Privacy Policy

Last updated: July 17, 2026

Introduction
Drectly Teknoloji ve Yazılım Anonim Şirketi (“Drectly”, “we”, “our”, or “us”) operates
the platform available at drectly.io (the “Platform”). This Platform Privacy Policy
explains how we collect, use, share, retain, and protect personal data relating to
Hirers, Recruiters, and their authorised representatives when they access or use the
Platform.
As the data controller is established in the Republic of Türkiye, this Privacy Policy
has been prepared in accordance with the Law No. 6698 on the Protection of
Personal Data (“KVKK”). Where applicable, it has also been drafted in line with the
principles of the General Data Protection Regulation (“GDPR”).
Data Controller
Drectly Teknoloji ve Yazılım Anonim Şirketi, registered with the İstanbul Trade
Registry under number 1132550, with its registered office at Ayazağa Mahallesi,
Kemerburgaz Caddesi, Vadi İstanbul Park Sitesi, 7a Blok, No: 7b, İç Kapı No: 4,
Sarıyer/İstanbul, Türkiye; acts as the data controller in relation to the personal data
processing activities described in this Policy.
Scope
This Privacy Policy applies to Hirers, Recruiters, and their authorised representatives
who access or use the Platform.
The processing of Candidate personal data is addressed in the separate Candidate
Privacy Notice made available through the Candidate approval process.
Our processing of personal data through our public website - including website
visitors, the contact form, and cookies - is addressed in our separate website privacy
notices and Cookie Policy.
Where Drectly provides a separate Hirer or Recruiter privacy notice, that notice
supplements this Policy and provides more detailed information concerning the
relevant processing activities.
Hirers and Recruiters may also process personal data independently for their own
recruitment activities. Their respective data-protection roles and obligations are
determined according to the purposes and means of the relevant processing activity.
Personal Data We Collect and How We Collect It
Information you provide:
- Name and email address
- Job title and company information
- Password and authentication information. Passwords are not stored in plain text.
Information from third-party services:
- When you connect your Google account, we access your Google Calendar
  to access the availability or free/busy information and event information
  necessary to create or manage interview calendar events, in accordance
  with the permissions you grant through Google’s process.
Automatically collected information:
- Log data (IP address, browser type, pages visited)
- Cookies for session management
Purposes of Processing
We process your personal data to:
- Provide, operate, and secure the Platform,
- Maintain, troubleshoot, audit, and improve the security, reliability, and usability of
  the Platform;
- Create and manage user accounts,
- Schedule and manage job interviews via Google Calendar,
- Send notifications related to hiring activities (new candidates, interview requests,
  status updates),
- Communicate service-related updates,
- Keep business and evidentiary records,
- Prevent fraud, unauthorised access, misuse of the Platform, circumvention, and
  security incidents;
- Comply with our legal obligations and establish, exercise, or defend legal claims.
Google Calendar data obtained through Google APIs is used solely to display your
availability and create interview calendar events. This data is not used for
advertising, is not sold to third parties, and is not used for any purpose other than
interview scheduling.
Legal Bases for Processing
We process personal data on the following legal bases under the KVKK (Article 5)
and, where applicable, the GDPR (Article 6):
- Performance of a contract: processing necessary to provide the Platform and
  the services you request, including account creation and interview scheduling.
- Legitimate interests: processing necessary for our legitimate interests in
  operating, securing, and improving the Platform.
- Compliance with legal obligations: processing necessary to comply with our
  obligations under applicable law.
- Explicit consent: where required by applicable law or where Drectly specifically
  requests consent for an optional processing activity. Where processing is based
  on consent, you may withdraw that consent at any time. Such withdrawal does
  not affect the lawfulness of processing carried out before the withdrawal.
Transfer of Personal Data
We do not sell your personal data. We may share your personal data with:
- Service providers who help us operate the Platform (e.g., cloud hosting, email
  delivery), acting under appropriate contractual and confidentiality obligations;
- Other Platform users as necessary for the hiring workflow (e.g., your name and
  job title visible to Recruiters on your open roles). Candidate Data is shared in
  accordance with the Candidate approval process and the applicable Candidate
  Privacy Notice;
- Professional advisers and insurers where reasonably necessary for legal,
  accounting, audit, insurance, or risk-management purposes;
- Legal, judicial, or regulatory authorities where required by law.
International transfers: Some service providers and integration providers may
process personal data outside Türkiye. Where an activity constitutes a transfer of
personal data abroad, Drectly uses a transfer mechanism permitted under Article 9
of the KVKK, such as an adequacy decision, an appropriate safeguard, including an
applicable standard contract, or an exceptional transfer condition where legally
available. Where the GDPR applies, transfers are carried out in accordance with
Chapter V of the GDPR.
Data Retention
We retain your personal data for as long as your account is active and thereafter
only for as long as reasonably necessary for the purposes described in this Policy,
taking into account applicable legal retention and limitation periods.
Account and profile data is generally retained for the duration of the active account
and for the period necessary to complete account closure and comply with legal
obligations.
Contractual and hiring-workflow records may be retained for the period necessary to
administer the relevant agreement and establish, exercise, or defend legal claims.
Security and audit logs are retained for a limited period proportionate to security,
fraud-prevention, and evidentiary needs.
You may request deletion of your account and associated data at any time by
contacting us, subject to any legal obligation or overriding lawful basis requiring
continued retention.
Google Calendar tokens are stored securely and are deleted or invalidated when you
disconnect your Google account from Drectly, revoke access, or when the relevant
token expires, subject to ordinary technical processing and backup cycles.

When retention is no longer justified, personal data is deleted, destroyed, or
anonymised in accordance with applicable law.
Data Security
We implement appropriate technical and organisational measures to protect your
personal data, including access controls, secure authentication and token
management, encryption in transit, logging and monitoring, role-based permissions,
backups, and contractual controls for service providers.
While we take reasonable steps to safeguard your data, no method of transmission
or storage is completely secure, and users are also responsible for protecting their
own devices and account credentials.
Your Rights
Under Article 11 of the KVKK, and where applicable the GDPR, you have the right to:
- learn whether your personal data is being processed;
- request information if your personal data has been processed;
- earn the purpose of processing and whether your data is used in accordance
  with that purpose;
- know the third parties to whom your personal data is transferred, whether
  domestically or abroad;
- request rectification of incomplete or inaccurate data, and request that such
  rectification be notified to third parties to whom the data has been transferred;
- request the deletion or destruction of your personal data where the reasons
  requiring its processing cease to exist, and request that such deletion be notified
  to third parties;
- object to any outcome against you arising from the analysis of your personal
  data exclusively through automated systems; and
- request compensation for damages arising from the unlawful processing of your
  personal data.
Where the GDPR applies, you also have the right to data portability, to restrict
processing, to withdraw consent, to object to processing in applicable circumstances,
and to lodge a complaint with a supervisory authority, subject to the conditions and
limitations under applicable law.
To exercise your rights, please contact us at berker@drectly.io. We will conclude
your request within 30 days and free of charge, provided that it does not require
additional cost.
Along with these rights, you may also disconnect third-party integrations (e.g.,
Google Calendar) at any time from your profile settings.
Cookies
We use essential cookies to keep you logged in and maintain your session. We do
not use advertising cookies on the Platform. For details on the cookies used on our
public website, please see our Cookie Policy.
Children
The Platform is intended for business use by professionals and is not directed to
individuals under the age of 18. We do not knowingly collect personal data from
children. If you are under 18, please refrain from using the Platform.
Changes to This Policy
We may update this Privacy Policy to reflect changes in applicable law, Platform
functions, integrations, or our processing practices. We will notify you of material
changes via email or a notice on the Platform before or when the relevant changes
take effect, as appropriate. The “Last updated” date above indicates when this Policy
was last revised.
Contact
If you have questions about this Privacy Policy or wish to exercise your rights, please
contact:
Drectly Teknoloji ve Yazılım Anonim Şirketi
Ayazağa Mahallesi, Kemerburgaz Caddesi, Vadi İstanbul Park Sitesi, 7a Blok, No:
7b, İç Kapı No: 4, Sarıyer/İstanbul, Türkiye
Email: berker@drectly.io
Website: drectly.io