TR Log inPost a project
serbestis / kvkk

Privacy Notice (KVKK)

Last updated: 7 October 2026

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform people who use the Serbest İş platform ("Platform") on serbestis.com and its subdomains (including app.serbestis.com) about how their personal data is processed. In case of any discrepancy, the Turkish version prevails.

1. Data controller

E-veri Bilişim Turizm San. ve Tic. Ltd. Şti. ("Serbest İş"), Küçükbakkalköy Mah. Küçüksetli Sok. No:5-9 D19 Denge Panaroma, 34750 Ataşehir / İstanbul, Türkiye. MERSİS: 0323048983800019, Kozyatağı Tax Office 3230489838, Trade Registry No: 748284. Contact: info@serbestis.com.

2. Personal data we process

  • Identity: name and surname, username.
  • Contact: e-mail address, mobile phone number.
  • Profile (for experts): headline, bio, skills, city, rate range, website, profile photo, the AI agents and tools you use (your own statement); optionally added experience (company, role, dates, description), education, certifications, languages and portfolio links.
  • LinkedIn profile address (for experts): the LinkedIn profile link the expert enters and its verification status (pending / approved / rejected, rejection reason, review date). No data is fetched automatically from LinkedIn; we do not access your LinkedIn account.
  • Transaction data: project posts, stages, proposals, messages, stage delivery/approval/payment statements, reviews, quality control requests.
  • Security: IP address, session and login records, browser information, results of human verification (math question or Cloudflare Turnstile).
  • Site usage records: pages visited and actions taken (e.g. “sent a proposal”; the texts you write and passwords are not recorded), date and time, IP address, approximate country, device and browser type, referring address. Kept for security, troubleshooting and improving the service (statistics), without cookies, for 1 year.
  • If you use Google sign-in: your Google account ID, name and verified e-mail address.

The Platform does not collect card or bank account details; payments are made directly between the parties.

3. Purposes and legal grounds

  • Creating and managing your account, posting projects, sending proposals, messaging and tracking stages — establishment and performance of a contract (KVKK Art. 5/2-c).
  • Showing the client and the selected expert each other's phone and e-mail once a proposal is accepted — performance of a contract (Art. 5/2-c). This information is never shown before acceptance or to any other member.
  • Showing expert profiles in the expert list and search engines if you choose to publish them — performance of a contract (Art. 5/2-c) and your publishing preference.
  • Checking that experts are real people and that their statements are consistent: the LinkedIn profile address you enter is opened in a browser and viewed manually by our team (authorised staff); your name and experience are compared with your serbestis profile and the result (approval, or rejection with a reason) is e-mailed to you. This check is to prevent fake accounts and protect clients — performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f). A verified expert's profile shows a "Verified with LinkedIn" badge and the LinkedIn link; an unverified address is not shown on public pages. If you change or delete the address, the previous verification lapses.
  • Sending notification e-mails (new proposal, acceptance, message, stage status) — performance of a contract (Art. 5/2-c).
  • Contacting you about quality control/consulting if you request it — establishment of a contract (Art. 5/2-c).
  • Preventing fake and automated (bot) sign-ups, account security and abuse detection — legitimate interest (Art. 5/2-f).
  • Fulfilling retention and disclosure obligations under the law (e.g. Law No. 5651) — legal obligation (Art. 5/2-ç).

4. Transfers

Your personal data may be transferred, limited to the purposes above, to:

  • Other members: profile and project information you publish is public; phone and e-mail only to the counterparty whose proposal was accepted.
  • Service providers: hosting (servers in Türkiye, at a data centre in Istanbul), e-mail delivery, domain and security/network services (Cloudflare, Inc. — USA), Google if you use Google sign-in, and AI service providers (automatic translation and the project wizard), limited to the texts described under "AI services" below.
  • Competent authorities: where required by law.

Because service providers such as Cloudflare, Google and AI service providers are located abroad, your data may be transferred abroad. Such transfers are made in accordance with the conditions set out in KVKK Article 9 (adequacy decision, appropriate safeguards or the occasional transfer cases listed in the law).

AI services: To show published project listings in the site's other language (Turkish ↔ English), the Platform uses AI-based automatic translation services; their providers may be located outside Türkiye and the texts listed below may be transferred outside Türkiye. Only the listing text — title, description and stage titles/descriptions — is sent to this service. Your name, phone number, e-mail address, proposals, messages and profile information are not sent. If the client chooses "only models running on the expert's own server" or "no AI", the listing is never translated and any earlier automatic translations are deleted. If you use the project wizard, the idea text you enter is also sent to the same service only to suggest stages; the wizard is only available with the "AI may be used" option. We recommend not writing personal data (name, phone, address, etc.) in the listing text.

About AI agents: The AI tools used by experts are the experts' own responsibility. When posting a project, the client chooses whether AI may be used (allowed / only models running on the expert's own server / no AI), and experts who send proposals must follow this choice. We recommend choosing accordingly before sharing documents that contain personal data.

5. How we collect data

Data is collected electronically through sign-up and profile forms (including the LinkedIn profile address and optional additional profile details, which only you enter), project/proposal/message forms, Google sign-in and automatically while you use the Platform (session and security records).

6. Retention

Data is kept while your membership continues and afterwards for the periods required by law (e.g. the periods in Law No. 5651 for traffic records and general limitation periods for potential disputes), and is then deleted, destroyed or anonymised.

7. Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether it is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request correction if it is incomplete or inaccurate, to request deletion or destruction under KVKK Article 7, to request that these actions be notified to third parties, to object to a result against you arising exclusively from automated analysis, and to claim compensation for damages caused by unlawful processing.

You can send requests from your registered e-mail address to info@serbestis.com or in writing to the address above. Requests are answered within 30 days at the latest.