Privacy Policy and Privacy Notice (KVKK)

Your personal data will be processed within the scope described in this text by GlobalAds OÜ, the operator of the platform (“Platform” / “masoz.app”), as data controller. GlobalAds OÜ is responsible, as data controller, for all data processing activities related to the Platform.

• Data controller: GlobalAds OÜ

• Address: Viru väljak 2, 10111 Tallinn, Estonia

• Contact: destek@masoz.app

The method you can use to submit your requests is described in the “Applications and Contact” section of this text.

Given the nature of its services, the Platform collects the following personal data, either directly from you through electronic forms or automatically while the website is used:

• User (Massage Therapist) Data: First name, last name, email address, phone number (which may belong to Turkey or to another country), profile photo, service descriptions, working hours, district served, price information, gender, years of professional experience, certificate declaration and foreign languages known. The information on a profile page (e.g. profile name, photo, business phone and WhatsApp number, district, service description, price information) is open to everyone who visits the Platform; the first and last name and email address on your account registration are not published on the profile.

• Profile Description Translations: The Platform may produce translated versions of the description on your profile in other languages (e.g. English, Russian and Arabic). The translations are produced automatically, stored together with your description and published on the Platform with an “automatic translation” label. Only the text of the description is used for translation; your name, phone number, photos and other profile information are not sent to the translation service.

• Writing Assistance (“Write for me”) Data: When you press the “Write for me” button while preparing your profile, the information you selected (massage types, service location, years of experience, languages known, districts served, certificate and education status, gender and free-form keywords of up to 200 characters) is sent to the artificial intelligence service provider abroad in order to produce a draft description. Nothing is sent unless you press the button. Your name, phone number, email address, photos and address are not sent; if the free-form keywords contain contact information, it is masked before sending. You add the draft that is produced to your profile yourself. The Platform stores only your usage count (daily and total allowance); the information sent and the text produced are not stored separately.

• Identity Verification (KYC) Data: For optional identity verification, the front and back of a Turkish ID card, passport or residence permit (a driver's license is not accepted because the blood group on it is special category health data). These documents are collected on the basis of your explicit consent and are stored with AES-256-GCM encryption. The documents are not deleted by any automated process; they are deleted only one by one by an authorized administrator (see the section “Retention Periods and Destruction of Personal Data” for details).

• Visitor Data: The Internet Protocol (IP) address (for security and rate limiting against overload, depending on the retention periods in this text), cookies that keep the session going and secure sign-in, a cookie that remembers your language choice in the panel and on the sign-in pages, a cookie that remembers your decision about analytics cookies, and a browser record showing that the visitor has confirmed being over 18 (not a cookie; it is kept in the browser's local storage; see the Cookie Policy section for details).

• Previously Collected Pre-Application Data: The full name, additional phone number, date of birth, province and district, certificate information, work preference, experience information, introduction text and uploaded photos previously collected on the optional pre-application form, which Users could fill in while their account was awaiting approval and which is now closed. This information is not published on the profile and is visible only to authorized administrators; the photos are stored encrypted.

• Introduction Call Record: The status (done, could not be reached or not done) and date of the short introduction call our team makes with you over WhatsApp after your account is approved, and the short note our team takes during the call. This record is visible only to authorized administrators and is not published on the profile. Because the call takes place on the WhatsApp application you use, this communication is also subject to that application's own terms and privacy policy.

• Report Data: The full name, mobile phone number and email address of the person who fills in the report form, the reason for and description of the report, the related profile information if any; also the IP address and browser information. The time of the information notice confirmation on the form and the version of the text at the time of confirmation are also recorded.

• Survey Data: The full name and email address of the person who fills in the survey, optional province/district and phone information, experience comment and suggestion; also the IP address and browser information. The time of the information notice confirmation on the form and the version of the text at the time of confirmation are also recorded.

• Support Correspondence: The support messages you send us from the panel, the replies we give and the announcements our team sends to your account.

• Security and Audit Records: Failed sign-in attempts (including the email address entered and the IP address in attempts made with an unregistered email address), the IP address of your account at registration and at last sign-in, account actions (registration, email verification, password change, profile submission, identity document upload, support request) and administrator actions.

• Traffic Records (Law No. 5651): As a hosting provider, the Platform records the traffic information of the account and profile actions of Users, who are content providers, and of administrators: who (account type and number), what (short action code), from where (full IP address and browser information), which page path and when. Content such as messages, passwords, documents, names, email addresses and phone numbers is not written to these records.

• Consent Records: The time of confirmations and withdrawals of the privacy notice, terms of use, pre-application terms, transfer abroad, identity document processing and commercial electronic message consents, the version of the text at the time of consent and the IP address.

• Block List: The email address and phone number of a User whose account has been banned or deleted are stored as an irreversible keyed digest (hash); the purpose is to prevent a new account from being opened with the same details (Single Entry Rule). The digest is deleted 10 years after the account is banned or deleted. Raw email and phone numbers are not kept in this list; phone numbers also appear in plain form in the “Phone Number History” record below.

• Phone Number History: The phone number you gave in your account registration and the business phone and WhatsApp number on your profile are recorded together with the first and last dates the number was used, the profile name you were using at the time (for the registration phone, an abbreviated form of your name) and the final status of the account (active, deleted or banned). Unlike the block list, the phone number is kept in plain form in this record and the record is visible only to authorized administrators. The purpose is to prevent the Single Entry Rule and the Platform rules from being circumvented by opening a new account with the same numbers. When the same number is used on another account, administrators are informed; this information does not by itself result in a block or a decision, and the situation is reviewed by an administrator. This record is kept for five (5) years from the deletion or banning of your account; at the end of that period the phone number, name and date details are deleted and only the irreversible digest in the block list remains (see the section “Retention Periods and Destruction of Personal Data”).

• Registration Funnel Measurement: A measurement record that counts which step new Users have reached on the path of registration and profile preparation: a short event code (e.g. registered, verified email, completed a profile step), the step name, the account number and your panel language. Your IP address, browser information, name, email, phone or the text you write are not written to this record. The purpose is to see where users get stuck in the registration process and to improve the process.

• Aggregate Usage Statistics: To measure and improve service quality, the Platform records usage events such as profile views, searches and clicks as aggregate statistics that do not identify any person (e.g. how many times a profile was viewed in a day). These records contain no IP address, name, email, cookie or any other information that could directly identify a Visitor. For counting unique visitors, the IP address and browser information are irreversibly summarized (hashed) with a key that changes every day; the IP address itself is not written to the measurement records (it is kept only temporarily, for at most 24 hours, in the rate-limit counter to protect the measurement endpoint from overload, and then deleted) and the resulting digest cannot be matched across days. The measurement records are deleted automatically after 30 days.

• Analytics Cookie Data (only if you consent): If you choose “Accept” in the cookie consent bar, the Google Analytics and Yandex Metrica analytics services place cookies in your browser so that we can see how the site is used through statistics that do not directly identify you, and they process the following information: a randomly generated browser identifier, the address and title of the pages you visit, the time you spend on a page and the links you click, the address of the page you came from, the type of device, browser and operating system, screen size and language. Your IP address is passed to these services and is used to determine an approximate location (city or country). Your name, email address, phone number and the information you type into forms are not sent to these services; advertising signals and the visit recording (screen recording) feature are switched off. If you choose “Reject” or do not decide, these services are not loaded at all (see the Cookie Policy section for details).

Your personal data is processed for the following purposes, within the personal data processing conditions set out in Articles 5 and 6 of the KVKK and Article 6 of the GDPR:

• Service Provision: Creating and publishing User profiles and giving Visitors access to these profiles.

• Profile Translation and Writing Assistance: Publishing your profile description in other languages as well, so that Visitors who search in other languages can reach your profile; and, if you wish, helping you prepare your description.

• Communication: Establishing communication between Users and Platform management and enabling Visitors to contact Users directly (through channels outside the Platform).

• Application Management and Information: Evaluating account and profile applications, holding an introduction call with you during the application process, and sending service notifications and reminders about the status of your application and the preparation of your profile, and service announcements about your account, your profile and the operation of the Platform.

• Security and Verification: Ensuring the security of the Platform, preventing fake profiles and verifying the identity of Users (KYC process).

• Legal Obligations: Keeping traffic records under Law No. 5651, fulfilling obligations arising from tax and accounting legislation and responding to requests that may come from authorized public bodies and institutions.

• Report and Complaint Management: Reviewing and verifying reports and remedying rule violations.

• Feedback: Evaluating survey responses and improving the Platform.

• Statistics and Improvement: Producing aggregate usage statistics that do not identify any person, and registration funnel measurement, to measure service quality and improve the Platform.

• Measuring Site Use (only if you consent): If you consent to analytics cookies, using Google Analytics and Yandex Metrica to see through anonymous statistics which pages are visited how often and how the site is used, and improving the site on the basis of this information.

• Operating the Platform and Continuity: Making the website work technically, managing sessions, applying the age confirmation rule, preventing blocked identities and phone numbers from being used to open a new registration (including the phone number history), and protecting data against possible loss by backing it up.

Your personal data is processed on the following legal grounds. For each ground, the KVKK and GDPR equivalents are given together. The “I have read the Privacy Notice” box on the registration form only confirms that you have been informed by this text; it is not a declaration of consent, and the processing of your personal data is based not on this box but on the legal grounds below.

• It is directly related to the establishment or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b): User registration, evaluation of the application, the introduction call, service notifications, service announcements and profile creation processes are the establishment and performance of the Terms of Use.

• Translation and publication of the profile description (KVKK Art. 5/2-c; GDPR Art. 6/1-b): Translating your description into other languages and publishing the translations on the Platform is directly related to the performance of the contract, as part of the service of publishing your profile. A transfer abroad that may be made for this purpose is not based on explicit consent; the safeguards for the transfer are described in the section “Transfer of Personal Data”. You keep the right to object to the translation: if you write to destek@masoz.app, the translation is removed.

• Writing assistance (KVKK Art. 5/2-c; GDPR Art. 6/1-b): Sending the information you selected, when you press the “Write for me” button, to the artificial intelligence provider abroad that provides the writing assistance service is necessary to provide this feature that you requested and is directly related to the performance of the contract.

• It is mandatory for the data controller to fulfil its legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c): Traffic records under Law No. 5651, record-keeping obligations arising from tax and accounting legislation and responding to the lawful requests of authorized public bodies and institutions fall within this scope.

• Processing is mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f; GDPR Art. 6/1-f): Processing technical data such as the IP address to ensure the security of the Platform, prevent fraud and maintain service quality; aggregate usage statistics that do not identify any person and registration funnel measurement; and backing up data. For the same reason, block list digests and the phone number history are kept to prevent the Single Entry Rule and the Platform rules from being circumvented; your rights and freedoms are also taken into account in these processing activities.

• Explicit Consent (KVKK Art. 5/1; GDPR Art. 6/1-a): Identity verification (KYC) is a completely optional service, and the identity document data you upload is processed only on the basis of the explicit consent you give during registration and/or at the document upload step; you can withdraw this consent at any time. The consent to transfer abroad that is additionally requested during registration is obtained as a further safeguard on top of the appropriate safeguards, as described in the section “Transfer of Personal Data”.

• Survey and report forms (KVKK Art. 5/1; GDPR Art. 6/1-a): The information given in these forms is processed on the basis of the explicit consent given through the separate checkbox on the form.

• Commercial electronic messages (Law No. 6563; KVKK Art. 5/1; GDPR Art. 6/1-a): Messages with campaign and advertising content are sent only on the basis of the consent given separately and optionally at registration or later on the Settings page of the panel; this consent can be withdrawn at any time. Service announcements are not commercial messages and rely on the contract ground above.

• Analytics cookies (KVKK Art. 5/1; GDPR Art. 6/1-a): Google Analytics and Yandex Metrica analytics cookies and the usage data collected with them are processed only on the basis of the explicit consent you give with the “Accept” option in the cookie consent bar. Not giving consent does not prevent you from using the site; you can withdraw your consent at any time with the “Cookie preferences” link in the footer of every page. The cookie that remembers your decision is necessary to apply this choice.

In processing that relies on consent, withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal.

Your personal data is never shared with third parties for marketing or advertising purposes. Your data is transferred only to domestic and foreign technology providers from which we receive services as data processors, solely to operate the technical infrastructure of the Platform and, if you consent, to measure site use.

• Domestic Transfer: Your data is not shared with third parties in Turkey unless there is a legal obligation or it is requested by the competent authorities.

• Transfer Abroad and Recipient Groups: Because the operator of the Platform is established in Estonia, the data of persons in Turkey is transferred to the data controller in Estonia. In addition, only the data required by the service is transferred to the following recipient groups: (1) service providers located mainly within the European Union (EU) region for hosting, database (Ireland) and file storage services; (2) email delivery, content delivery network (CDN), backup and artificial intelligence (translation and writing assistance) service providers abroad, including in the United States; (3) only if you consent to analytics cookies, analytics service providers abroad, including in the United States and the Russian Federation (Google Analytics and Yandex Metrica). Your email address and the related communication content go to the email delivery service, backups go to the backup service, and the texts needed for translation and writing assistance go to the artificial intelligence service. The current list of service providers is shared with you if requested within the scope of your right of application.

• Legal Basis of the Transfer: The main basis of transfers abroad is the appropriate safeguards under KVKK Art. 9 (standard contractual clauses); transfers within the EU are protected under the GDPR. For recipients in the United States, the EU Standard Contractual Clauses or the EU-US Data Privacy Framework are relied on. The explicit consent to transfer abroad that is separately obtained from you at registration is an additional safeguard on top of these safeguards and is meant for incidental transfers; the transfer is not based on this consent alone.

• Translation of the Profile Description (Transfer Abroad): The description on your profile may be transferred to service providers abroad in order to be translated into other languages. The recipient group is the artificial intelligence service providers abroad that provide translation services as data processors. Only the text of the description is sent; your name, phone number, photos and account details are not sent, and if the text contains contact information such as a phone number, email or address, that information is masked before it is sent. The purpose of the transfer is to translate the text and its legal basis is KVKK Art. 5/2-c (performance of a contract). This transfer is not based on explicit consent; it is safeguarded by the appropriate safeguards described above (standard contractual clauses). The providers are asked to use the text sent only to produce the translation. To see the translations, to ask for a translation you find incorrect to be corrected or to object to the translation, you can write to destek@masoz.app.

• Transfer for Writing Assistance (Transfer Abroad): When you press the “Write for me” button, the information you selected is sent to the artificial intelligence service provider abroad so that it produces the draft text. Your name, phone number and email address are not sent. The legal basis of the transfer is KVKK Art. 5/2-c (performance of a contract); it is safeguarded by the appropriate safeguards described above.

• Transfer to Analytics Services (Transfer Abroad): If you consent to analytics cookies, the data collected to measure site use (random browser identifier, pages visited, device and browser information, IP address) is transferred to Google for the Google Analytics service (abroad, including the United States) and to Yandex for the Yandex Metrica service (abroad, including the Russian Federation). Your name, email address and phone number are not sent. The main basis of the transfer is the appropriate safeguards described above (standard contractual clauses; for the recipient in the United States, the EU Standard Contractual Clauses or the EU-US Data Privacy Framework). The explicit consent you give in the cookie consent bar also covers this transfer; where appropriate safeguards cannot be ensured, the transfer is based on this explicit consent (KVKK Art. 9/6-a), and the recipient country may not offer the same level of protection as Turkey. If you do not consent or withdraw your consent, no new data is transferred to these services.

The Platform takes the most up-to-date and adequate technical and administrative measures to prevent your personal data from being processed or accessed unlawfully and to ensure its safekeeping. These measures include:

• All data traffic is encrypted with HTTPS (TLS 1.2+).
• User passwords are stored irreversibly hashed with the bcrypt algorithm (cost factor 12).
• Identity (KYC) documents are encrypted with AES-256-GCM envelope encryption, using a separate key for each file, and unauthorized access to and deletion of these documents is prevented.
• Measures such as account locking against failed sign-in attempts (15 minutes after 5 attempts) and rate limiting are applied.
• The automatic sign-in ticket that lets you sign in after email verification without typing your password again is stored only as a digest (hash), is valid for 10 minutes and can be used only once.
• Backups are taken in encrypted form.
• Access to the administrator panel is restricted by role-based authorization (super_admin, moderator, support) and all critical administrator actions are recorded in an audit log.

The Platform uses strictly necessary and functional cookies to run the basic functions of the site; because they are needed for the site to provide the service you request, they do not depend on consent. In addition, only if you consent, analytics cookies (Google Analytics and Yandex Metrica) that collect anonymous usage statistics to improve the site are used. Marketing and advertising cookies are not used.

On your first visit to the site, a cookie consent bar appears at the bottom of the page; the “Accept” and “Reject” options are presented in the same way. If you do not decide or choose “Reject”, no analytics cookies are set and the analytics services are not loaded at all. You can change your decision or withdraw your consent at any time with the “Cookie preferences” link in the footer of every page; when you withdraw your consent, the analytics services stop and the analytics cookies on this site's domain are deleted.

The cookies and browser records used are as follows:

• Session Cookie: Used to keep Users' sessions open securely; it is valid for 7 days.
• Sign-In Security Cookies: A cookie that protects the sign-in form against forged requests (csrf) and a cookie that remembers which page to return to after sign-in (callback-url). Both are technical cookies used only in the sign-in flow and contain no personal data.
• Language Preference Cookie: A cookie (masoz_dil) that only remembers the language of the panel and of the sign-in and registration pages: it is set to the language of the page you came from, or to the language you select there. On public pages the language is chosen through the address, and these pages do not set this cookie. It is valid for 1 year and contains no personal data.
• Age Confirmation Record: The visitor's +18 confirmation is not kept as a cookie but in the visitor's own browser local storage (localStorage); it is remembered for about 30 days, and this period starts again each time the visitor confirms again. The date of the first confirmation is also kept in the browser until the browser data is cleared. None of these records is sent to the server.
• Panel Hint Record: A simple marker (masoz_panel) placed in the browser's local storage (localStorage) when a User signs in. It is used to show the panel link in the site footer, contains no personal data, is not sent to the server and is deleted on sign-out.
• Profile Draft Backup: A temporary copy, on this device, of the text fields you write while preparing your profile (the browser's local storage). It is not sent to the server, copies older than 7 days are not used, and it is deleted when the profile is saved successfully.
• Password Reset Temporary Record: To carry the email address you type on the sign-in page over to the password reset page, it is kept only in the temporary memory of that tab (sessionStorage), is not sent to the server and is deleted after the email is requested or when the tab is closed.
• Measurement Repeat Guard: A short marker kept in the temporary memory of the tab (sessionStorage) so that the same event (e.g. the view of the same profile) is not counted again and again during a session; it is not sent to the server and is deleted when the tab is closed.
• Cookie Preference Cookie: A cookie (masoz_cerez_onay) that remembers your decision about analytics cookies: it holds the value “analitik” (consent given) or “red” (rejected). It is necessary to apply your decision, contains no personal data and is valid for 180 days; when the period ends, you are asked again.
• Google Analytics Cookies (only if you consent): _ga and a second cookie starting with _ga_. They distinguish your browser with a random identifier in order to count visits and page views; they are valid for at most 2 years. Advertising signals and ad personalization are switched off. The analytics data collected is kept in Google Analytics for 2 months and then deleted.
• Yandex Metrica Cookies (only if you consent): _ym_uid and _ym_d (they distinguish your browser with a random identifier and keep the date of your first visit; valid for 1 year) and _ym_isad (determines whether the browser has an ad blocker; valid for 2 days). Metrica may also write records starting with _ym to the browser's local storage (localStorage). The visit recording (screen recording) feature is switched off; in-page clicks and link clicks are measured as anonymous statistics.

Analytics service providers may also use cookies on their own domains, subject to their own privacy policies. You can also delete or block cookies in your browser settings; if you block strictly necessary cookies, some functions such as sign-in may not work.

Your personal data is kept for as long as the purposes of processing require and in accordance with the schedule below; at the end of the period it is deleted, destroyed or anonymized:

• Profile description translations: Kept for the same periods as your description; when your description changes, the translations are produced again, and when the account is deleted, the translations are deleted together with the profile.

• Account and profile data: Kept as long as the account is active. When the account is deleted, the account, profile, membership and support records are deleted; the records specified separately below are outside this scope.

• Payment records: The Platform does not currently take payments from members. When payments start to be taken, payment records are kept for the period set by the relevant tax and accounting legislation (up to 10 years). When the account is deleted, the payment record is not deleted; its link to the account is cut and the record is kept until the end of that period.

• Accounts that do not verify their email: If the email is not verified within about 30 days of registration and there is no profile linked to the account, the account is deleted automatically.

• Identity verification (KYC) documents: Kept encrypted on the basis of explicit consent; they are not deleted by any automated process and are deleted only one by one by an authorized administrator. When the account is deleted, the link between the documents and the account is cut and the file name given by the person who uploaded the document is deleted; the documents are kept in the archive only against possible legal disputes. Because the document image itself contains identity information, it remains personal data even though its link to the account is cut. Withdrawal of consent is requested through the channel in the “Applications and Contact” section of this text; unless there is another legal ground requiring retention, the documents are destroyed.

• Previously collected pre-application information and photos: Kept as long as the account is active. When the account is deleted, the information is deleted together with the account. The uploaded photos are kept in encrypted storage and are not deleted automatically; when the account is deleted, their link to the account is cut and they continue to be kept until they are deleted one by one by an authorized administrator.

• Consent records (privacy notice/terms/transfer abroad/identity document/commercial message): They are kept for proof of the consent and its withdrawal during membership and for 10 years (the general limitation period) after membership ends. Even if the account is deleted, these event records remain in a separate log with the account number, consent type, text version and time; they are deleted automatically 10 years after the account is deleted. The IP address belonging to the event is deleted after 180 days (it is shortened and masked when the account is deleted).

• Block list digests: The email and phone digests of a User whose account has been banned or deleted are kept for 10 years from the banning or deletion of the account so that the Single Entry Rule can work; at the end of the period the digests are also deleted and the person can register again. The email or phone cannot be recovered from the digest.

• Phone number history: Kept even if the account is deleted or banned, so that the Single Entry Rule can work. This record is kept for five (5) years from the deletion or banning of the account; at the end of the period the phone number, name and date details are deleted and only the irreversible digest in the block list remains (which is itself deleted at the end of the 10-year period above). The record contains the phone number in plain form, the dates, the profile name (for the registration phone, an abbreviated form of the name) and the final status of the account; its link to the account and profile is cut. Only authorized administrators see it. Deletion requests concerning these records are answered by assessing whether the reason for keeping the record still continues.

• Introduction call record and reminder records: Kept as long as the account is active; when the account is deleted, they are deleted together with it.

• Security and audit records (including IP address and email): Deleted automatically after 180 days. The IP address at registration and at last sign-in in the account record, the IP address in consent events, the IP address and browser information in report and survey records, and the administrator IP address in the identity document review log are also deleted after 180 days; the records themselves stay according to their own retention periods.

• Traffic records (Law No. 5651): Kept for 365 days (1 year) and deleted automatically when the period ends. Because of the legal retention obligation, they are not deleted when the account is deleted until this period expires.

• Rate-limit counters (IP address): For the duration of the counter window, at most 24 hours; then deleted.

• Aggregate usage statistics: Deleted automatically after 30 days.

• Registration funnel measurement: Deleted automatically after 365 days. Apart from the account number, the record contains no information that identifies you.

• “Write for me” usage counter: Kept as long as the account is active; deleted when the account is deleted. The information sent and the text produced are not stored on the Platform.

• Automatic sign-in ticket: Valid for 10 minutes and deleted on first use; unused tickets become invalid when they expire and are cleaned up in later operations.

• Support and communication records: Kept as long as the account is active; when the account is deleted, they are deleted together with it.

• Survey answers: Kept for at most 2 years from the date received; deleted automatically when the period ends.

• Report records: A report that has been concluded (action taken or closed) is kept for 2 years from the date it was concluded and is deleted automatically when the period ends; a report that has not been concluded (new or under review) is not deleted. The IP address and browser information of the person who made the report are deleted after 180 days.

• Backups: The encrypted nightly backup of the database and files is kept for 14 days in cloud storage abroad; in addition, the daily backup of the hosting service provider is kept for about 7 days. Deleted data also drops out of the backups within these periods at the latest.

• Cookies and analytics data: The retention periods of cookies are stated in the Cookie Policy section. If you consent, the analytics data collected is kept for 2 months in Google Analytics and, in Yandex Metrica, for the period set out in the provider's terms of service; when you withdraw your consent, no new data is collected.

Data whose period has expired is deleted by daily automatic cleanup jobs; copies in the backups drop out within the backup period stated above.

Service announcements (not commercial messages): Service announcements about your account, your profile and the operation of the Platform (changes to rules and terms, maintenance, security, profile reminders, information about new features) are sent by email. These are not commercial electronic messages; they are sent as part of the performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) and independently of commercial message consent.

Your account continues to receive service notifications about how the application and membership process works, regardless of consent. These notifications are: email verification (including the final reminder sent before an unverified account is deleted), information that the application was received and concluded, security notifications, support correspondence, information about the membership period, platform announcements such as maintenance and rule changes, and profile preparation reminders sent to accounts that have been approved but have not yet submitted their profile for review.

Profile preparation reminders relate only to the application process, contain no promotion or campaign, and at most three are sent to an account. Which reminder was sent and your choice to stop them are recorded. With the “Stop reminders” link in the email these reminders are stopped with one click; your account and application are not affected.

Platform announcements may be sent as service notifications to active accounts that have been published before, have no profile and are awaiting approval. If an announcement contains promotion or campaign content, it is sent only to accounts that have given commercial electronic message consent, and the email contains a one-click opt-out link.

Promotional messages (commercial electronic messages): Commercial electronic messages with campaign and advertising content are sent, under Law No. 6563 on the Regulation of Electronic Commerce, only if you have given separate prior consent. This consent is optional and is not a condition of membership; it is offered as a separate choice on the registration form and can also be given later on the Settings page of the panel. The Platform does not currently send emails with promotional content.

The consent can be withdrawn free of charge at any time, using the switch on the Settings page of the panel, the one-click opt-out link in promotional messages or destek@masoz.app. Consent and opt-out records are kept together with the text version.

Under Article 11 of the KVKK, as a data subject you have the following rights:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• To know the third parties, in Turkey or abroad, to whom your personal data is transferred,
• To request correction if your personal data has been processed incompletely or incorrectly,
• To request deletion or destruction of your personal data within the conditions set out in Article 7 of the KVKK,
• To request that the correction, deletion or destruction be notified to third parties to whom your personal data has been transferred,
• To object to a result against you arising from the analysis of your processed data exclusively through automated systems,
• To request compensation for damage if you suffer damage because your personal data has been processed unlawfully.

Under the GDPR, in addition to and together with the rights above, you have the following rights (GDPR Articles 15 to 22):

• To access your personal data and obtain a copy of it (Art. 15),
• To ask for incomplete or incorrect data to be corrected (Art. 16),
• To ask for your data to be erased (Art. 17),
• To ask for the processing of data to be restricted (Art. 18),
• To receive the data you provided that is processed by automated means on the basis of a contract or consent in a structured, commonly used format and to transmit it to another data controller (Art. 20),
• To object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21),
• Not to be subject to a decision based solely on automated processing that produces legal effects concerning you (Art. 22). Approval of your application, publication of your profile and sanctions against your account are decided by administrator review; the automatic account lock applied for sign-in security is temporary,
• To withdraw your consent at any time in processing that relies on consent (Art. 7/3).

To exercise these rights, you can follow the method in the “Applications and Contact” section. Your right to complain: If you believe that the processing of your data violates the GDPR, you can apply to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the competent supervisory authority in the country where you live, work or believe the infringement took place. Persons in Turkey can lodge a complaint with the Personal Data Protection Board.

To exercise your rights under this text and under the law, you can submit your requests by writing to destek@masoz.app from the email address registered on your account (or the one you wrote on the relevant form). To verify your identity, the request is expected to be written from this address; if necessary, we may ask for additional verification information. Requests for the deletion of your account and profile, or for their removal from publication, are also submitted through the same address.

Your application must include your first and last name, the subject of the request and information through which we can reach you. If other information required under the Communiqué on the Procedures and Principles of Application to the Data Controller (Turkish ID number, for foreigners nationality and passport number, address for notification) is missing, we may ask you to complete it so that we can conclude your application. Your application will be concluded free of charge as soon as possible, depending on its nature, and within thirty (30) days at the latest.

If you find the answer given to your application insufficient, do not receive an answer in time or your application is rejected, you reserve the right to complain to the Personal Data Protection Board within thirty (30) days from the date you learn of the answer and in any case within sixty (60) days from the date of application. For your right to complain under the GDPR, see the section “Your Rights Under the EU General Data Protection Regulation (GDPR)” above.