1.Data controller
Under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by CorpsLoop as data controller.
CorpsLoop is the brand and platform name of this service. The platform helps European organisations — including those in the European Solidarity Corps ecosystem — discover each other, manage organisation profiles, and build a trusted communication network.
Email: privacy@corpsloop.com
Address / contact: Yazılı KVKK başvuruları için: privacy@corpsloop.com — İletişim sayfası: https://corpsloop.com/contact
Website: https://corpsloop.com
CorpsLoop is an independent platform. It is not an official European Union service and is not a substitute for any EU programme authority or accreditation body.
2.Why this notice exists
This notice informs you how personal data is processed when you use CorpsLoop, create an account, and submit an organisation verification/claim request.
Personal data is processed only for specific, explicit and legitimate purposes, and in a manner that is relevant, limited and proportionate to those purposes.
3.What personal data we process
Account data: first name, last name, email address, login credentials, account creation date and account status. Passwords are protected with appropriate technical measures and are not stored in plain text.
Organisation data: organisation name, CorpsLoop profile details, verification applications and information you provide about your relationship with the organisation.
Organisation verification document: an activity certificate or similar official organisation document. Personal data contained in the document may also be processed as part of the document. CorpsLoop does not separately request personal information that is unnecessary for verification.
Communication and platform-use data: content and communication records you create on the platform.
Technical and security data: IP address, session data, date/time, browser, device, operating system, technical error logs, and security/access logs.
4.Purposes of processing
Creating and managing user accounts: registration, login, account security and necessary notices.
Running organisation verification: receiving claims, reviewing activity certificates, determining verification status, preventing unauthorised claims and abusive accounts, and improving trust in organisation information.
Providing the CorpsLoop platform: managing organisation profiles, discovery, organisation-to-organisation messaging and product features.
Information security: preventing unauthorised access, detecting abuse, investigating security incidents and maintaining technical security.
Legal obligations: responding to lawful requests of competent authorities, complying with legislation and protecting rights in disputes.
5.Legal bases for processing
Depending on the processing activity, we rely on the applicable grounds in Article 5 of the KVKK, including: explicit provision in law; processing directly related to concluding or performing a contract; necessity for the controller’s legal obligation; necessity for establishing, exercising or defending a right; and necessity for the controller’s legitimate interests without harming fundamental rights and freedoms.
Where processing requires explicit consent, consent is obtained separately and independently from this notice.
6.Why we ask for an activity certificate
Organisation verification is a core CorpsLoop security mechanism. When a user wants to claim an organisation or be verified as a representative, we may request an official activity certificate or similar document to assess that the organisation is genuine.
The document is used only to run the verification process: assessing the application, approving or rejecting it, and enabling review of the verification decision when needed.
The document is not used for other purposes. CorpsLoop does not separately request identity or sensitive personal data that is unnecessary for verification.
7.Third-party data in uploaded documents
Official documents you upload may contain names, signatures, roles or contact details of other individuals. Such data may be processed as part of the verification process because it appears in the document.
Where possible, avoid sharing personal information that is unnecessary for verification. CorpsLoop processes personal data in documents only for verification and only to the extent necessary.
8.Special categories of personal data
CorpsLoop does not aim to request special categories of personal data in the organisation verification process.
If uploaded official documents contain such data, processing is carried out in accordance with the relevant provisions of the KVKK. Please avoid sharing special-category personal data that is unnecessary for verification.
9.Who may receive your personal data
Authorised CorpsLoop personnel for verification, platform operations, support and security.
Technical service providers for hosting, database, file storage, email, security, monitoring and error management — only as needed.
Competent public authorities upon lawful requests.
Legal and professional advisers where necessary to meet legal obligations or protect rights.
Personal data is not sold or rented to third parties for commercial purposes.
10.International transfers
If some of CorpsLoop’s technical service providers are located abroad, personal data may be transferred internationally.
Such transfers are carried out in accordance with applicable legal requirements. Providers and transfer methods may change with the technical infrastructure.
Current requirements under Article 9 of the KVKK apply to international transfers.
11.How personal data is collected
Personal data may be collected electronically through the CorpsLoop website, registration forms, organisation verification forms, document upload fields, in-platform messaging, user actions, and automated technical/security logs.
Data may be obtained directly from you or automatically through the platform’s technical systems.
12.How long we keep personal data
Personal data is retained for as long as needed for the purposes of processing. Account data may be kept while the account is active and for periods required by law.
Activity certificates uploaded for organisation verification are deleted or destroyed after verification is complete, once the defined retention period ends, unless another legal or operational reason requires retention.
Where the outcome of verification may need to be evidenced later, minimum records of the verification result may be kept instead of the full document where possible.
When the purpose ends and no other legal ground requires retention, data is deleted, destroyed or anonymised.
13.Security of personal data
CorpsLoop takes appropriate technical and organisational measures to prevent unlawful processing of or access to personal data, and to protect against loss, alteration and unauthorised use.
Depending on the technical setup, this may include access authorisations, authentication, secure storage, logging and access controls. Access to activity certificates is limited to persons authorised for verification.
14.Your rights under the KVKK
Under Article 11 of the KVKK, you may learn whether your personal data is processed; request information; learn the purpose and whether it is used accordingly; learn the third parties to whom data is transferred; and request correction of incomplete or inaccurate data.
You may also request deletion or destruction under the conditions in the KVKK; request that such operations be notified to third parties; object to adverse results produced exclusively by automated systems; and claim compensation for damage caused by unlawful processing.
15.How to apply
To exercise your KVKK rights, contact privacy@corpsloop.com.
Written / postal contact channel: Yazılı KVKK başvuruları için: privacy@corpsloop.com — İletişim sayfası: https://corpsloop.com/contact
Applications are assessed under the KVKK and related legislation. Identity verification may be required depending on the request.
Applications are concluded as soon as possible and within thirty days at the latest; if an additional cost is required, the Board’s tariff may apply.
If your application is rejected, the reply is insufficient, or no reply is given in time, you may complain to the Personal Data Protection Board within thirty days of learning the reply and, in any event, within sixty days of the application date.
16.Updates to this notice
This notice may be updated if CorpsLoop’s services, technical infrastructure or personal-data processing activities change.
The current notice is published on the CorpsLoop website. Where processing purposes change materially, additional notice is provided as required.
17.Contact
CorpsLoop — Data controller: CorpsLoop
Email: privacy@corpsloop.com
Address / contact: Yazılı KVKK başvuruları için: privacy@corpsloop.com — İletişim sayfası: https://corpsloop.com/contact
Web: https://corpsloop.com
Last updated: 20 September 2026