Data Protection Notice

2. Categories of personal data processed

• Identity: first and last name; and, if you pay online, your Turkish ID number so that we can issue an invoice.
• Contact: email address, phone number, the name of the organisation you work for.
• Customer transaction: the service you request, budget range, message content, and correspondence history.
• Financial: payment amount, currency, proposal/invoice number, and the transaction record. We do not process card numbers, expiry dates, or CVC codes.
• Transaction security: IP address, browser and device information, access and activity logs.
• Professional experience: information contained in your CV, only if you apply for a role.

3. Purposes of processing

• Conducting communication activities and following up requests and complaints.
• Running sales processes for goods and services, and preparing proposals.
• Running finance and accounting operations — collecting payment and issuing the invoice.
• Executing contractual processes and business operations.
• Running information security processes and preventing unauthorised access and misuse.
• Managing job applicant processes.
• Conducting our activities in compliance with applicable legislation.

4. Method of collection and legal grounds

Your personal data is collected by fully or partly automated means through electronic channels such as the contact form on our website, email, telephone, and WhatsApp.

Our processing rests on the following grounds set out in Article 5 of the KVKK: that it is directly related to the conclusion or performance of a contract (Art. 5/2-c), that it is necessary for the data controller to fulfil a legal obligation (Art. 5/2-ç), that the data has been made public by the data subject (Art. 5/2-d), and that processing is necessary for the legitimate interests of the data controller (Art. 5/2-f). Where none of these grounds apply, your data is processed solely on the basis of your explicit consent.

5. Transfer of personal data

Your personal data may be transferred to our hosting and email infrastructure providers, to our security service provider (Google reCAPTCHA), to our payment provider Stripe for online payments, and to competent public authorities where a legal obligation arises, in line with the conditions laid down in Articles 8 and 9 of the KVKK.

Because some of the infrastructure services we use are located abroad, your data may be transferred outside Türkiye. Such transfers are made under the safeguards provided for in Article 9 of the KVKK.

6. Your rights under Article 11 of the KVKK

As a data subject, you may apply to the data controller to exercise the following rights:

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties to whom your data is transferred, in Türkiye or abroad.
• To request correction where the data is incomplete or inaccurate.
• To request erasure or destruction under the conditions set out in Article 7 of the KVKK.
• To request that correction, erasure, and destruction be notified to the third parties to whom the data was transferred.
• To object to a result reached to your detriment through analysis carried out exclusively by automated systems.
• To claim compensation if you suffer loss as a result of unlawful processing.

7. How to submit a request

You may submit requests concerning the rights above by email to hello@kleaworkagency.com, together with information verifying your identity. Your request will be concluded free of charge as soon as possible, and in any event within 30 days.

If the request incurs an additional cost, the fee set out in the tariff determined by the Turkish Personal Data Protection Board may be charged. If your request is refused or you receive no reply within the time limit, you retain the right to lodge a complaint with the Board.