Privacy Policy

1. Who we are

The controller of your personal data for maxellm.com and the services offered under the Maxellm brand is the company below. We have not appointed a data protection officer.

Legal name

UNIJOB Teknoloji ve İnsan Kaynakları Hizmetleri A.Ş.

Tax ID (VKN)

8920749107

Address

Çınarlı Mah., Ankara Asfaltı Cad., No:15, İç Kapı No:391, Mistral Office Tower, Konak, İzmir, Türkiye

Privacy requests

support@unijob.com.tr

2. Which law applies

We are established in Türkiye, so the Turkish Personal Data Protection Law No. 6698 (“KVKK”) applies to all the processing described here. The EU General Data Protection Regulation (“GDPR”) applies where its Article 3(2) reaches our processing, for example when we offer you our services while you are in the European Union or the European Economic Area. Where it does, this policy also gives you the information its Articles 13 and 14 require, and you have the rights in section 8.

The Turkish version of this notice is the Aydınlatma Metni. The privacy policy of our game halfway is separate: halfway privacy policy.

3. What we process, why, and on what legal basis

Legal bases are given as the article of the KVKK and, where the GDPR applies, of the GDPR. We do not rely on consent for any of the processing below.

3.1 Visitors to the website

Data

IP address, the address of the page requested, the time and method of the request, the response code and your browser’s user agent.

Source

Automatically, from the requests your browser sends, in the systems of our hosting provider Vercel.

Purpose

To serve the website, keep it secure and fix errors.

Legal basis

KVKK art. 5(2)(f), GDPR art. 6(1)(f): our legitimate interest in running a secure, working website.

Retention

These logs can be viewed in our Vercel account for 1 day; we do not export them to any other service. How long Vercel keeps them in its own systems is governed by Vercel’s privacy notice. Our server software removes IP addresses, e-mail addresses, phone numbers, names and message contents from its own logs before they are written.

We use no analytics, advertising or marketing tools, and our public pages set no cookies (see the Cookie Notice). The images in the work section of the homepage are loaded from studio.seedstone.xyz; to load them your browser connects to that address, which receives your IP address and browser information.

3.2 People who send the contact or quote form

Data

Contact form: name, e-mail address, organisation (optional), subject and message. Quote form: name, e-mail address, phone number (optional), the package you choose and message. With every submission also the form type and language, the time it was sent, its status, who changed the status and when, our team’s notes and, where relevant, a link to a business record.

IP address

When you send a form, your IP address is passed to Cloudflare Turnstile to block automated (bot) submissions. To limit submissions from the same place (at most 5 in 10 minutes) we do not store your IP address itself; we store only a value derived from it with a secret key (an HMAC) with the form record. For IPv6 addresses the value is derived from the first 64 bits.

Purpose

To receive, assess and answer your request; to prepare a quote; to follow up on it; to protect the forms against abuse and automated submissions.

Legal basis

Quote requests and questions about our services: KVKK art. 5(2)(c), GDPR art. 6(1)(b) (steps you ask for before a contract). Other messages, keeping the record, Turnstile and the submission limit: KVKK art. 5(2)(f), GDPR art. 6(1)(f) (our legitimate interest in answering requests and protecting the forms from abuse).

Notification

Your form is sent to our team as a notification e-mail; one of its recipients is a Gmail address. No automatic e-mail is sent to you.

Retention

Form records are not deleted automatically after a fixed time: they stay in our database for as long as your request and any business relationship that follows need them, and are deleted when you ask. The value derived from your IP address is deleted at the latest with the form record. Notification e-mails are not deleted automatically.

The required fields (name, e-mail address, message and, on the contact form, subject) are needed to send the form; without them we cannot receive your request this way. You can also e-mail us.

3.3 People who write to us by e-mail or WhatsApp

Data

E-mail: your name and address, the subject, the message, attachments and the date. WhatsApp: your phone number, your WhatsApp name and your messages.

Purpose

To answer you, to assess requests for our services, and to handle requests about your personal data.

Legal basis

About our services: KVKK art. 5(2)(c), GDPR art. 6(1)(b). Other messages: KVKK art. 5(2)(f), GDPR art. 6(1)(f) (answering people who write to us). Requests about your personal data: KVKK art. 5(2)(ç), GDPR art. 6(1)(c).

Retention

E-mails to maxellm.com addresses are stored by our e-mail provider; some are also forwarded to Gmail. E-mails to support@unijob.com.tr are stored in Google Workspace. WhatsApp messages stay in our team’s WhatsApp account. None of these are copied into our admin panel, and none are deleted automatically.

3.4 Businesses and business owners we contact

We look for businesses that could use our website services in business information that is publicly available, and we contact them. Information about a company is not personal data; for a sole trader, or a business that carries a person’s name, it is.

Data

The business’s name, type, address, district and city, phone number, website, Instagram account and opening hours; the technical state of its website (whether it loads, secure connection, page speed, domain and e-mail records); a fit score computed from these and the business’s status with us; a record of our contacts (channel, date, message used, our team’s notes); and, if you asked us not to contact you again, your phone number and that request.

Source

Open-licensed, publicly available map data from the Overture Maps Foundation; the business’s own website and public domain and DNS records; information our team enters; our correspondence with you. Collected by software and by hand.

Purpose

To find businesses that could use our services and decide whom to contact first; to send you one first message about our services or call you; to respect a request not to be contacted again.

Legal basis

KVKK art. 5(2)(f), GDPR art. 6(1)(f): our legitimate interest in offering our services to businesses through contact details they published themselves. Keeping your number after you ask us not to contact you again: KVKK art. 5(2)(ç) and (f), GDPR art. 6(1)(f).

Automated scoring

Software scores businesses by the state of their website. The score only decides which business we contact first; it has no other effect on you, and we make no decision with legal or similarly significant effects by automated means.

Contact

Our first message is sent by WhatsApp, or we call. Reply “hayır” (no) and we will not contact you again. You can object to this at any time (section 8).

Retention

Business records are not deleted automatically after a fixed time; when you ask, we delete the business record and its contact history from our database. A phone number you asked us not to contact is kept without time limit so that we can respect that request. The source files we downloaded from the map data (public business information only) are kept separately and are not deleted.

3.5 Users of our admin panel

Data

E-mail address; for administrators, the verified e-mail addresses of their GitHub account; who invited a user and when, and when access was removed; requests for e-mailed sign-in links (time and a value derived from the IP address); the session cookie; a record of actions taken in the panel (who, when).

Purpose

To limit the panel to authorised people, record who did what, and keep it secure.

Legal basis

KVKK art. 5(2)(c), GDPR art. 6(1)(b) (our working relationship); KVKK art. 5(2)(f), GDPR art. 6(1)(f) (the security of the panel).

Retention

The account record and the action records are kept after access is removed and are not deleted automatically. A session lasts at most 12 hours; a sign-in link works once, within 15 minutes.

4. Who receives your data

We share personal data only with the service providers below, for the work stated. Apart from them, we disclose it to public authorities or courts only when a law or a court order requires it (KVKK art. 8(2)(a)). We do not sell personal data.

Vercel Inc. (United States)

Hosting of our website and server software; request logs (3.1–3.5). Our server functions run in Vercel’s Frankfurt (Germany) region; pages are delivered through Vercel’s worldwide content delivery network. Under Vercel’s terms, data may also be processed in the United States and at Vercel’s other facilities.

Neon, LLC and its parent Databricks, Inc. (United States)

The database that holds form, business and panel records (3.2, 3.4, 3.5), running in the Amazon Web Services Frankfurt (Germany) region.

Cloudflare, Inc. (United States)

Bot checks on the forms (Turnstile: IP address and browser information, 3.2); storage of the map data files (R2, 3.4; the storage location is not limited to a particular country); DNS for maxellm.com.

Add Rabbit, LLC — Purelymail (United States)

The maxellm.com mailboxes, and delivery of notification and sign-in e-mails (3.2, 3.3, 3.5). According to the provider, its servers are in the Amazon Web Services US East (Northern Virginia) region.

Google LLC (United States)

Gmail: one recipient of the notification e-mails is a Gmail address, and mail to some maxellm.com addresses is forwarded to Gmail (3.2, 3.3). Google Workspace: the mailbox of support@unijob.com.tr (3.3). PageSpeed Insights: a business’s website address, to measure its speed (3.4).

Backblaze, Inc. (United States)

Database backups (3.2, 3.4, 3.5), encrypted by us before they are sent, so the provider cannot read them; stored in Backblaze’s Amsterdam (Netherlands) data centre.

GitHub, Inc. (United States)

Administrators’ sign-in with their GitHub account (3.5); running one of the workflows that back up the database (when it runs, the backup is processed on GitHub’s servers before it is encrypted).

WhatsApp (Meta)

Messages when you write to us on WhatsApp or we write to you there (3.3, 3.4). WhatsApp processes this data under its own terms.

The software that backs up the database also runs in Türkiye, on a computer owned by the person who runs Maxellm; it does not belong to a hosting provider.

5. Transfers outside Türkiye and the EU

All the providers above are established outside Türkiye, so these are transfers abroad under article 9 of the KVKK, and the data is processed in the countries stated for each provider.

Where the GDPR applies, Türkiye has no adequacy decision of the European Commission, and the United States has one only for organisations certified under the EU–US Data Privacy Framework. The data processing terms of Vercel, Neon (Databricks), Cloudflare and Backblaze, which apply to our accounts, include the European Commission’s standard contractual clauses; each publishes them on its website, and you can ask us for a copy. We have not signed separate transfer terms with Purelymail, Google, GitHub or WhatsApp.

6. Backups

Encrypted database backups are kept for at most 6 months; the last 10 backups taken by hand are also kept. The database provider keeps a 6-hour restore history. A record deleted from the database leaves the backups when these periods end.

7. Children

Our website and services are for businesses and are not directed at children.

8. Your rights

Under article 11 of the KVKK you can ask us:

• whether we process your personal data, and for information about it;
• why we process it and whether it is used for that purpose;
• to whom, in Türkiye or abroad, it has been transferred;
• to correct it if it is incomplete or wrong;
• to delete or destroy it under the conditions of article 7 of the KVKK;
• to tell those we transferred it to about a correction, deletion or destruction;
• to object to a result against you that comes solely from automated analysis of your data;
• to compensate damage you suffered from unlawful processing.

Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (GDPR articles 15 to 18, 20 and 21). You can object at any time to being contacted about our services, and we will then stop.

9. How to make a request or a complaint

Write to support@unijob.com.tr from an e-mail address you gave us before, send us an e-mail signed with a secure electronic or mobile signature, or send a signed letter to the address in section 1. Give your name, your nationality and passport or ID number (or, for Turkish citizens, the T.C. identity number), your address, an e-mail address or phone number for our answer, and what you are asking for. Requests under the KVKK must be written in Turkish (article 4(2) of the Communiqué on applications to the controller); requests under the GDPR can also be in English. A printable Turkish form is on the KVKK Başvuru page. We may ask for more information to confirm that the request is yours.

We answer in writing or electronically within 30 days, free of charge. Only where the answer runs to more than ten printed pages may a fee of 1 Turkish lira per extra page be charged, or the cost of the medium if the answer is given on a CD or flash drive. If we refuse your request, you find our answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our answer and in any case within 60 days of your request (KVKK article 14). Where the GDPR applies, you can also complain to the data protection authority of the EU country where you live, work or where the issue arose.

10. Changes

When we change this policy, we publish the new version on this page with its effective date and version number.