Privacy Notice

This notice explains how your personal data is processed when you use the MarinersLobby platform, in accordance with Turkish Personal Data Protection Law No. 6698 ("KVKK"). Our principle in designing the platform has been simple: don't collect data we don't need, show what we collect only to the people who need it, and delete it when its time is up.

1. Data Controller#

Your personal data is processed by MarinersLobby ("we") as the data controller.

• Email: [email protected]

2. What Personal Data We Process#

Account and contact details: email address, display name, profile and cover image (if you upload them), your preferred language and notification settings.

Professional information: rank or position, department, length of experience, your vessel experience (vessel name, type, company, dates), sea service, education, certificates and competencies, languages and English test result, nationality, location and your profile summary.

Job search preferences: your "open to work" status, availability date, salary expectation, vessel type and internship preferences.

Medical certificate expiry dates (optional): processed only if you declare the expiry date of your medical certificate and yellow fever vaccination certificate yourself and give your explicit consent for it. No certificate, certificate number, diagnosis or other health information is collected or stored.

Application and recruitment information: the jobs you apply to, your cover letter, the status of your application, the tags the employer keeps for your application and interview appointments.

Communication content: your messages in application channels and direct chats, what you write in chat rooms, your questions and answers in the forum, your votes, saved jobs and searches, and your connections.

Student area: your school email address (for verification only) and the information you share on your student card (school, year, city, short introduction).

Corporate members: company name, tax number, website, an email address on the company's domain, address, fleet information, logo and images, and published job postings.

Security and activity records: an irreversibly hashed form of your password, session records, IP address, browser information, sign-in times, which version of our terms you accepted and when, when you declared that you are over 18, and reports and moderation records.

Traffic records: access records that must be kept under Turkish Law No. 5651 (IP address, time, requested address).

Data we do not process: images of ID cards, passports, seaman's books or certificates; medical reports; location tracking; behavioural data for advertising or marketing.

3. How We Collect Personal Data#

Your personal data is collected electronically from the information you enter in the registration, profile, job posting and application forms, from records created while you use the platform (session, activity and traffic records), and from information that an employer you applied to keeps about your application on the platform.

4. Purposes and Legal Grounds#

• Setting up your membership and managing your account; providing the profile, job, application, messaging, forum and student area services: establishment and performance of a contract (KVKK Art. 5/2-c).
• Forwarding your application to the employer and running the application process: performance of a contract (KVKK Art. 5/2-c).
• Comparing your profile with job requirements (match indicator) and notifying you of matching jobs: performance of a contract (KVKK Art. 5/2-c) and legitimate interest (KVKK Art. 5/2-f). The comparison is for information only; the platform takes no automated decision about you.
• Company verification: performance of a contract and the legitimate interest of protecting users from fake employers (KVKK Art. 5/2-c, f).
• Account security, preventing fraud and misuse, content moderation and reviewing reports: legitimate interest and the establishment, exercise or protection of a right (KVKK Art. 5/2-e, f).
• Keeping traffic records and complying with requests and decisions of competent authorities: express provision in law and legal obligation (KVKK Art. 5/2-a, ç).
• Keeping records of accepted terms and activity logs: legal obligation and the establishment, exercise or protection of a right (KVKK Art. 5/2-ç, e).
• Service emails (verification codes, password resets, application and message notifications): performance of a contract (KVKK Art. 5/2-c). No commercial electronic messages are sent without your explicit consent.
• Medical certificate expiry dates: your explicit consent (KVKK Art. 6). You give it with a separate box when you add these dates; what is processed, why and who sees it is set out in the Explicit Consent text. Entering these dates is entirely optional; you can withdraw your consent from your profile at any time, and all the dates are deleted at that moment.
• Aggregate figures about platform use (numbers of members, jobs, questions, etc.): legitimate interest (KVKK Art. 5/2-f); these figures do not identify anyone.

5. Who Can See Your Information#

• Your profile: You choose its visibility in settings (everyone, members only, your connections, or employers only).
• Your job search information: Your open-to-work status, availability date, salary expectation and medical certificate dates are visible only to verified employers and to companies you have applied to. Companies you block cannot see this information.
• Your applications: Visible only to the company you applied to.
• Your messages: Visible only to the people in the conversation. What you write in public chat rooms is visible to the members of that room.
• Your forum content: Forum questions and answers are public and may appear in search engines.
• Your student card: You choose who can see it (students only, members, or everyone).
• Search engines: Personal profiles are closed to search engines. Job postings, company pages and the forum may appear in search results.

6. Transfers of Personal Data#

Your personal data is transferred only to the following recipients and only for the stated purpose:

• Employers you apply to: When you apply, your profile, CV and application details are shared with the company. The employer processes this data for its own recruitment process as a separate data controller.
• Our service providers (data processors): Third-party service providers needed for the platform to operate, acting only on our instructions: server hosting, domain name and traffic protection, file storage, encrypted backups, email delivery, company email and error monitoring services. Requests to the site, including your IP address, pass through the traffic protection service's network. Error monitoring receives only technical error details (the error type and message, the path of the page where it happened, the browser type); your name, email address, IP address and session details are not sent.
• Competent public authorities and courts: Within the scope of our legal obligations and to the extent requested.

Because some of our service providers are located abroad, your personal data may be transferred abroad; such transfers are made in accordance with Article 9 of the KVKK.

Your personal data is never sold and is not shared with third parties for advertising or marketing.

7. Retention Periods#

• Your account information and content: For as long as your account is open. When you ask for your account to be deleted, it is closed immediately, kept in a recoverable state for 180 days, and permanently deleted at the end of that period.
• Session records (IP address, browser information): Deleted 30 days after the session ends.
• Read notifications: Deleted after 90 days.
• Traffic records: Kept for 1 year as required by Law No. 5651, then deleted.
• Audit and moderation records: Kept for 2 years. When your account is deleted, the link between these records and your identity is removed.
• Backups: Encrypted database backups are deleted after 35 days and encrypted backups of traffic records after 400 days; a deleted account disappears entirely from backups once they expire.

Data whose retention period has ended is deleted automatically by a destruction process that runs every day.

8. Security Measures#

The main measures we take to protect your data:

• All connections are encrypted (HTTPS). Passwords are stored only in irreversible form (Argon2id).
• Verification codes and reset links are not stored in plain text and expire quickly.
• Documents such as ID cards and medical reports are never collected; data that isn't stored can't leak.
• Every request is authorised; who can see which information is decided on the server.
• Sign-in attempts, code requests and bulk actions are protected by rate limits.
• Important actions are logged; backups are encrypted and kept with a separate provider.

9. Cookies#

The platform uses only cookies that the service needs to work. No advertising, analytics or tracking cookies are used, so no cookie consent is requested. Details are in the Cookie Policy.

• ml_at: Shows that you are signed in. Valid for 15 minutes.
• ml_rt: Used to renew your session; sent only to the session renewal address. Valid for 30 days and deleted when you sign out.
• ml_csrf: A security cookie that stops other websites from acting on your behalf. Valid for 30 days.
• ml_reg: Recognises the browser in which registration started. Valid for at most 24 hours.
• NEXT_LOCALE: Remembers which language the site opens in; written according to the language you open on your first visit. Valid for 1 year.
• ml-theme: Remembers your light or dark theme preference. Valid for 1 year.

The site is served through an infrastructure service that provides security and traffic protection; this service may set security cookies to tell suspicious traffic apart. Fonts and all other files are loaded from the platform's own server; our pages do not load files from other sites such as advertising, analytics or font services.

10. Your Rights Under the KVKK#

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request its deletion or destruction under the conditions in Article 7 of the KVKK,
• request that corrections, deletions and destructions be notified to third parties to whom the data was transferred,
• object to a result against you arising from analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing.

Within the platform: From the settings screen you can download a copy of your data, correct your profile information and request the deletion of your account.

By application: For other requests, you can apply from your registered email address to [email protected]. Applications are concluded free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller. If your application is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.

If you are located in the European Union, your rights under the General Data Protection Regulation (GDPR) are also reserved.

11. Persons Under 18#

The platform is intended for people aged 18 and over. Accounts we find to belong to someone under 18 are closed and their data deleted.

12. Changes to This Notice#

We may update this notice because of changes in the law or new services. The current version and its effective date are published on this page; significant changes are also notified to your registered email address.

13. Contact#

For questions about this notice: [email protected]

In case of any inconsistency between the Turkish and English versions of this notice, the Turkish version prevails.