Data Protection Notice (KVKK)
Under Art. 10 of Turkish Law No. 6698: the data we process, our legal bases, transfers, retention periods, and your rights.
- Effective date:
- 4 August 2026
This document was drawn up in Turkish, and the Turkish text governs. This English version is an unofficial translation provided for convenience.
This is a notice under Art. 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) — it informs you and does not request consent. Optional processing that requires explicit consent is collected through a separate Explicit Consent Text. (Settled practice of the Turkish Data Protection Board: the notice and the consent are separate documents.)
1.Data Controller
UniConnectly is a digital platform. The controller of the personal data processed through this platform is the platform operator that runs it.
- Controller / operator: UniConnectly
- Requests and contact (KVKK): info@uniconnectly.com
2.Personal Data We Process
| Category | Data | Source |
|---|---|---|
| Identity | First name, last name | Your input |
| Contact | Email, phone (optional) | Your input |
| Education | University, faculty, department, year, date of birth (age verification) | Your input |
| Profile / Visual | Avatar, bio, profile links, images you share | Your input |
| Interests & Preferences | The community types / sectors / event interests you select | Your input |
| Platform interaction | Community memberships, event attendance/check-in, your recommendation feedback (like / not interested), messaging | Your usage |
| Transaction security | Last sign-in time, last sign-in IP address (IPv4) and device information, device time zone | Automatic |
IP address (limited, security-purpose processing): For the security of your account (new-device/suspicious-sign-in warnings and showing your last sign-in on the profile "Security" card), your sign-in IP address is held only in the sign-in security records (user_login_events); it is limited to the last 20 sign-ins per profile and 180 days at most, after which it is deleted automatically. We do not process IP addresses for marketing or analytics.
What we do not process (data minimisation): We do not collect CVs/résumés. We do not keep full device fingerprints, and we use no marketing tracking pixels or session recording.
3.Purposes and Legal Bases (KVKK Art. 5)
a) Performance of a contract (Art. 5/2-c) — the very service you request by joining:
- Account creation, profile and education-information management
- Community membership, event organisation, check-in and attendance records
- In-community messaging, announcement/content publishing
- Job/internship listing discovery (referral plus click statistics only; no CV collection)
b) Legitimate interest (Art. 5/2-f):
- Platform security, prevention of abuse and fraud
- Personalised recommendations: to suggest suitable communities, events, and opportunities, we assess your interests, your education information, and your in-app interactions. These recommendations are informational in nature; they are not fully automated decisions producing legal effects concerning you. You have the right to turn them off and to object (see Art. 6).
c) Explicit consent (Art. 5/1-a) — only the optional processing below, collected through a separate Explicit Consent Text, OFF by default, withdrawable at any time:
- Marketing/announcement communication (email/notification)
- Usage analytics (off by default)
- Career discovery / audience sharing: with your explicit consent, relevant companies may discover you only through the communities you belong to, in aggregate (groups of at least 5), and without your personal information being shared. Your individual identity, contact details, and recommendation preferences are never shared with companies. You can switch this sharing off at any time.
Note: feedback such as like / not interested is used solely to give you better recommendations; it is never shared with third parties.
4.Transfer of Data (KVKK Art. 8-9)
To deliver the service we work with the following data processors under contract (DPA):
| Processor | Purpose | Location | Status |
|---|---|---|---|
| Supabase | Database, authentication, storage | EU (Frankfurt/Germany) | Active |
| Cloudflare R2 | File storage + content delivery (CDN) | Global edge | Active |
| Resend | Transactional email delivery (verification, password reset, account notifications) | EU (Ireland) | Active |
| Cloudflare Email Routing | Delivering the emails you send us (info@uniconnectly.com) | Global edge | Active |
| Google Firebase Cloud Messaging | Push notification delivery — device notification token | USA | Active |
| Analytics / error monitoring | Measurement, debugging | — | Planned (not yet active) |
Transfer abroad (Art. 9): Because of the hosting infrastructure, your data is processed on European Union servers (Germany, Ireland). For push notification delivery, your device notification token is transferred to Google Firebase Cloud Messaging infrastructure located in the USA; that token does not identify you on its own and is used only to deliver notifications. These transfers rely on the appropriate safeguards set out in Art. 9 of the KVKK.
5.Retention Periods
| Data | Period |
|---|---|
| Active account data | For as long as the account is active |
| Account deletion | The request is processed immediately: your profile, your content and the files you uploaded are erased irreversibly. There is no waiting or undo window |
Consent records (user_consents, user_legal_acceptances) | Because of the burden of proof, 10 years after account deletion (general limitation period), then destruction. These records do not hold your identity directly; an irreversibly hashed reference (subject_hash) is stored instead |
Sign-in security records (user_login_events — sign-in IP/device) | The last 20 sign-ins per profile plus 180 days at most; then automatic destruction |
Audit records (audit_logs) | For the duration of the legal obligation |
6.Your Rights (KVKK Art. 11)
In the app or via info@uniconnectly.com you may exercise these rights: learning whether your data is processed, requesting information, learning whether it is used in line with its purpose, knowing the parties it is transferred to, rectification, erasure/destruction, requesting it in a portable format (data download), objecting to processing (including turning off recommendations/profiling), and complaining to the Board.
Response time: account deletion carried out from within the app happens immediately; you do not need to wait. For requests sent by e-mail the legal maximum is 30 days — our aim is to resolve them well before that.
7.Data of Minors
UniConnectly is a university student platform and does not accept users under 16. Date of birth is collected at sign-up; applications from under-16s are blocked.
Minor users aged 16-18: sign-up requires a declaration of parental/guardian approval. For their protection, these users are automatically exempt from commercial access/audience sharing towards companies (career discovery) and from marketing communication; they benefit only from core platform services and non-commercial recommendations. Once the user turns 18, such processing becomes active only with their own explicit consent.
8.Contact and Complaints
- Requests: info@uniconnectly.com
- Authority: Turkish Personal Data Protection Authority — www.kvkk.gov.tr
When we make a significant change to this notice we will inform you in the app. Previous versions are shared on request at info@uniconnectly.com.
Have a question?
Write to us about data protection requests, data subject rights, and questions on these agreements. The legal maximum response time is 30 days; our target is much shorter.
info@uniconnectly.com