only that distance and whether it was within the set radius are kept. A check-in from further away still counts; it is simply marked unverified.
• The place of work: the meeting point the customer sets. When the booking's retention period ends, the address is erased and the position rounded to about 1 km.
• Map search: a customer may choose to use their own location in the map search; it is used to run that search.

Crewla does not track anyone outside the job.

6. Who we share your data with

• The other side of a booking: only what the work needs (profile, rating, place and time, meeting details; for a confirmed booking where needed, sizes). Phone numbers are not shared.
• Supplier agency and business team: an agency sees its roster's agency work; a business team sees the business's postings, bookings and invoices.
• Processors: service providers working on our behalf and on our instructions, bound by contract (table below).
• Public authorities: tax authorities, courts and authorities empowered by law, only where there is a legal obligation.
• Transfer of the business: if Crewla's business is transferred, data may pass to the new owner with the safeguards in this policy; we tell you beforehand.

7. International transfers

Our servers are in the EU (Frankfurt). For transfers from Turkey we use the standard contracts of Turkey's Personal Data Protection Board under Article 9 KVKK and notify the Board of them. For transfers outside the EU/EEA (for example to the USA) we rely on an adequacy decision of the European Commission (such as providers certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses (SCCs), with supplementary measures where needed. You can ask us for a copy of these safeguards.

8. How long we keep data

When you delete your account, the data that names you is erased straight away. The data below stays for a legal reason and is cleaned up by nightly jobs when its period ends. The periods are open to confirmation by our lawyer and accountant.

ID document and selfie images are kept by the identity verification provider for its own retention period.

9. Deleting your account and downloading your data

• Deletion: you can delete your account from Account. If you have work under way, money still to be settled, an open dispute, an open posting or earnings not yet paid out, or you own a business whose team has other people, these must be finished first; the app tells you why. After deletion, the remaining records are kept as in the table above.
• Download: from Account you can download a copy of your data as a machine-readable (JSON) file (GDPR Art. 20).

10. Security

• Connections are encrypted with TLS.
• Tax numbers and IBANs are encrypted at field level in the database.
• Personal data is masked in logs; names, phone numbers, email addresses, IBANs and locations are not written to logs. Error reports are cleaned of personal data before they are sent.
• Card details never enter our systems.
• The staff panel has a separate sign-in and mandatory two-step verification; every staff action is written to an audit log.
• If there is a data breach, we notify the competent authority within the legal deadline and, where required, you (GDPR Arts. 33–34, KVKK Art. 12).

11. Automated decisions

Search ranking, badges and reliability measures are calculated automatically; the rules are transparent and shown to the worker. Some disputes are settled automatically by clear rules (for example, a refund to the customer when there is no check-in and no location evidence). An automated system never decides to restrict, suspend or close an account: the system only opens a case for review, a person makes the decision with reasons, and you can appeal. You can contest an automated result and ask for human review (GDPR Art. 22, KVKK Art. 11(1)(g)).

12. Children

Crewla is not for anyone under 18. If we learn that someone under 18 has opened an account, we close it.

13. Your rights

Under GDPR Arts. 15–22 and KVKK Art. 11 you have the right to access your data, have it corrected or erased, restrict processing, data portability, object, withdraw consent, and ask for human review of solely automated decisions. You can use many of these in the app yourself; for the others, write to us. We answer free of charge within one month (30 days under KVKK).

You can also complain to a supervisory authority: in Turkey the Personal Data Protection Board; in the EU, the data protection authority of the country where you live or work. For how to apply under KVKK, see the Privacy Notice (KVKK).

14. Changes

When we change this policy we publish a new version; an earlier version is never edited, so the text you accepted always stays the same. We tell you about important changes in the app and ask for your consent again where needed.

15. Contact

[PLACEHOLDER: privacy@crewla.app — once the address is set up]. Post: Nivorbit Teknoloji Limited Şirketi, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale 17100, Türkiye.

This English version is provided for convenience; where the Turkish and English texts differ, the Turkish text prevails.