1. Introduction
Drectly Teknoloji ve Yazılım Anonim Şirketi (“Drectly”, “we”, “our”, or “us”) operates the platform available at drectly.io (the “Platform”). This Platform Privacy Policy explains how we collect, use, share, retain, and protect personal data relating to Hirers, Recruiters, and their authorised representatives when they access or use the Platform.
As the data controller is established in the Republic of Türkiye, this Privacy Policy has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”). Where applicable, it has also been drafted in line with the principles of the General Data Protection Regulation (“GDPR”).
2. Data Controller
Drectly acts as the data controller in relation to the personal data processing activities described in this Policy.
3. Scope
This Privacy Policy applies to Hirers, Recruiters, and their authorised representatives who access or use the Platform.
- The processing of Candidate personal data is addressed in the separate Candidate Privacy Notice made available through the Candidate approval process.
- Our processing of personal data through our public website, including website visitors, the contact form, and cookies, is addressed in our separate website privacy notices and Cookie Policy.
- Where Drectly provides a separate Hirer or Recruiter privacy notice, that notice supplements this Policy and provides more detailed information concerning the relevant processing activities.
Hirers and Recruiters may also process personal data independently for their own recruitment activities. Their respective data-protection roles and obligations are determined according to the purposes and means of the relevant processing activity.
4. Personal Data We Collect and How We Collect It
Information you provide
- Name and email address
- Job title and company information
- Password and authentication information. Passwords are not stored in plain text.
Information from third-party services
When you connect your Google account, we access your Google Calendar to access the availability or free/busy information and event information necessary to create or manage interview calendar events, in accordance with the permissions you grant through Google’s process.
Automatically collected information
- Log data (IP address, browser type, pages visited)
- Cookies for session management
5. Purposes of Processing
We process your personal data to:
- provide, operate, and secure the Platform;
- maintain, troubleshoot, audit, and improve the security, reliability, and usability of the Platform;
- create and manage user accounts;
- schedule and manage job interviews via Google Calendar;
- send notifications related to hiring activities (new candidates, interview requests, status updates);
- communicate service-related updates;
- keep business and evidentiary records;
- prevent fraud, unauthorised access, misuse of the Platform, circumvention, and security incidents;
- comply with our legal obligations and establish, exercise, or defend legal claims.
6. Legal Bases for Processing
We process personal data on the following legal bases under the KVKK (Article 5) and, where applicable, the GDPR (Article 6):
- Performance of a contract: processing necessary to provide the Platform and the services you request, including account creation and interview scheduling.
- Legitimate interests: processing necessary for our legitimate interests in operating, securing, and improving the Platform.
- Compliance with legal obligations: processing necessary to comply with our obligations under applicable law.
- Explicit consent: where required by applicable law or where Drectly specifically requests consent for an optional processing activity. Where processing is based on consent, you may withdraw that consent at any time. Such withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7. Transfer of Personal Data
We do not sell your personal data. We may share your personal data with:
- Service providers who help us operate the Platform (e.g., cloud hosting, email delivery), acting under appropriate contractual and confidentiality obligations;
- Other Platform users as necessary for the hiring workflow (e.g., your name and job title visible to Recruiters on your open roles). Candidate Data is shared in accordance with the Candidate approval process and the applicable Candidate Privacy Notice;
- Professional advisers and insurers where reasonably necessary for legal, accounting, audit, insurance, or risk-management purposes;
- Legal, judicial, or regulatory authorities where required by law.
International transfers
Some service providers and integration providers may process personal data outside Türkiye. Where an activity constitutes a transfer of personal data abroad, Drectly uses a transfer mechanism permitted under Article 9 of the KVKK, such as an adequacy decision, an appropriate safeguard, including an applicable standard contract, or an exceptional transfer condition where legally available. Where the GDPR applies, transfers are carried out in accordance with Chapter V of the GDPR.
8. Data Retention
We retain your personal data for as long as your account is active and thereafter only for as long as reasonably necessary for the purposes described in this Policy, taking into account applicable legal retention and limitation periods.
- Account and profile data is generally retained for the duration of the active account and for the period necessary to complete account closure and comply with legal obligations.
- Contractual and hiring-workflow records may be retained for the period necessary to administer the relevant agreement and establish, exercise, or defend legal claims.
- Security and audit logs are retained for a limited period proportionate to security, fraud-prevention, and evidentiary needs.
- Google Calendar tokens are stored securely and are deleted or invalidated when you disconnect your Google account from Drectly, revoke access, or when the relevant token expires, subject to ordinary technical processing and backup cycles.
You may request deletion of your account and associated data at any time by contacting us, subject to any legal obligation or overriding lawful basis requiring continued retention.
When retention is no longer justified, personal data is deleted, destroyed, or anonymised in accordance with applicable law.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including access controls, secure authentication and token management, encryption in transit, logging and monitoring, role-based permissions, backups, and contractual controls for service providers.
While we take reasonable steps to safeguard your data, no method of transmission or storage is completely secure, and users are also responsible for protecting their own devices and account credentials.
10. Your Rights
Under Article 11 of the KVKK, and where applicable the GDPR, you have the right to:
- learn whether your personal data is being processed;
- request information if your personal data has been processed;
- learn the purpose of processing and whether your data is used in accordance with that purpose;
- know the third parties to whom your personal data is transferred, whether domestically or abroad;
- request rectification of incomplete or inaccurate data, and request that such rectification be notified to third parties to whom the data has been transferred;
- request the deletion or destruction of your personal data where the reasons requiring its processing cease to exist, and request that such deletion be notified to third parties;
- object to any outcome against you arising from the analysis of your personal data exclusively through automated systems; and
- request compensation for damages arising from the unlawful processing of your personal data.
Where the GDPR applies, you also have the right to data portability, to restrict processing, to withdraw consent, to object to processing in applicable circumstances, and to lodge a complaint with a supervisory authority, subject to the conditions and limitations under applicable law.
To exercise your rights, please contact us at support@drectly.io. We will conclude your request within 30 days and free of charge, provided that it does not require additional cost.
Along with these rights, you may also disconnect third-party integrations (e.g., Google Calendar) at any time from your profile settings.
11. Cookies
We use essential cookies to keep you logged in and maintain your session. We do not use advertising cookies on the Platform. For details on the cookies used on our public website, please see our Cookie Policy.
12. Children
The Platform is intended for business use by professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are under 18, please refrain from using the Platform.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in applicable law, Platform functions, integrations, or our processing practices. We will notify you of material changes via email or a notice on the Platform before or when the relevant changes take effect, as appropriate. The “Last updated” date above indicates when this Policy was last revised.
14. Contact
If you have questions about this Privacy Policy or wish to exercise your rights, please contact: