Information notice under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) for talent, brand representatives and visitors.
1. Controller
Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Oryvelon LLC (the "Company") as controller, as described below. Address: Delaware, United States. E-mail: info@castlyra.com.
The Company's controller representative in Türkiye will be listed here once appointed.
2. Categories of personal data
- Identity: name, display name, date of birth.
- Contact: e-mail address, phone number (required for talent, optional for businesses).
- Professional: categories, experience level, skills, languages, portfolio and social links, availability.
- Visual records: photos uploaded with an application.
- Physical characteristics (optional): height, sizes, shoe size, bust/waist/hips, hair and eye colour.
- Customer/transaction: enquiry content, company details, application status and correspondence.
- Transaction security: one-way hashed value derived from the IP address, session information, audit logs.
- Marketing (with consent): newsletter preference, analytics cookie data.
3. Purposes
- Running the membership and application process and reviewing applications,
- Publishing approved talent profiles and presenting them to brands,
- Receiving and answering brand and business enquiries,
- Age (18+) checks, content moderation, fraud and abuse prevention,
- Information security and improving the Service,
- Complying with legal obligations, informing authorities and handling legal matters,
- With your explicit consent, sending announcements and newsletters and measuring usage.
4. Collection method and legal grounds
Your data is collected electronically, fully or partly by automated means, through the application, sign-in and enquiry forms on castlyra.com, e-mail correspondence and cookies.
It is processed under KVKK Art. 5(2) on the grounds that processing is directly related to the formation or performance of a contract (c), necessary to comply with a legal obligation (ç), necessary to establish, exercise or protect a right (e), and necessary for our legitimate interests provided your fundamental rights are not harmed (f). Publishing your profile, marketing communication and analytics cookies are based on your explicit consent under KVKK Art. 5(1).
We do not ask for special-category data. Photos are not processed by biometric methods such as facial recognition.
5. Transfers
Your data may be transferred, limited to the purposes above, to suppliers providing hosting, database, file storage, e-mail delivery, security and (with consent) analytics services; to brands and the public as regards published profile information; and to authorised public bodies.
Our database is in the European Union (Germany), the Company is based in the USA and some suppliers are abroad. Cross-border transfers are made under KVKK Art. 9: to countries with an adequacy decision; otherwise where appropriate safeguards such as a standard contract notified to the Board are in place; and, in incidental cases where neither applies, under the exceptions in Art. 9(6).
6. Retention
Data is kept for as long as the purpose requires and as required by law; the detailed periods are in the "Retention" section of the Privacy Policy. At the end of the period data is deleted, destroyed or anonymised.
7. Your rights under KVKK Art. 11
- To learn whether your personal data is processed and to request information about it,
- To learn the purpose of processing and whether data is used accordingly,
- To know the third parties in Türkiye or abroad to whom data is transferred,
- To request correction of incomplete or inaccurate data,
- To request deletion or destruction under the conditions of KVKK Art. 7,
- To request that corrections, deletions and destructions be notified to third parties who received the data,
- To object to a result against you arising exclusively from automated analysis,
- To claim compensation for damage caused by unlawful processing.
Application decisions are made by our team, not by automated systems.
To exercise your rights, write to info@castlyra.com from the e-mail address registered with us or use the other methods in the Data Request Guide. Requests are answered free of charge within 30 days; if the action involves additional cost, the fee set by the Board may be charged.