Privacy Policy

ORTAQ (ortaq.biz) acts as the data controller under Turkey's Law No. 6698 on the Protection of Personal Data (KVKK). This policy covers both the disclosure obligation under KVKK Art. 10 and the information to data subjects under Art. 13 of the EU General Data Protection Regulation (GDPR).

For questions and any KVKK/GDPR requests, reach us via the Contact page: ortaq.biz/iletisim.

While providing our services, we may process the following categories of data:

• Identity and contact: name, email address, profile picture.
• OAuth data: when you sign in with Google, Facebook or LinkedIn, the email address and public profile information (name, avatar) that the provider shares based on your consent. Only the minimum scope needed for sign-in is requested; no page, publishing or business-management permissions are requested.
• Account and usage: partnership profiles you create, documents you upload, messages, favourites, search history and preferences.
• Technical data: IP address, browser/device information, cookie identifiers and anonymized usage statistics.
• Payment data: for paid services, payments are processed by a secure third-party provider (Stripe); we never store your card details.

Your data is processed for account creation and authentication, providing the platform services, partnership matching, security and fraud prevention, complying with legal obligations, and — where you have consented — informational communications.

Our legal bases under KVKK Art. 5(2) and GDPR Art. 6(1) are: performance of a contract (b), legal obligation (c), legitimate interest (f) and explicit consent (a). Data received from OAuth providers is based on the explicit consent you give on the provider's consent screen.

If you choose to sign in with a third-party account, Google's, Facebook's or LinkedIn's OAuth infrastructure is used. In this flow the provider offers to share only your email address and public profile information; only you grant that consent. Your password is never transmitted to ORTAQ servers.

You can revoke provider access at any time: Google Account Settings → Third-party apps, Facebook Settings → Apps and websites, LinkedIn Settings → Authorized services. Deleting your ORTAQ account also removes OAuth records.

Personal data is shared only with processors required to deliver the service: hosting (Vercel), payments (Stripe) and OAuth identity providers. Your data is never sold.

Some processors may host data outside your country; transfers are covered by appropriate safeguards under GDPR Art. 44-49 (e.g., Standard Contractual Clauses). Transfers outside Turkey comply with KVKK Art. 9.

Your data is retained while your account is active and for as long as required by legal retention obligations. When you delete your account, data other than records required by legal and financial obligations (e.g., invoices) is deleted or anonymized within a reasonable period.

Your data is protected with TLS encryption in transit, access controls, the principle of least privilege and regular security reviews. OAuth tokens are stored server-side and are never exposed to the browser or client code.

Under KVKK Art. 11 and the GDPR you have the right to: know whether your data is processed; request information if it is; request rectification, erasure or anonymization; request restriction of processing; data portability; withdraw consent; and object to automated decisions.

Requests can be submitted via the Contact page and are concluded within 30 days at the latest. Users in Turkey may lodge complaints with KVKK; users in the EU may lodge complaints with their supervisory authority (e.g., CNIL, ICO, BfDI).

For questions and any KVKK/GDPR requests, reach us via the Contact page: ortaq.biz/iletisim.

We use cookies that are strictly necessary for sessions, security and site preferences, and anonymized analytics cookies to understand usage. We obtain your consent where non-essential cookies are used.

This policy may be updated from time to time; material changes are announced on this page together with an effective date.

For questions and any KVKK/GDPR requests, reach us via the Contact page: ortaq.biz/iletisim.