DRAFT — This text has not been reviewed by legal counsel and is not binding.

KVKK Privacy Notice

Data controller

The data controller's details are not published here yet, and we do not fill the gap with a placeholder. The title, address, trade registry number and registered (KEP) address of the company that will operate SeaTalent are missing from this page. KVKK art. 10 requires this disclosure, so until those details are published this notice is incomplete — which is stated here plainly rather than papered over.

Until they are published:

  • Anything the panel covers, you can do yourself, today. Both downloading a full copy of your data and deleting your account are on the Account page, together with your consent history and your reminder settings. Neither needs anyone's involvement, and both work now.
  • For anything else, the KVKK application form page lists what a request must contain. Be aware that the formal application channel — an e-mail address and a registered address — does not exist yet either, so a request cannot be filed through it today. That page says so too.
  • When the details arrive this section is replaced by them, the version date of this text changes, and the Registrations and permissions page records the change. Both pages are linked in the footer.

What we process

  • Identity and contact: name, e-mail, phone, city of residence.
  • Professional data: position, experience, certificate records, work history, language levels, salary expectation, uploaded CV and documents.
  • Account and usage data: session records, IP address, audit trail (who accessed which profile and when).
  • Certificate number and QR result (optional): the number you enter for a non-medical certificate; and, when you upload a certificate file, the result of reading the QR code printed on it — which recognised authority it points to and, where the code carries a number, whether it matches the number you entered. The code is read on our own servers; its content is not stored, and we do not contact the authority. Medical certificate numbers are never collected. (Draft — to be confirmed by counsel.)
  • Special-category data (health): only the code, date and validity of seafarer medical certificates (e.g. ENG1); processed ONLY with your separate explicit consent, solely for reminders. No health-related information is ever sent by e-mail.

Why we process it

  • Matching seafarers with employers (formation and performance of the contract),
  • Publishing your profile in the candidate pool under a reference code, with your name and contact details hidden until a hire is confirmed by both sides,
  • Running application, contact-request and messaging flows,
  • Certificate expiry reminders (upon your request),
  • Meeting legal obligations and keeping access auditable.

Who we share it with

  • Employers: only upon your own action — when you apply to a listing or accept a contact request. Before that, your professional profile appears in the candidate pool under a reference code — without your name, contact details, photo or uploaded files.
  • Hosting and e-mail infrastructure: platform data may be hosted on servers located abroad (EU region); account e-mails may be delivered via foreign e-mail infrastructure. The legal basis for cross-border transfer (standard contract / Authority notification — to be confirmed by counsel).
  • Certificate numbers: an employer sees a certificate number only after a hire is confirmed by both sides on SeaTalent, next to a link to the issuing authority's official portal so they can check it there. Before that, an employer sees at most that a certificate's QR code points to a recognised authority — never the number, and never a QR code we could not recognise. Authorised SeaTalent staff can also see the number when they review a profile; that access is recorded in the audit trail. Legal basis: establishing and performing the contract (KVKK art. 5/2-c). (Draft — to be confirmed by counsel.)
  • Health data is never shared with any third party.

Retention

For as long as your account is open; when you delete your account, personal data is deleted or anonymised without delay. If your profile stays inactive for 24 months it disappears from the candidate pool, and after 36 months your data is anonymised automatically. Access audit records (who viewed which profile and when) are kept for 24 months. Consent records are retained as proof. Backup copies roll out within six months at the latest.

Your rights (KVKK art. 11)

You may access, correct, delete, port and object. Downloading your data and deleting your account work today, from the panel. The application form page describes the remaining route and its current limits — see Data controller above.

Draft: this text has not been reviewed by legal counsel and carries no version date yet. The Registrations and permissions page tracks the status of that review.

KVKK Privacy Notice · SeaTalent