Recipient Privacy Notice
Effective date: [DOLDURULACAK] · Last updated: [DOLDURULACAK]
You are on this page because you received a business email. This notice explains how your personal data is processed in connection with a business email sent to you by a company using the Leadivo service, as required by Art. 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the Turkish Communiqué on the Obligation to Inform and, where applicable, Art. 14 of the EU General Data Protection Regulation ("GDPR"). The Turkish version (Alıcı Aydınlatma Metni) is authoritative.
If you do not want to receive further emails: simply click the opt-out (unsubscribe) link at the bottom of the email or reply to the email with "unsubscribe" (or "çıkar"). Your request is applied immediately and in any case within the three business days required by Turkish law, and you will not be contacted again on behalf of the same sender. You do not need to give a reason and it is free of charge.
1. Who is the controller?
The controller is the business that sent you the email and whose legal name, MERSIS/tax ID, address and contact email appear in the email footer (the "Sender"). The Sender decides why you are contacted and which kinds of companies' staff are contacted.
[DOLDURULACAK] ("Leadivo"; MERSIS: [DOLDURULACAK]; address: [DOLDURULACAK]; email: [DOLDURULACAK]; KEP: [DOLDURULACAK]) is the processor acting on behalf of and on the instructions of the Sender. This notice is published by Leadivo on the Sender's instruction and on its behalf.
Why did the email come from a different domain? To protect the email reputation of its primary domain, the Sender uses secondary sending domains opened in its name. The actual sender of the email is the business identified in the footer.
2. What personal data do we process?
| Category | Data |
|---|---|
| Identity | First name, last name |
| Professional | Job title, department, seniority, your company's name, industry, size and domain; your public LinkedIn profile URL where available |
| Contact | Business email address |
| Location | City/country and time zone (so the email arrives during business hours) |
| Marketing and transaction | Emails sent to you, sending and delivery status, your replies and their classification as positive/neutral/negative, date of opt-out or objection |
| Meeting | If you book a meeting: your name, email address, meeting date and time |
Special categories of personal data (health, religion, political opinions etc.) are not processed and not used for targeting.
3. Where did we get your data?
Your data was not collected directly from you. The Sender defined its target market (industry, job title, company size and region), and Leadivo obtained your data on that basis from the business contact database provider ZenLeads, Inc. d/b/a Apollo.io ("Apollo"). Apollo is an independent controller that compiles data from publicly available professional sources and partners under its own privacy policy. To ask Apollo to remove you from its database, use the methods on Apollo's privacy page.
Reply and meeting data is obtained from you if you reply to the emails or book a meeting through the Sender's booking page.
4. Purposes and legal bases
| Purpose | KVKK | GDPR |
|---|---|---|
| Presenting the Sender's goods and services to you in a way likely to be relevant to your professional role and proposing a business meeting (first email and up to two follow-ups) | Art. 5(2)(f) — legitimate interest | Art. 6(1)(f) — legitimate interest |
| Forwarding your reply to the Sender and scheduling a meeting | Art. 5(2)(f); Art. 5(2)(c) if you request a meeting | Art. 6(1)(f); Art. 6(1)(b) |
| Applying your opt-out and objection requests, ensuring you are not emailed again, and evidencing this | Art. 5(2)(ç) — legal obligation (Law No. 6563 and Arts. 9, 10, 13 of the Regulation on Commercial Communication and Commercial Electronic Messages) | Art. 6(1)(c) and 6(1)(f) |
| Ensuring information security and preventing abuse | Art. 5(2)(f) | Art. 6(1)(f) |
Summary of the legitimate interest assessment: The Sender's legitimate interest is to present its services to decision makers at businesses likely to be interested in them. Processing is limited to your professional contact data and at most three emails. It has been assessed that, given your professional role, you can reasonably expect to receive business offers at your business email address. Every email offers a one-step opt-out, your request is applied permanently and your data is kept for a limited period. Under Art. 6(3) of the Turkish Regulation on Commercial Communication and Commercial Electronic Messages, prior consent is not required for commercial electronic messages to merchants and tradespeople, but once you opt out no further messages are sent. You can request the details of the assessment from the Sender.
No automated decision producing legal effects concerning you or similarly significantly affecting you is made. AI classification of your reply only determines whether the Sender is notified and whether opt-out replies are applied.
5. Who receives your data?
- The Sender: your contact record, replies and meeting details are made available to the Sender.
- Leadivo and its sub-processors: database and hosting (Supabase Inc., Vercel Inc.), email sending infrastructure (mailbox service: Instantly.ai DFY (Google Workspace); mailboxes are hosted on Google Workspace infrastructure), AI models for personalising emails and classifying replies (Anthropic PBC and/or OpenAI; under these providers' commercial API terms, content is not used for model training by default), and notification delivery to the Sender (Resend). Current list: Sub-processors.
- Services chosen by the Sender: the Slack workspace receiving notifications and the calendar service used for meetings (Cal.com) are the Sender's own service providers.
- Competent authorities: where required by law.
Your data is not sold, not shared with other businesses and not used for Leadivo's own marketing.
International transfers: some of the providers above are established in the United States. Transfers are protected by the standard contracts published by the Turkish Personal Data Protection Board, signed and notified to the Turkish Personal Data Protection Authority under Art. 9 KVKK; for persons in the European Economic Area, by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
6. How long is your data kept?
| Data | Period |
|---|---|
| Identity, professional and contact data | While you are active in a campaign and at most 12 months after the last interaction |
| Emails sent and replies | 12 months |
| Meeting records | 12 months from the meeting date |
| Opt-out/objection record | As long as necessary to ensure you are not emailed again; minimum data only (your email address, date and channel; no later than 60 days after the Sender's relationship with Leadivo ends, only a one-way hash of your email address, date and channel). 3 years from the end of that relationship due to the evidentiary obligation under Turkish law. |
| Your email address on the sending infrastructure's block list | As long as that infrastructure is used; only your email address, so that you are not emailed again through it on behalf of any sender |
If the Sender's relationship with Leadivo ends, your data, except the opt-out record, is deleted within 60 days at the latest.
7. Your rights
Under Art. 11 KVKK you have the right to learn whether your data is processed, request information, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred, request rectification, erasure or destruction, request that these actions be notified to recipients, object to a result to your detriment arising exclusively from automated analysis, and claim compensation for damage.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and the right to object at any time and without giving reasons to processing for direct marketing (Art. 21(2)–(3) GDPR), as well as the right to lodge a complaint with the supervisory authority in your country.
8. How to exercise your rights
- To stop receiving emails: use the opt-out link in the email or reply "unsubscribe".
- Other requests: you can send your request directly to the Sender at the contact address in the footer. You may also send it to [DOLDURULACAK]; in that case it will be forwarded to the relevant Sender within 2 business days at the latest, and opt-out and objection requests will be applied immediately on the Sender's behalf. Forwarding the email you received or naming the Sender helps us identify which Sender your request concerns.
Under the Turkish Communiqué on the Procedures and Principles of Application to the Controller, KVKK requests can be made in writing, by KEP, with a secure electronic or mobile signature, or from an email address previously notified to and registered with the controller. Requests are answered free of charge within 30 days. If your request is rejected, the answer is insufficient or no answer is given in time, you may complain to the Turkish Personal Data Protection Board under Art. 14 KVKK.