Privacy Notice & Personal Data Protection Policy

Pursuant to KVKK Law No. 6698, your personal data is processed by Vellium ("Company", developer and operator of Operis platform; Operis is a product of Vellium) acting as the Data Controller under the following principles.

• Trade Registry No: 123456-5
• MERSIS No: 0123456789000001
• Tax Office / No: Istanbul Tax Office / 1234567890
• Official DPO Contact: privacy@vellium.dev
• Official Support / Inquiries: contact@vellium.dev | support@vellium.dev
• Registered Electronic Mail (KEP): vellium@hs01.kep.tr

Under the principle of privacy by design and data minimization, Operis processes only the minimum data necessary for service provision:

1. 1Identity Data: Full name, date of birth (for statutory age verification).
2. 2Contact Data: City, country of residence, verified email address, verified phone number.
3. 3Technical and Security Data: Salted password hashes, SHA-256 digital integrity digests, session tokens, IP address, statutory traffic logs under Law No. 5651, transaction timestamps.
4. 4Signature Assets: User-uploaded signature or company stamp graphics for bilateral contract execution (stored in WebP format with metadata stripped).
5. 5Special Categories of Data: Operis does not collect or process national identification numbers (TCKN), criminal records, biometrics, or health data.

Personal data is processed pursuant to Article 5 of KVKK under the following legal bases:

1. 1Performance of a Contract (KVKK Art. 5/2-c): Account creation, authentication, listing publication, proposal routing, and mutual reveal of direct contact details upon mutual proposal acceptance.
2. 2Statutory Obligations (KVKK Art. 5/2-ç): Retention of hosting traffic records under Law No. 5651, compliance with electronic commerce regulations under Law No. 6563, and responses to judicial subpoenas.
3. 3Legitimate Interests (KVKK Art. 5/2-f): Detection of automated abuse, bot mitigation, and safeguarding infrastructure security without prejudicing user fundamental rights.
4. 4Explicit Consent (KVKK Art. 5/1): Deployment of optional analytics cookies or elective marketing communications is conducted solely with revocable explicit user consent.

Operis protects your data using industry-standard measures:

1. 1In-Transit Security: All traffic is encrypted using modern TLS (HTTPS) protocols.
2. 2At-Rest Encryption: Sensitive database columns (full name, phone number) are encrypted at the application layer with AES-256-GCM envelope encryption.
3. 3Blind Indexing: Uniqueness checks on contact information are performed using keyed HMAC-SHA256 blind indexing rather than plaintext queries.
4. 4Access Control: User signatures and private documents are protected by strict authorization rules and short-lived (max 5 minutes) signed URLs.

1. 1No Data Monetization: Operis never sells, leases, or trades personal data to third-party advertisers or data brokers.
2. 2Bilateral Exchange: Direct phone and email channels remain masked until mutual proposal acceptance, where they unlock strictly between the contracting parties for project execution.
3. 3Infrastructure Sub-processors: Cloud hosting, object storage, error monitoring, and transactional email services are utilized under data processing agreements complying with KVKK Article 9.
4. 4Public Authorities: Data is disclosed to judicial or law enforcement authorities solely upon presentation of binding statutory legal orders.

Personal data is retained for proportionate, purpose-driven periods:

1. 1User Accounts: Maintained for the duration of active membership; deleted following account closure subject to statutory hold periods.
2. 2Executed Contracts & Acceptances: Retained for the statutory limitation period governing contract claims.
3. 3Traffic Logs: Retained for the statutory duration mandated for hosting providers under Law No. 5651.
4. 4Temporary Uploads: Uncompleted temporary uploads are purged within 24 hours.
5. 5Draft Listings: Inactive draft listings may be cleaned after 90 days following user notification.

Under Article 11 of KVKK, you possess rights to learn whether your data is processed, request information, request correction of inaccurate data, request erasure under Article 7, and claim compensation for damages resulting from unlawful processing.

Requests may be submitted to privacy@vellium.dev via your verified account email or certified digital signature. Responses are issued within 30 days free of charge.