Privacy Notice

1. Controller

Your personal data is processed by Winwestor Consultants Ltd., a company registered in the TRNC under number MŞ 25388, as the controller. KıbrısCV is a venture built and backed by Winwestor Labs and operated by the Company.

Contact: [email protected]

2. Data we process

• All members: name, email, phone, password (hashed only), language, sign-up and last login time, email verification status, newsletter consent.
• Candidates: headline, city, year of birth, nationality, work permit status, availability, salary expectation, driving licence, student status, experience, education, languages, skills, job preferences, uploaded CV file, applications and notes.
• Employers: company name, tax number, sector, city, website, logo and cover image, company texts, job posts.
• Visitors: session and security cookies, job report records, technical logs (IP address, browser, request time).

3. Purposes and legal bases

• Providing the service (accounts, job posts, applications, forwarding applications to employers) — performance of the membership contract.
• Transactional emails — performance of the contract.
• Security and abuse prevention — legitimate interest and legal obligations.
• Newsletters — only with your separate explicit consent, which you can withdraw at any time on the Account page.
• Legal obligations.

4. Sharing

• Employers you apply to receive your profile, contact details, note and CV file for that job only.
• Share link: if you turn it on, anyone with the link can see your CV page (you choose whether contact details are shown). These pages are not indexed by search engines.
• Service providers: hosting (netcup GmbH, servers in the EU — Nuremberg, Germany), content delivery, security and email (Cloudflare, Inc.). This involves transfers outside the TRNC, limited to providing the service.
• Authorities where required by law.

We do not sell your data and do not use advertising or analytics cookies.

5. Retention

• Account and profile data: while your account is open; deleted when you delete your account.
• Email logs: up to 12 months. Verification and reset links: up to 30 days after expiry.
• Security and technical logs: as required by providers and law.

6. Your rights

You can ask whether your data is processed and request information, correction, deletion or blocking; ask that third parties be notified; object on legitimate grounds; complain to the Personal Data Protection Board if we do not answer within 30 days; and claim compensation for damage caused by unlawful processing.

On the Account page you can download your data, withdraw newsletter consent and delete your account. For other requests, email [email protected] with the subject "Privacy request"; we reply within 30 days.