Privacy Notice (KVKK)

This notice is given under Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data (KVKK) to everyone who uses the Crewla app and the crewla.app website: customers, workers, agencies and members of business teams. For more detail, retention periods and technical safeguards, see the Privacy Policy.

1. Data controller

Crewla is a brand of Nivorbit Teknoloji Limited Şirketi. For work done in Turkey (where both the place of the service and the worker's country are Turkey) the data controller is:

• Legal name: Nivorbit Teknoloji Limited Şirketi
• MERSİS number: 0631151313600001
• Tax office and number: Çanakkale Tax Office, 6311513136
• Trade registry: Çanakkale Trade Registry, registration no. 9575
• Address: Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale 17100, Türkiye
• VERBİS registration no.: [PLACEHOLDER: added once registered with VERBİS]
• Registered electronic mail (KEP): [PLACEHOLDER: added once obtained]
• Email for data protection requests: [PLACEHOLDER: kvkk@crewla.app — once the address is set up]

For work done outside Turkey, the company that sells that work and is responsible for its data will be [PLACEHOLDER: EU company (proposed Estonian OÜ) — name, registry number and address once incorporated]. Which company a booking is made with is shown in the booking summary and on the invoice.

2. Which personal data we process

We collect only the data we actually use to provide the service. Which data is processed depends on how you use Crewla.

Everyone

• Identity and contact: your phone number (the key to your account; verified once by SMS code when you sign up), your name or display name, your language, your country of residence.
• Email address: only if you sign in with Google or Apple, the address that service passes to us.
• Sign-in and security data: your passkeys (only the public part of the key on your device; your fingerprint or face data never reaches us), an optional authenticator app (TOTP), session data, sign-in attempts and security logs.
• Evidence of consent: which version of which legal document you accepted or declined and when, the language it was shown in, your IP address and your browser or app details.
• Messages and calls: your conversations in the app, their translations if you ask for them, and records of masked calls. Your phone number is never shown to the other side. Contact details in messages (phone numbers, email addresses, IBANs and the like) are hidden automatically; repeated cases are reviewed by a person.
• Ratings and reliability: the ratings and reviews you give and receive; for workers, reliability records such as completed jobs, no-shows, late cancellations and on-time check-ins.
• Notifications: your device's push token and your notification preferences.
• Problems and disputes: reported problems, dispute records, and the explanations and evidence you add.

Customers and businesses

• Bookings and postings: the place, date and times of the work, the meeting point and meeting note, the posting's description, the clothing and equipment asked for.
• Payments: the amount, payment and refund status, and the payment provider's transaction reference. Your card details never reach Crewla; you enter them on the payment provider's own page.
• Invoicing: the invoice name or company name, tax number (with the tax office in Turkey), address, and the sales invoices issued. If a business uses projects, the project name on the invoice.
• Business and team: the business's name, tax details, address and verification status; team members and their roles (owner, manager); who created a piece of work on the business's behalf.

Workers

• Profile: profile photo, introduction, experience, the categories you work in, the languages you speak, your hourly rate, your availability, your clothing and equipment.
• Service areas: the centre and radius of the area you work in. The centre shown in search is shifted from your real centre by a secret offset; your real centre is not shown to anyone.
• Sizes (optional): clothing size and shoe size, used only to provide a uniform and passed only to the customer of a confirmed booking; never a search filter or ranking criterion.
• Identity verification: your ID document and your selfie stay with the identity verification provider; Crewla keeps only the result and the provider's reference.
• Licence documents: in categories that need a licence (such as tourist guiding), the document you upload. It is reviewed by a Crewla staff member.
• Tax profile: your Turkish identity number or tax number (encrypted at field level), whether you are a taxpayer, and your consent to documents being issued on your behalf (expense voucher or self-billing).
• Payout account: the IBAN your earnings are paid to (encrypted) and the account holder's name; bank verification status.
• Earnings: earnings items, payout batches, transfer and return records, expense voucher and withholding tax details.
• Agency membership: if you are on a supplier agency's roster, which agency and whether you chose to appear on its page.
• Check-in and check-out location: your location is used only at the moment you check in and out. Your phone's position is read once to measure the distance from the meeting point; only that distance and whether it was within the set radius are kept, never the position itself. Crewla does not track you outside the job.

3. Why we process your data

1. To open your account, verify your phone and let you sign in securely.
2. To bring customers and workers together: search, postings, applications, offers and bookings.
3. To sell the service, take payment, handle cancellations and refunds, and invoice the customer (Crewla sells the service in its own name and issues the invoice itself).
4. To work out and pay workers' earnings; to issue expense vouchers, withhold and report tax.
5. To verify identities, licences, businesses and bank accounts; to prevent fraud and abuse.
6. To look for a suitable person to replace a worker who cannot come or cancels, to provide the standby service, and to notify the people involved.
7. To keep communication between the parties on the platform, translate messages and make masked calls.
8. To run ratings, badges and reliability measures, and to rank search results.
9. To review and decide on complaints, reported problems and disputes.
10. To meet legal obligations: tax and commercial records, consent records, requests from authorities.
11. To keep the service secure and running: error logs, security logs, limits against abuse.
12. If you agreed, to send marketing messages and measure usage (see Marketing Communications Consent and Analytics Consent).

4. Legal bases

We rely on these grounds of Article 5 KVKK:

• Entering into and performing a contract (5/2-c): account, bookings, payments, earnings, messaging, stand-in search, check-in and check-out, ratings.
• Legal obligation (5/2-ç): invoices and expense vouchers, withholding tax, commercial books (Turkish Commercial Code, Tax Procedure Law), consent and marketing records.
• Establishing, exercising or defending a right (5/2-e): dispute and refund records, evidence of consent, proof that contracts and legal documents were accepted.
• Legitimate interest (5/2-f): security of the service, fraud prevention, error logs, hiding contact details, ranking and reliability measures.
• Explicit consent (5/1): marketing messages, analytics, and, where required, biometric matching during identity verification. You can withdraw explicit consent at any time; doing so does not stop you using the service.

5. Who receives your data

We do not sell your data and we do not use it for advertising. We share only what the service needs, with those who need it.

• The other side of a booking: the customer sees the worker's profile, rating and badges and, for a confirmed booking where needed, their sizes. The worker sees the place, time, meeting details and the customer's rating. Phone numbers are not shared.
• Supplier agency: if you are on an agency's roster, the agency sees your agency bookings, availability, verification status and rating.
• Business team: if you are on a business's team, the team sees that business's postings, bookings and invoices.
• Our service providers (processors): listed in the table below.
• Public authorities: the Turkish Revenue Administration (invoices, expense vouchers, withholding tax), courts, enforcement offices and other authorities empowered by law, only where there is a legal obligation.

Transfers abroad

Our servers are in Germany (AWS Frankfurt) and some of our providers are outside Turkey, so your data is transferred abroad. We make these transfers under Article 9 KVKK using the standard contracts published by the Personal Data Protection Board and notify the Board within 5 working days of signing them.

6. How we collect your data

• From the forms you fill in and the actions you take in the app and on the website (electronically, by automated or partly automated means).
• From Google or Apple, if you sign in with them.
• From the identity verification, payment and bank verification providers, as the result of their checks.
• From your device: location only with your permission and only at check-in or check-out; the push token; app and browser details.
• From the other side of a booking: ratings, reviews, reported problems.

7. How long we keep it

When you delete your account, the data that directly identifies you is erased straight away. Records the law requires us to keep (bookings, payments and invoices, the tax profile, evidence of consent and the like) are kept for the legal period and then erased or anonymised automatically. The periods are listed in a table in the Privacy Policy.

8. Your rights under KVKK

Under Article 11 KVKK you have the right to:

1. Learn whether your personal data is processed.
2. Ask for information about it if it is.
3. Learn the purpose of processing and whether it is used for that purpose.
4. Know the third parties in Turkey or abroad it is transferred to.
5. Have it corrected if it is incomplete or wrong.
6. Have it erased or destroyed under the conditions of Article 7 KVKK.
7. Have corrections, erasure or destruction passed on to the third parties it was transferred to.
8. Object to a result against you that comes solely from automated analysis.
9. Claim compensation if you suffer damage from unlawful processing.

You can use many of these rights yourself in the app: correct your profile and details, download a copy of your data from Account, and delete your account. You can withdraw marketing and analytics consent at any time.

Decisions to restrict, suspend or close an account are never made by an automated system; a Crewla staff member makes them with reasons, and you can appeal.

9. How to make a request

Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can send your request, with details that identify you, in one of these ways:

• In writing, with a signed letter to our address above.
• To our registered electronic mail (KEP): [PLACEHOLDER: KEP address].
• From the email address registered with us, or with a secure electronic or mobile signature, to: [PLACEHOLDER: kvkk@crewla.app].

We answer within 30 days, free of charge. If the request involves an additional cost, the fee in the Board's tariff may be charged. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board.

10. Changes

When we change this notice we publish a new version; an earlier version is never edited. We tell you about important changes in the app.

This English version is provided for convenience; where the Turkish and English texts differ, the Turkish text prevails.