Privacy notice
This notice explains how we handle personal data when you hire or contact us through Upwork or Fiverr, e-mail us, or visit derinlabsstudio.com. It is written to meet Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, where they apply, Articles 13 and 14 of the EU and UK GDPR.
Who we are
Derin Labs is the business name of Arda Ceylan, a sole proprietor (natural person) registered in Türkiye. Arda Ceylan is the data controller for the personal data described here. Privacy requests: teklif@derinlabsstudio.com.tr, or a message on Upwork or Fiverr if we work together there.
This notice covers
- clients and prospective clients, and people who act for them, whose job posts we answer on Upwork, who contact us on Fiverr, or who e-mail us about a website, web app, fix, integration or maintenance job;
- visitors of derinlabsstudio.com.
Our notice in Turkish, for people in Türkiye, is at derinlabsstudio.com/kvkk.
What we collect
- From the platform: your name or username, business name, country, the job post and the messages you send us there.
- For a contract: billing name and address, tax or VAT ID if you give it, and the contract and payment records the platform shows us. We never see your card details; the platform handles payment.
- For the job itself: access you give us (staging logins, repository access) and the files we need. We ask only for the access the job needs. When the job ends, we delete our copies of logins and files and ask you to revoke our access.
- On the website: our hosting provider, Cloudflare, processes your IP address in access logs. We count visits with Cloudflare Web Analytics, including which of our social media profile links (tagged like ?k=ig) they came from; it sets no cookies and uses no browser storage. We use no cookies for analytics, advertising or profiling.
We collect this data electronically: through the platform, by e-mail, and automatically in our website's logs.
We do not take jobs that need access to personal data of your customers, users or staff (for example a live database or form submissions) unless we have first signed a data processing agreement with you and, where that data comes from the EU, the EEA or the UK, the transfer clauses those laws require.
Why we use it, and on what legal basis
- To answer your job post or message and prepare a proposal: steps taken at your request before a contract (GDPR Art. 6(1)(b)) or, if you act for a company, our legitimate interest in answering its request (GDPR Art. 6(1)(f)); KVKK Art. 5(2)(c) and (f).
- To perform the contract: GDPR Art. 6(1)(b); KVKK Art. 5(2)(c). If the contract is with your company, we use your own contact details on the basis of our legitimate interest in working with the people who act for our client (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- To issue invoices and keep the books Turkish law requires: our legitimate interest in meeting our legal obligations in Türkiye (GDPR Art. 6(1)(f)); KVKK Art. 5(2)(ç).
- To keep a record of each proposal we send (the job post and our proposal text), to show that our business messages follow Turkish law: GDPR Art. 6(1)(f); KVKK Art. 5(2)(ç) and (e).
- To establish or defend legal claims: GDPR Art. 6(1)(f); KVKK Art. 5(2)(e).
- To run and protect our website and count visits: our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)); KVKK Art. 5(2)(f).
We do not use your data for advertising, and we do not sell it.
You do not have to give us personal data. Turkish tax law requires your billing name and address on our invoice; without it and the job details we cannot send a proposal, perform a contract or invoice it.
Who receives it
- Upwork or Fiverr, which run the platform under their own privacy policies.
- Alastyr Telekomünikasyon A.Ş. (İzmir, Türkiye), which receives and stores e-mail sent to teklif@derinlabsstudio.com.tr on our behalf. During an attack on its mail server, this traffic may pass through the network of its DDoS-protection provider Voxility outside Türkiye.
- Google Cloud EMEA Limited (Ireland), which stores e-mail sent to our general address hello@derinlabsstudio.com (Google Workspace).
- Cloudflare, Inc. (United States), which hosts our website and provides Cloudflare Web Analytics.
- Our accountant in Türkiye and the Turkish Revenue Administration, for invoices (e-Archive invoice).
- Courts or authorities, only when the law requires it.
We do not pass your data to anyone else.
Where it is processed
We work from Türkiye, which is outside the EU, the EEA and the UK and has no EU or UK adequacy decision. We process the data you give us in Türkiye; our e-mail provider Alastyr and our accountant are also in Türkiye. Google stores e-mail sent to our general address in the EU (Ireland); Google's Cloud Data Processing Addendum governs any transfer outside the EEA (EU Standard Contractual Clauses or another mechanism recognised under EU law). Cloudflare, Inc. is in the United States and is certified under the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for a copy of these safeguards. Under Turkish law, the transfers to Google, Cloudflare and Voxility are transfers abroad under KVKK Art. 9.
How long we keep it
- Messages that do not lead to a contract: we delete our copies within 12 months; Upwork and Fiverr keep their own copies under their own rules.
- Proposal records (job post and our proposal): 10 years, then deleted.
- Contract, invoice and accounting records: for the periods Turkish law sets (5 years after the end of the year for tax records; up to 10 years for electronic commerce records), then deleted.
- Job access and working copies of your files: removed when the job ends.
Your rights
You can ask us for access to your data, for correction, deletion, restriction, or a copy in a portable format, and you can object to processing based on our legitimate interests. Write to teklif@derinlabsstudio.com.tr or message us on the platform. We answer free of charge, as soon as possible and at the latest within one month or 30 days, whichever is shorter.
Under Turkish law (KVKK Art. 11) you can also ask whether your data is processed and for information about it; learn the purpose and whether your data is used for it; learn to whom in Türkiye or abroad it is transferred; have a correction or deletion passed on to them; object to a result against you that comes solely from automated analysis; and claim compensation if unlawful processing harms you.
You can complain to the data protection authority where you live or work or where you think the infringement happened (in the UK, the ICO). Under Turkish law you can complain to the Personal Data Protection Board (KVKK) after you have first written to us (KVKK Art. 14).
Automated decisions
We make no decisions with legal or similarly significant effects on you by automated means alone.
Changes
If this notice changes, we update the date below; if a change affects how we use your data, we also tell current clients on the platform or by e-mail.
Last updated: