This policy explains how Crewla processes your personal data. Crewla is a global service, so we take the EU General Data Protection Regulation (GDPR) as our baseline and, for work in Turkey, also apply Turkey's Law No. 6698 on the Protection of Personal Data (KVKK). The short notice KVKK requires is in the Privacy Notice (KVKK); this policy completes it.
1. In short
- We do not sell your data, use it for advertising or build advertising profiles.
- Your card details never reach Crewla; you pay on the provider's own page.
- Your phone number is not shown to the other side; you talk through the app.
- Your location is read only at check-in and check-out, once, to measure the distance from the meeting point; the position itself is not kept.
- Your tax number and IBAN are stored encrypted.
- An automated system never decides to restrict or close your account.
- You can delete your account and download a copy of your data at any time.
2. Who is the controller?
Each booking on Crewla is sold by one Crewla company, chosen by the market where the work is done, and that company is responsible for that work's data:
| Situation | Controller |
|---|---|
| Service in Turkey and worker in Turkey | Nivorbit Teknoloji Limited Şirketi (MERSİS 0631151313600001, tax no. 6311513136, Çanakkale Trade Registry 9575; Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale 17100, Türkiye) |
| All other work | [PLACEHOLDER: EU company (proposed Estonian OÜ) — name, registry number and address once incorporated] |
For your account, sign-in and consent records, the controller is one of these companies depending on your country of residence. Which company a booking is made with is shown in the booking summary and on the invoice.
- Data protection officer (DPO): [PLACEHOLDER: name and contact once appointed]
- EU representative (GDPR Art. 27): [PLACEHOLDER: if required, once appointed]
- Contact: [PLACEHOLDER: privacy@crewla.app — once the address is set up]
3. What data we process
| Category | Examples | From whom |
|---|---|---|
| Account and identity | Phone number (verified once by SMS at sign-up), name or display name, language, country of residence; email address when signing in with Google or Apple | Everyone |
| Sign-in and security | Passkey public key (your biometrics stay on your device), optional authenticator app, sessions, sign-in attempts, security logs | Everyone |
| Evidence of consent | The document and version accepted or declined, time, language, IP address, browser or app details | Everyone |
| Messages and calls | Conversations, translations asked for, masked call records, records of hidden contact details | Everyone |
| Ratings and reliability | Ratings and reviews given and received; completed jobs, no-shows, late cancellations, on-time check-ins | Everyone |
| Notifications | Device push token, notification preferences | Everyone |
| Problems and disputes | Reported problems, explanations, evidence, decisions | Everyone |
| Bookings and postings | Place and times of the work, meeting point and note, posting description, clothing and equipment asked for | Customers, businesses |
| Payments | Amount, payment and refund status, provider's transaction reference (never card details) | Customers, businesses |
| Invoicing and business | Invoice or company name, tax number, tax office (Turkey), address, project name; business verification, team members and roles | Customers, businesses |
| Worker profile | Photo, introduction, experience, categories, languages, hourly rate, availability, clothing and equipment | Workers |
| Service area | Centre and radius; search shows a point shifted from the real centre by a secret offset | Workers |
| Sizes (optional) | Clothing size, shoe size; only to the customer of a confirmed booking, for a uniform | Workers |
| Identity verification | Result and the provider's reference; the document and selfie stay with the provider | Workers |
| Licence document | The document uploaded for licensed categories and the review decision | Workers |
| Tax profile | Turkish identity number or tax number (encrypted), taxpayer status, consent to documents issued on your behalf | Workers |
| Payout account and earnings | IBAN (encrypted), account holder's name, bank verification; earnings items, payouts, expense vouchers and withholding tax | Workers, supplier agencies |
| Check-in and check-out | Distance from the meeting point and whether it was within the radius (not the position itself) | Workers |
| Agency membership | The agency joined, whether to appear on its page | Workers |
We do not ask for special category data (health, religion, ethnic origin and the like). The face match during identity verification is done by the provider and may count as biometric data.
4. Why, and on what legal basis?
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Account, sign-in, phone verification | Contract (Art. 6(1)(b)) | 5/2-c |
| Search, postings, applications, offers, bookings | Contract (6(1)(b)) | 5/2-c |
| Payment, cancellation, refunds, invoicing the customer | Contract (6(1)(b)), legal obligation (6(1)(c)) | 5/2-c, 5/2-ç |
| Paying earnings, expense vouchers, self-billing, withholding tax | Contract (6(1)(b)), legal obligation (6(1)(c)) | 5/2-c, 5/2-ç |
| Identity, licence, business and bank verification | Contract (6(1)(b)), legitimate interest (6(1)(f)) | 5/2-c, 5/2-f |
| Stand-in search, standby, notifications | Contract (6(1)(b)) | 5/2-c |
| Messaging, translation, masked calls, hiding contact details | Contract (6(1)(b)), legitimate interest (6(1)(f)) | 5/2-c, 5/2-f |
| Ratings, badges, reliability, ranking | Contract (6(1)(b)), legitimate interest (6(1)(f)) | 5/2-c, 5/2-f |
| Reviewing disputes and complaints | Contract (6(1)(b)), legitimate interest (6(1)(f)) | 5/2-c, 5/2-e |
| Evidence of consent, commercial books, tax records | Legal obligation (6(1)(c)) | 5/2-ç, 5/2-e |
| Security, fraud prevention, error logs | Legitimate interest (6(1)(f)) | 5/2-f |
| Marketing messages | Consent (6(1)(a)) | Explicit consent (5/1) |
| Analytics | Consent (6(1)(a)) | Explicit consent (5/1) |
You can always object to processing based on legitimate interest (GDPR Art. 21). You can withdraw consent at any time; this does not make earlier processing unlawful and does not stop you using the service. For marketing see Marketing Communications Consent; for analytics see Analytics Consent.
5. Location
Location is the data we use most carefully:
- A worker's service area: the centre and radius the worker chooses. The centre shown in search is shifted from the real centre by a secret offset; the real centre is shown to no one.
- Check-in and check-out: when a worker checks in and out, with their permission, the phone's position is read once and the distance from the meeting point is measured. Only that distance and whether it was within the set radius are kept. A check-in from further away still counts; it is simply marked unverified.
- The place of work: the meeting point the customer sets. When the booking's retention period ends, the address is erased and the position rounded to about 1 km.
- Map search: a customer may choose to use their own location in the map search; it is used to run that search.
Crewla does not track anyone outside the job.
6. Who we share your data with
- The other side of a booking: only what the work needs (profile, rating, place and time, meeting details; for a confirmed booking where needed, sizes). Phone numbers are not shared.
- Supplier agency and business team: an agency sees its roster's agency work; a business team sees the business's postings, bookings and invoices.
- Processors: service providers working on our behalf and on our instructions, bound by contract (table below).
- Public authorities: tax authorities, courts and authorities empowered by law, only where there is a legal obligation.
- Transfer of the business: if Crewla's business is transferred, data may pass to the new owner with the safeguards in this policy; we tell you beforehand.
| Service | Provider | Location |
|---|---|---|
| Hosting and database | Amazon Web Services | Germany (Frankfurt) |
| Payments and payouts (Turkey) | iyzico | Turkey |
| e-Archive / e-Invoice integrator (Turkey) | Nilvera | Turkey |
| SMS (Turkish numbers) | Netgsm | Turkey |
| SMS (other numbers) | Twilio | USA |
| App notifications | Google Firebase Cloud Messaging | USA |
| Error reports (personal data removed before sending) | Sentry | [PLACEHOLDER: data region] |
| Sign in with Google / Apple | Google, Apple | USA |
| Identity verification | [PLACEHOLDER: once chosen] | [PLACEHOLDER] |
| Message translation | [PLACEHOLDER: planned DeepL] | [PLACEHOLDER: processing in the EU planned] |
| Masked calls | [PLACEHOLDER: once chosen] | [PLACEHOLDER] |
| Payments and payouts (outside Turkey) | [PLACEHOLDER: planned Stripe and Wise, with the EU company] | [PLACEHOLDER] |
7. International transfers
Our servers are in the EU (Frankfurt). For transfers from Turkey we use the standard contracts of Turkey's Personal Data Protection Board under Article 9 KVKK and notify the Board of them. For transfers outside the EU/EEA (for example to the USA) we rely on an adequacy decision of the European Commission (such as providers certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses (SCCs), with supplementary measures where needed. You can ask us for a copy of these safeguards.
8. How long we keep data
When you delete your account, the data that names you is erased straight away. The data below stays for a legal reason and is cleaned up by nightly jobs when its period ends. The periods are open to confirmation by our lawyer and accountant.
| Data | Period | Basis | When it ends |
|---|---|---|---|
| Booking, payment, ledger and dispute records | 10 years from the end of the year the booking ended | Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253; in the EU HGB §257 / AO §147 | Address erased, position rounded to about 1 km, meeting note erased; amounts stay |
| Payouts (last 4 digits of the IBAN) | Same as booking records (10 years) | TTK 82, VUK 253 | The IBAN itself goes with the account; the payout item stays |
| Invoices and documents (sales invoice, expense voucher) | 10 years from the end of the year of issue | TTK 82, VUK 253; documents cannot be altered | Kept even if the account is deleted |
| Tax profile (encrypted tax number) | 10 years after the account is anonymised | TTK 82, VUK 253 | Deleted |
| Identity verification result | 5 years after the account is anonymised | Fraud prevention and defence of claims | Deleted |
| Evidence of consent (IP, browser details) | 10 years after the account is anonymised | KVKK 5/2-e, GDPR 17(3)(e); Turkish Code of Obligations Art. 146 | IP and browser details erased; which version of which document was accepted stays |
| Description of a closed posting | 2 years from its last shift | Free text may contain names | Description erased |
| Conversation whose two people are both deleted | 2 years from the later deletion | Window for claims and appeals | Messages, translations and the conversation deleted |
| Originals of messages caught sharing contact details | 180 days | Review period | Original text deleted |
| SMS code records | 1 day | Limiting abuse | Deleted |
| Audit log | 10 years | TTK 82 | Immutable record; separate decision at the end |
ID document and selfie images are kept by the identity verification provider for its own retention period.
9. Deleting your account and downloading your data
- Deletion: you can delete your account from Account. If you have work under way, money still to be settled, an open dispute, an open posting or earnings not yet paid out, or you own a business whose team has other people, these must be finished first; the app tells you why. After deletion, the remaining records are kept as in the table above.
- Download: from Account you can download a copy of your data as a machine-readable (JSON) file (GDPR Art. 20).
10. Security
- Connections are encrypted with TLS.
- Tax numbers and IBANs are encrypted at field level in the database.
- Personal data is masked in logs; names, phone numbers, email addresses, IBANs and locations are not written to logs. Error reports are cleaned of personal data before they are sent.
- Card details never enter our systems.
- The staff panel has a separate sign-in and mandatory two-step verification; every staff action is written to an audit log.
- If there is a data breach, we notify the competent authority within the legal deadline and, where required, you (GDPR Arts. 33–34, KVKK Art. 12).
11. Automated decisions
Search ranking, badges and reliability measures are calculated automatically; the rules are transparent and shown to the worker. Some disputes are settled automatically by clear rules (for example, a refund to the customer when there is no check-in and no location evidence). An automated system never decides to restrict, suspend or close an account: the system only opens a case for review, a person makes the decision with reasons, and you can appeal. You can contest an automated result and ask for human review (GDPR Art. 22, KVKK Art. 11(1)(g)).
12. Children
Crewla is not for anyone under 18. If we learn that someone under 18 has opened an account, we close it.
13. Your rights
Under GDPR Arts. 15–22 and KVKK Art. 11 you have the right to access your data, have it corrected or erased, restrict processing, data portability, object, withdraw consent, and ask for human review of solely automated decisions. You can use many of these in the app yourself; for the others, write to us. We answer free of charge within one month (30 days under KVKK).
You can also complain to a supervisory authority: in Turkey the Personal Data Protection Board; in the EU, the data protection authority of the country where you live or work. For how to apply under KVKK, see the Privacy Notice (KVKK).
14. Changes
When we change this policy we publish a new version; an earlier version is never edited, so the text you accepted always stays the same. We tell you about important changes in the app and ask for your consent again where needed.
15. Contact
[PLACEHOLDER: privacy@crewla.app — once the address is set up]. Post: Nivorbit Teknoloji Limited Şirketi, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale 17100, Türkiye.
This English version is provided for convenience; where the Turkish and English texts differ, the Turkish text prevails.