KVKK Privacy Notice

İlandan Önce is a service of Bumba Teknoloji Limited Şirketi (Ataşehir, Istanbul). Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is Bumba Teknoloji Limited Şirketi. You can send your questions and any applications under the Law to bilgi@bumbagroup.com.

We process the following data to provide membership and run the service.

• Identity and contact: full name, email address, and optionally phone number and city.
• Membership: membership status, start and end dates.
• Career data: the CV you upload, your workplace records, the notes in your logbook, the records you enter in the organisation analysis, and the supporting documents you upload.
• Sending data: whom you wrote to, when, and which message; reply and bounce information.
• Email account authorisation: if you connect your Google or Microsoft account, the permission to send email on your behalf and the connected address.
• Technical: session, language and theme preference cookies, IP address and browser information (only for security and consent records). The list of cookies is in the Privacy Policy.

We process identity, contact and membership data to establish and perform the membership contract. Career data and sending data are processed on the basis of your explicit consent so that the service can be provided to you.

We keep security logs under our legal obligations and legitimate interest. To prevent abuse, we monitor sending volumes and bounce rates.

The logbook and organisation analysis areas belong to you alone. No other member can see the records and documents in these areas, and neither can administrators. This is how it is built technically: every record is tied to your account and, at database level, only you can access it. The content of these areas is not sent to any AI provider.

If you enter your colleagues' names, job titles, departments and similar information, or an organisation chart or announcement image, into these areas, you are processing the personal data of third parties rather than your own. For that content you are the data controller; we act only as the party providing storage on your instructions.

It is therefore your responsibility to rely on one of the legal grounds in Article 5 of the Law, and to act in a way that is limited to the purpose and proportionate. Do not enter special categories of personal data, such as health, religion or trade union membership, into these areas. You can delete your records at any time, and when you delete your account, all of them are permanently deleted.

The company directory contains each company's name, sector, city, official website and careers page, and corporate contact addresses. The directory also contains a limited set of data about people who work at these companies. This data set is not limited to managers; it may cover employees in every department of the company.

People data is compiled from public sources, using automated tools and search engine queries. These sources are: the companies' and their groups' own websites; public pages such as press articles, industry event pages and lists published by institutions; and the titles of people's LinkedIn profiles as they appear in search engine results ("Name Surname - Title - Company"). LinkedIn data is read only from the search engine's results page; no requests are sent to linkedin.com and no profile pages are opened. When our automated tool opens a page, it follows that site's robots.txt rules.

For each person in the directory, we keep the following data:

• First name and surname.
• Job title at the company, plus the department and level derived from the title by rule. If the source has no job title, these fields stay empty.
• A link to the page the information came from and, where available, the person's public LinkedIn profile link.
• Work email address. If the company has published the address itself, the published address is kept. If not, an estimated address on the company's domain, derived from the first name and surname, is kept. No estimated address is derived for board members.
• The status of the address (estimated, verified or bounced) and the number of bounces and replies to messages sent to it.
• For people added by a member through the contribution form: the job title, department, work email address and phone number the member entered.

This data is processed so that members can write a job application from their own email address to the relevant person at a company. People data is shown only to members and to users who gain access through contributions; visitors who are not members cannot see it. The data is hosted with the infrastructure providers listed under "Transfers"; it is not sold and not used for advertising.

An estimated address is a guess and has not been verified as belonging to the person. If the company's email pattern is known, the address is derived with that pattern. If not, the most common format, firstname.surname, is assumed and the address is created on the company's own domain. Only one address is derived per person, and it is shown in the directory as "Estimated". An address that bounces is marked "Bounced" and is never used for sending again.

First name, surname, job title and profile link are processed under Article 5(2)(d) of the Law, because they have been made public by the person or their employer for professional purposes, and only within the purpose of that publication.

We do not collect employees' private email addresses with free email providers such as Gmail, Hotmail or Yahoo, their home addresses, dates of birth or identity details. We also do not collect, through automated compilation, mobile phone numbers that have not been published publicly. A phone number can be added to the directory only if a member enters it themselves in the contribution form for a person they know.

If a person named in the directory asks to be removed, we deactivate the record and the address can no longer be used for sending. The request can be made by entering the email address on the ilandanonce.com/en/vazgec page, or by writing to bilgi@bumbagroup.com. People whose address is not in the directory, or whose estimated address does not belong to them, can use the email route. The rights in Article 11 of the Law can be exercised through the same address.

Your data is processed by the infrastructure providers we use to run the service: hosting and database services, an email sending service, and an AI service for text correction. These providers process the data only on our instructions.

If you connect your Google or Microsoft account, your email is sent directly through that provider; the content is not stored permanently on our servers, only a sending record is kept.

We keep your data for as long as your membership continues. When you delete your account, your profile, CV, logbook, reports and sending history are permanently deleted. Records that must be kept by law are kept for the statutory period.

Under Article 11 of the Law, you have the following rights.

• To learn whether your personal data is processed and to request information about it.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To ask for incomplete or incorrect data to be corrected.
• To ask for the data to be erased or destroyed.
• To object to an outcome against you arising from the analysis of the processed data exclusively by automated systems.
• To claim compensation if you suffer damage because of unlawful processing.