Privacy policy

This policy explains which of your personal data we process and why when you use the İşBuldum KKTC website (isbuldumkibris.com) and mobile app, who we share it with, how long we keep it and how you can exercise your rights. For the rules on using the service, see the terms of use.

In short

• We don't sell your data. We don't show ads, and we don't use any advertising, analytics or error-reporting tools.
• Your profile and CVs are not public. A copy of your CV goes only to the employer of the job you apply for.
• We don't use your device's location, contacts or advertising ID.
• You can download a copy of your data and delete your account yourself at any time.

Data controller

İşBuldum KKTC is run by independent developer Ahmet Balaman (Girne/Kyrenia, TRNC). "We" in this policy means him, and he is the data controller for your personal data. You can reach us at info@isbuldumkibris.com or through the Contact and support page.

We process your data in accordance with the Turkish Republic of Northern Cyprus Personal Data Protection Law No. 89/2007, Turkey's Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the European Union General Data Protection Regulation (GDPR).

What data we collect

We process only the information you give us and the technical data needed for the service to run securely.

• Account information: your full name, e-mail address, whether your e-mail address has been verified, your e-mail notification preferences and the language in which e-mails are sent to you. We never store your password in plain text; we keep only a one-way hash generated with bcrypt. If you sign in with Google or Apple, these services send us your name, e-mail address, whether that e-mail address is verified and your permanent account ID with that service. When signing in with Apple, you can choose to share Apple's relay address instead of your real e-mail address.
• Job seeker profile: profile headline, summary, skills, education, work experience, languages, whether you are a student, your preferred work models and the district you choose from the list. Optionally, your phone number, year of birth, gender and profile photo.
• CVs: the content you enter in the CV builder (in addition to the above: website, LinkedIn address, driving licence, certificates, projects, interests and any custom sections you add), your design choices and the PDF CV files you upload (up to 5 MB).
• References: the name, workplace, job title, phone number and e-mail address of the referees you add. You should add these details only after getting the person's permission.
• Applications: the job you applied for, your application note, the status of the application and an unchangeable copy of the CV you chose when applying. If your photo appears in the CV template, it is included in this copy too. Any private note the employer makes about your application is also stored with the application; this note is not shown to you.
• Messages and notifications: the content of your conversations with employers, sender and date information, your in-app notifications and whether they have been read.
• Employer and company information: company name, description, website, logo, district, sector and employee-count range; a contact e-mail, phone number and tax number for verification; the names, e-mail addresses and roles of the members of the company team; published jobs.
• Other usage records: jobs you save, your job alerts (the search filters you save and your e-mail preference), employers you block, candidates blocked by employers on behalf of their companies, reports you submit (reason and description) and audit logs of administrative actions. Audit logs do not contain the content of messages or CVs.
• Technical data: for your open sessions, the browser or app identification string (user agent) and the time of last use. Your IP address appears only as a one-way hash in the request counters kept to prevent abuse, is passed to Cloudflare during the bot check and appears in our web server's standard access logs. If you allow notifications in the mobile app or in your browser, your device's or browser's push notification address (push token or Web Push subscription), platform and language are stored, linked to that session.

What we don't collect: We don't use your device's location (GPS); you choose your district from a list yourself. We don't access your contacts or advertising ID. We don't take payment details. We record how many times job pages are viewed only as a total count; we don't record who viewed them. Camera and photo access is used only when you add a profile photo, and only for the photo you choose. Uploaded images are re-processed and their EXIF data, including location, is removed.

Special categories of data: We don't ask for information about your health, disability, religion, ethnic origin, political opinions, trade union membership or criminal convictions, or for biometric data. We recommend that you don't include such information in your CV, application notes or messages. If you do, the employer you apply to will see it as well.

Why we process data

• To open your account and provide the service: sign-up, sign-in, e-mail verification, password reset, profile and CV, forwarding your application to the employer, messaging, notifications, saved jobs, and company and job management. Legal basis: entering into and performing a contract (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)).
• Optional information and preferences: phone number, year of birth, gender, photo and references; e-mail notifications; "urgent job" notifications sent when a new urgent job is published in the district and work model you choose; notifications about new jobs matching the job alerts you set. You add or turn these on yourself and can delete them or turn them off at any time. Legal basis: providing the service you request (performance of a contract).
• Security and abuse prevention: preventing fake accounts and jobs, bot checks, rate limits, blocking sign-ups with disposable e-mail addresses, company verification, job approval, report review, audit logs and backups. Legal basis: our legitimate interest in the security of the service and of our users (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
• Legal obligations and protection of rights: responding to lawful requests from competent authorities and protecting our rights in possible disputes (KVKK Art. 5(2)(ç) and 5(2)(e), GDPR Art. 6(1)(c) and 6(1)(f)).

We don't make automated decisions about applications or build profiles; the hiring decision is made by the employer. Urgent job notifications are sent based only on the district and work model preferences you choose. Gender is not shown to employers and is not used in any matching, ranking or filtering. Your phone number and year of birth are carried over to CVs created from your profile and to applications you make without choosing a CV; if you don't want to share them, you can remove them from your profile or CV.

Who can see it

• Everyone: published jobs and the pages of verified companies (name, description, website, logo, district, sector, number of employees). These pages may be listed by search engines. Your profile, CVs and applications are not public; there is no database in which employers can search for candidates.
• Employers you apply to: your name, e-mail address, application note and the copy of the CV you chose when applying. If they appear in your CV, your phone number, year of birth, location and photo are also in this copy. Your references are shared only if you choose to share them when applying. All members of the company team can see the application. The employer processes this information for its own hiring process and under its own responsibility.
• People you message: the other party to a conversation sees your messages and your name. On the employer side, this means all members of the company team.
• Company team: members of the same company see each other's names, e-mail addresses and roles.
• Our administrators: see the contact e-mail, phone number and tax number provided for company verification and, for reports, the names and e-mail addresses of the reporting user and the reported user. Where security, a report review or a legal obligation requires it, they may also access other records (including the messages in a reported conversation), only as far as necessary; viewing a reported conversation is recorded in the audit log. If an account is suspended, the date of and reason for the suspension are stored with the account.
• Public authorities: only where there is a legal obligation.

Service providers and transfers abroad

• Server hosting: the database, uploaded files and backups are kept on servers we rent.
• Hostinger (e-mail): verification codes, password reset e-mails and notification e-mails are sent through Hostinger's e-mail servers. In the process, your e-mail address, your name and the content of the e-mail are transmitted. New message e-mails contain the first 120 characters of the message; if you'd rather not receive them, you can turn off message e-mails in your account settings. E-mails you send to info@isbuldumkibris.com are also stored at Hostinger.
• Google and Apple: only if you choose to sign in with these methods. These companies process the sign-in under their own privacy policies.
• Cloudflare: domain name (DNS) service and the Turnstile bot check. When you sign up or sign in with e-mail, Turnstile processes your IP address and browser or device characteristics to tell whether the request comes from a human.
• Apple and Google notification services: if you allow notifications in the mobile app, the title and short text of each notification are delivered to your device via the Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android). You can turn notifications off in your device settings at any time.
• App stores: the App Store or Google Play, from which you download the app, process data under their own policies.

Some of these providers may process data outside the country you are in, for example in the USA. The data transferred to them is limited to what the relevant service needs in order to work.

Cookies and information stored on your device

We use only cookies that are strictly necessary for the service to work:

• isbuldum_session: keeps you signed in on the website. It is a cookie that browser scripts cannot read (HttpOnly) and that is sent only over secure connections; it expires after 30 days or when you sign out.
• isbuldum_oauth_google, isbuldum_oauth_apple: when you sign in with Google or Apple, these confirm that the returning response belongs to the process you started; they are valid for 10 minutes.
• isb_locale: remembers the site language you picked in the language switcher (Turkish, English, Russian); it is kept for 1 year and contains nothing else.

Because we don't use analytics or advertising cookies, we don't ask for cookie consent. The Cloudflare Turnstile script is loaded on the sign-up and sign-in forms. The mobile app stores its session keys in your device's secure storage (iOS Keychain, Android Keystore) and deletes them when you sign out.

How long we keep it

• Account, profile, CVs, photo, applications, messages, notifications, saved jobs and blocks: for as long as your account is open. They are deleted immediately when you delete your account.
• Sessions: a web session is valid for 30 days and a mobile session for up to 60 days. Expired sessions are deleted automatically. A push notification address is deleted when the session it is linked to ends (when you sign out or the session expires).
• E-mail verification codes and links are valid for 24 hours and password reset links for 1 hour; they are deleted when they expire.
• Request counters (one-way hashes of IP and e-mail addresses): deleted 7 days after they were last used.
• Copies of sent notification e-mails are deleted 30 days after sending; those that could not be sent are deleted after 90 days.
• Backups: 14 days. Deleted data disappears from backups by the end of this period at the latest.
• Jobs are taken down when they expire. Closed jobs are deleted two years after closing (or earlier, as soon as the company or candidate account is deleted), together with their applications, conversations and the CV copies taken at the time of application.
• Resolved reports and audit logs are deleted after two years; open reports are kept until they are resolved. If you delete your account, your identity is removed from the reports you submitted.
• Web server access logs (IP address, requested page, browser information): 14 days; application error logs are deleted automatically, oldest first, as they reach their size limit.

Deleting your account

You can delete your account yourself at any time: on the website, in the "Delete account" section of the Account settings page; in the mobile app, with the "Delete my account" button on the Profile tab. To confirm, you will be asked for your e-mail address and, if you have one, your password. If you can't sign in, write to info@isbuldumkibris.com from the e-mail address registered to your account.

Deletion permanently removes:

• Your account, sessions, Google/Apple connections, profile, CVs, the PDFs you uploaded and your photo.
• Your applications and the CV copies sent to employers, the conversations belonging to those applications and the messages you sent in other conversations.
• Your notifications, saved jobs, blocks and company memberships.
• Companies of which you are the only member, their logos, their jobs and the applications made to those jobs. Companies with other members are not deleted; if you are the last manager, the longest-standing member becomes the manager.

Reports you submitted are kept with your identity removed. The audit logs keep a record that the deletion took place, without your name and e-mail address. Copies in backups are deleted within 14 days at the latest.

Withdrawing an application or deleting a CV does not delete the copy of the application already sent to the employer; the employer may continue to see this copy. These copies are deleted when you delete your account.

Your rights

Under applicable law, you have the right to find out whether your data is processed; to request information about it and the purpose of processing; to find out who it has been transferred to; to request the correction of incomplete or inaccurate data, its deletion or the restriction of its processing; to object to processing; to receive a copy of your data in a portable format; and, if you have suffered damage as a result of unlawful processing, to claim compensation.

• Correction: you can edit your profile, CVs, name and notification preferences yourself. To change your e-mail address, write to us.
• Copy: with "Download my data" on the Account settings page of the website, you can download your account, profile, CV, application, sent message, notification, saved job, block and company membership data as a JSON file. You can also download PDF versions of your CVs from the CV page. You can sign in to the website with the account you opened in the mobile app using the same method, or set a password with "Forgot password?".
• Deletion: see the "Deleting your account" section above.
• Preferences: you can turn off e-mail notifications and urgent job notifications and, if you have another sign-in method, remove the Google or Apple connection.
• Other requests: for objections, restriction or information requests, write to info@isbuldumkibris.com from the e-mail address registered to your account. We may ask for additional information to verify your identity. We respond to your request within 30 days at the latest.

If you are not satisfied with our response, you can lodge a complaint with the Personal Data Protection Board in the TRNC, with the Personal Data Protection Board in Turkey (under KVKK, you must first have applied to us) or, in the European Union, with the data protection authority of the country where you live.

Age limit

The service is for people aged 16 or over. If you are under 16, do not sign up. If you are under 18, use the service with the knowledge of your parent or guardian. If we learn that someone under 16 has opened an account, we will delete the account and its data.

Security

• All traffic between the website and app and our server is encrypted with HTTPS.
• Passwords are stored hashed with bcrypt. Session keys, verification codes and password reset links are also kept in the database only as one-way hashes. When a password is changed, other sessions are signed out.
• Authorisation is checked on every request: applications can be seen only by the candidate and the relevant company's team, and conversations only by their participants.
• Uploaded files are not kept in a public folder but in restricted-access storage and are served only after an authorisation check. File types are verified by inspecting their content; images are re-encoded and their EXIF data removed.
• Rate limits apply to sign-up, sign-in, applications, messages and similar actions, and a bot check applies to sign-up and sign-in with e-mail.
• The database is not exposed to the internet; it can be accessed only from the application server.

No system is completely secure. If a security breach affects your data, we will notify the relevant authorities and the affected users as required by law.

Changes

We update this policy as the service changes. The current text is always on this page, and the date at the top changes. We announce important changes on the website and in the app, or by e-mail.

Contact

For any privacy question or request, write to info@isbuldumkibris.com or use the Contact and support page.