1 Controller and scope
Bright Point Technology, a Turkey-based company that owns and operates WeQure, is the data controller for the WeQure processing described here. Privacy enquiries and rights requests: info@wequre.com. General support: info@wequre.com.
This notice covers visitors, professional members, employer representatives and people contacting WeQure. It explains how personal data are used for the pan-Arab professional community, profiles and verification, communities, jobs, notifications and WeQure AI. It is an information notice under Article 10 of Turkish Law No 6698 (KVKK), not a request for blanket consent.
External employers and application sites generally determine their own processing of job applications. Their notices apply to that processing. Additional mandatory rights may apply in your country.
2 Data and collection methods
You provide account and contact details, professional profile information, community contributions, preferences, employer details and job listings through forms and use of the platform. Verification submissions include the credentials you upload, status information and review communications. Support, reports and appeals provide additional correspondence and evidence.
We collect service activity and technical data through interactions with WeQure, such as notification activity, saved opportunities, device and browser information, IP addresses and security or error records. Cookies and similar device storage are addressed separately in the Cookie Policy.
WeQure AI processes your prompts and content submitted with a request. Requests pass through Lovable AI Gateway to Google Gemini to generate responses. Do not submit patient-identifiable information, confidential records or unnecessary personal data.
Data may also come from other members’ reports or mentions, employer representatives and verification-related sources. Any credential check against external registers must be disclosed before it is used; submission of a document is not permission for unrestricted background checks.
3 Purposes and processing grounds
Account access and requested features: we use necessary account, profile and activity data to provide the service you request, relying on contract necessity under Article 5(2)(c). Optional public profile fields must be proportionate to the feature and your choices.
Verification: we use submitted professional evidence and review records to assess the badge you request under Article 5(2)(c), to the extent objectively necessary. Anti-impersonation and fraud prevention may rely on a documented legitimate-interest assessment under Article 5(2)(f). Special category data require a separate Article 6 ground.
Communities, jobs and notifications: we use your contributions, employer listing details, saved opportunities and preferences to deliver the requested features under Article 5(2)(c). Relevance and matching uses must be limited to the disclosed service. Promotional communications require separate permission where applicable; subscribing to community notifications is not marketing consent.
Security, moderation and support: necessary access records, reports, appeals and correspondence support platform integrity and dispute handling. The relevant grounds are Article 5(2)(f) for proportionate legitimate interests, Article 5(2)(e) for legal claims, and Article 5(2)(ç) for a specific legal obligation where one applies.
AI assistance: necessary prompt content is processed to answer your request under Article 5(2)(c). That ground does not authorise unrelated training, sensitive-data use or an overseas transfer without the required safeguards. Optional analytics and other consent-based activities rely on specific, informed, freely given consent under Article 5(1).
Where consent is the ground, you may refuse or withdraw it without losing unrelated core features. Withdrawal applies going forward. We identify the applicable ground for each activity rather than treating all listed grounds as interchangeable.
4 Sensitive data and patient information
WeQure is a professional community, not a patient-record or clinical-care service. Do not submit identifiable patient information or unnecessary health, biometric, religious, criminal-record or other sensitive information in profiles, posts, verification files or AI prompts.
If requested evidence would reveal special category data, the collection must be minimised and a valid ground under amended Article 6 established before processing, with the safeguards required by the Board. Being a healthcare platform does not automatically qualify us for a healthcare-treatment exception. Accidental receipt requires restricted handling, assessment and appropriate deletion or other lawful action.
5 Visibility and recipients
Profile information and community contributions are displayed through the relevant WeQure features. Information shared publicly may be copied or indexed outside WeQure. Do not assume that professional community content is confidential. Verification documents are submitted through the private verification workflow; the resulting badge or status may be visible on your profile and posts.
Authorised administrators, moderators and support personnel may access data needed for verification, safety, appeals and support. Infrastructure, storage, authentication, delivery and security providers may process data on our behalf for those services, subject to appropriate restrictions.
Lovable AI Gateway and Google Gemini process AI requests to provide responses. We may also disclose necessary data to professional advisers, competent authorities or courts where legally justified.
An employer may view information you make visible through WeQure. Clicking an external application link takes you to a separate service; information you then submit is collected there. Any click or referral measurement by WeQure remains subject to this notice and the Cookie Policy.
6 Overseas transfers
Using providers outside Turkey can involve overseas processing or remote access. Such transfers require a lawful processing ground and a valid mechanism under Article 9 of KVKK. These requirements apply separately from the processing grounds described above.
The revised Article 9 framework allows transfers with an applicable adequacy decision or, where its conditions are met, appropriate safeguards such as a Board-standard contract. Exceptional incidental-transfer grounds are not a routine solution for continuing cloud or AI operations. Consent to this policy does not itself authorise a transfer.
You can request information about recipients and relevant safeguards from info@wequre.com. Any safeguards must also address onward transfers. Separate restrictions in a user’s country may require further measures.
7 Retention and deletion
We keep identifiable data only while justified by the stated purpose or a legal requirement. Account and profile records support the active account; verification evidence should be retained only as needed for review and justified challenges; moderation and security records require proportionate periods. AI history and technical logs require distinct limits.
When the reasons for processing end, data must be erased, destroyed or genuinely anonymised under applicable rules. Retention depends on the account or service relationship, the completion of verification or support, security needs, applicable legal periods and any specific legal hold. Account closure does not mean immediate removal from backups or independent recipients. You may request information about retention and deletion through our privacy contact.
8 Your rights and how to use them
Under KVKK Article 11 you may learn whether your data are processed; request information about processing, its purpose and whether use matches that purpose; learn recipients in Turkey or abroad; request correction; request erasure or destruction when Article 7 conditions are met; request that relevant corrections or deletions be communicated to recipients; object to an adverse result produced solely by automated analysis; and seek compensation for unlawful processing.
Send requests to info@wequre.com using the email previously supplied to and recorded by WeQure,. Other legally recognised methods include registered electronic mail (KEP), secure electronic signature, mobile signature or a dedicated request application where available. Contact us for the applicable route; ordinary email does not replace every formal method.
Include your name, request, notification address, relevant contact details and supporting information. Formal applications require the particulars prescribed by the Turkish application communiqué, including a signature for written requests and, as applicable, Turkish identity number or nationality and passport or other identification number for foreign nationals. We will seek proportionate verification through a secure route; do not email unnecessary identity documents.
We respond as soon as practicable and within 30 days. Requests are normally free; only authorised tariff charges for extra costs may apply, with reimbursement where our error caused the request. We explain any refusal.
If refused, inadequately answered or unanswered within the legal period, you may complain to the Turkish Personal Data Protection Board after first applying to us. The statutory limits are 30 days from learning our response and in all cases 60 days from your application. If no response arrives within 30 days, do not wait beyond the 60-day limit. Judicial remedies and applicable local regulator rights remain available.
9 Matching security and changes
Job matching and notification selection may use professional profile and preference information to suggest opportunities. A match is not an employment decision. Contact us to question inaccurate information or an adverse outcome produced solely through automated processing.
We apply appropriate technical and organisational measures and limit access according to purpose. No system is completely secure. Report a suspected incident to info@wequre.com. Where notification duties arise, we will notify the competent authority and affected people as required.
WeQure is intended for adults aged 18 and above. Contact us if a child has provided personal data. We will publish changes with a revised date and supply a new notice before materially different processing; where required, we obtain fresh consent.