Notice on professional data compiled from public sources

Version 1.0 · Last updated: 6 November 2026

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform people whose personal data is not obtained directly from them and whose business and professional details may appear on Alvara AI (the "Platform"). It is issued by the company that operates Alvara AI (the "Company") as data controller.

1. Who this notice concerns

People who work at a company or organisation and appear in public sources under their professional identity, for example a manager, founder or head of department.

2. Data controller

Email: info@alvaraai.com

3. What data we process

Only business and professional data is processed:

Data we do not process: special categories of personal data (such as health, religion, political opinion, trade union membership), information about private life, identity numbers, financial information and data of anyone under 18. The Platform is not designed to target personal email addresses or personal telephone numbers.

4. Where we obtain the data

Data is obtained by automated means, through a data provider gateway, from companies' own websites, press releases and news sites, official publications such as the trade registry gazette, public professional profiles, industry directories, event pages and lawfully operating third-party business data providers (web search, company information and business contact information providers). Most of it is obtained in response to company and people searches, enrichment and verification requests made by Platform customers. The source and date of each piece of data are stored for every record and will be given to you on request.

The data is kept in the Company's central database. So that the same data does not have to be obtained again for every search, data obtained from one customer's search may also be made available to other customers who use the Platform. This is an access service, not a sale of data.

5. Our purposes

• Giving Platform customers business information about relevant companies and the right contacts there, for business-to-business development, sales and cooperation,
• keeping the data in a central database and making it available to more than one customer,
• checking the accuracy and currency of the data and removing duplicate and faulty records,
• carrying out refusal and objection requests and managing the suppression list,
• protecting rights in legal disputes and answering requests from authorities.

6. Legal bases

Your data is processed on these grounds under KVKK Article 5/2:

• (d) the data has been made public by the data subject, only to the extent compatible with the purpose of making it public (for example business details published for professional contact),
• (f) the legitimate interests of the Company and Platform customers in business development, provided that the fundamental rights and freedoms of the data subject are not harmed.

In our legitimate interest assessment we rely on processing professional data only, excluding special categories of data and offering an easy way to object.

7. Who receives your data

Platform customers. Your data may be made available for B2B business development to our corporate customers, who are bound to follow the Terms of use and the Acceptable use policy. When customers use this data for their own purposes (for example to contact you) they are independent data controllers; they must inform you at first contact, obtain your consent where the law requires it and honour your refusal.

Service providers. Providers of hosting, database, data provider gateway, search, data verification and AI services. Their servers are outside Türkiye: the database and backups are in the European Union, the application server is in Germany, the data provider gateway and data providers are abroad, and the language model service is in China. For your Platform Data profile, only your professional details (name, job title, company) are sent to the language model; the email address and telephone number in that profile are not. For the full list of recipients, see the KVKK privacy notice. Transfers abroad are made under KVKK Article 9.

Authorities. Public authorities and courts that are legally authorised to request data.

8. How long we keep it

Your data, including responses received from data providers, is kept for as long as it remains current. At your request your data is deleted or anonymised; retention obligations under law remain reserved. If you refuse or object, your data is deleted, including provider responses and source records, and is prevented from being added again. To prevent it from being compiled again, only the minimum information needed for that purpose is kept on the suppression list.

9. Your rights, refusal and objection

You may exercise all your rights under KVKK Article 11 (requesting information, correction, deletion, objection).

If you want to be removed from the Platform: send an email to info@alvaraai.com with the subject "I request the removal of my data" and state your name and the record you want removed (for example a company name or email address). Your request is answered free of charge within 30 days at the latest. Removed data is not made available to Platform customers again.

If you received a message from a Platform customer: the company that sent it is the data controller for that communication. You can use the refusal route in the message or contact the sender directly. We forward any such requests that reach us to the relevant customer.

For other ways to apply, see the Data subject requests page.