1. Controller and scope
1.1. Data controller (Veri Sorumlusu): ReWasteHub Dijital Platform Hizmetleri Ticaret Limited Şirketi, 19 Mayıs Mah. 19 Mayıs Cad. Golden Plaza No: 3/16, Şişli / İstanbul 34363, Türkiye (the "Company", "we").
1.2. This Policy covers personal data of User Representatives and other people who use rewastehub.com, company data of Users, and technical data.
1.3. The Platform is international; the GDPR, Turkey's KVKK and other laws may apply. We aim for a high standard of protection everywhere.
2. Data we process
2.1. Company data: short name, legal entity name (used for invoices and verification, not shown publicly), legal form, registration and tax numbers, tax office, address, company locations (branches), country, website or social media profile, industry, and Additional details about the business if you write them.
2.2. Contact person data: name, position, business email, phone, WhatsApp number for notifications (if provided).
2.3. Account data: login email, password hash, settings (language, reference currency, notification preferences), role.
2.4. Content: listings, photos, messages and files exchanged in Conversations, reports.
2.5. Verification data: results of our checks and documents you upload (registration or tax certificates, licences).
2.6. Commercial data: invoice requests, billing details, payment records, plan history.
2.7. Consent records: what you agreed to, the document version and the date.
2.8. Usage and technical data: IP address and the country derived from it (used to choose the reference currency), browser, device, language, action logs, security logs, cookies and similar identifiers, and your cookie choice (stored in your browser and, if you are logged in, in your account).
2.9. Marketing attribution: where your first and your latest visit came from — campaign parameters (UTM), ad click identifiers (gclid, fbclid, li_fat_id) and the name of the referring website — kept in a first-party cookie for 90 days and saved with your company record at registration. It contains no names or contact details.
3. Special categories of data
The Platform is not intended for sensitive categories of personal data. Please do not include them in listings, messages or files.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Registration, Account and Platform features (listings, messages, notifications) | Contract (the Terms) |
| Verification checks | Contract; legitimate interest in a trustworthy platform |
| Invoices, payments and accounting | Legal obligation; contract |
| Security, fraud and spam prevention, moderation of reports | Legitimate interest; legal obligation |
| Service emails (confirmations, reminders, notices of changes) | Contract; legitimate interest |
| Analytics and marketing measurement (Google Analytics via Google Tag Manager, Meta Pixel and Conversions API, LinkedIn Insight Tag) | Consent |
| Attribution of registrations and payments to campaigns (Section 2.9) | Legitimate interest in measuring our own marketing |
| Marketing emails | Consent (unsubscribe at any time) |
5. Who can see your data on the Platform
- Visitors who are not registered see only public listing data (category, type, location, volume, price, date, photos).
- Registered Users also see listing titles and descriptions.
- Verified companies also see the name, contact details and Additional details of the company that posted a listing, and the street address of the listing's location if it was given.
- A Conversation is visible only to its two participants. We access it only if a participant reports it, to review the report.
6. Cookies
We use necessary cookies and, with your consent, analytics and marketing cookies. Analytics and marketing tools load only after your consent (Google Consent Mode v2 with everything denied by default), in every country. Your choice is kept for 12 months and can be changed at any time with "Cookie settings" at the bottom of every page. Details are in the Cookie Policy.
7. Sharing with others
7.1. With other Users, as described in Section 5.
7.2. With service providers that process data on our behalf: hosting and database (Supabase, servers in the European Union, Ireland), content delivery and security (Cloudflare), transactional email (our email provider), business email for your messages to us (Zoho, servers in the European Union), encrypted backups of the database (GitHub, United States; the backup is encrypted before it leaves our systems), analytics and advertising partners (Google, Meta, LinkedIn — only with your consent), payment providers for invoices. If you accept marketing cookies, our server also reports some actions to Meta (Conversions API): registration, the first message to a company, submitting a listing, requesting an invoice, a payment and the contact form; your email address and phone number are sent only as one-way hashes (SHA-256), never in readable form.
7.3. With professional advisers and public authorities where required by law.
7.4. We do not sell personal data.
7.5. WhatsApp and social networks. The WhatsApp button and the WhatsApp links on the Platform open WhatsApp (a service of WhatsApp LLC / Meta) with a prepared message to our business number; the icons link to our pages on LinkedIn, Facebook and Instagram (Meta) and X. They are plain links: nothing is sent to these services while you only browse the Platform. If you write to us on WhatsApp or interact with our pages there, those services process your data under their own privacy policies, and we receive what you send us (for example your phone number, name and message) and use it to answer you. If you have accepted analytics or marketing cookies, we count a click on the WhatsApp button as an event without personal data.
8. International transfers
8.1. Our database and files are stored on servers in the European Union. Some providers (for example, content delivery, email and analytics) may process data in other countries, including the United States.
8.2. We use contractual safeguards and technical measures (access control, encryption in transit, and encryption of backups before they are stored).
8.3. Where KVKK or other law requires separate consent for transfers abroad, we ask for it with a separate, unticked checkbox at registration.
9. Retention
| Data | Retention |
|---|---|
| Account and company data | while the Account is active; after closure up to 10 years to the extent required by law |
| Listings | while active; a listing not renewed after 90 days is deleted; photos of deleted listings are deleted after 90 days |
| Message text | while both Accounts exist; then as required by law |
| Files in Conversations | 30 days after the last message in the Conversation (longer only while a report about it is being reviewed) |
| Files of a deleted Account | deleted 30 days after the Account is deleted |
| Verification documents | for the verification period and up to 12 months after it ends |
| Invoices and payment records | as required by tax and accounting law |
| Consent records | as long as needed to prove consent |
| Cookie choice | 12 months in your browser; in your account until you change it |
| Attribution data (Section 2.9) | 90 days in the cookie; with the company record while the Account is active |
| Security logs | at least 1 year, no more than 2 years |
| Server error logs (no personal data: page address without parameters and the error message) | 90 days |
| Encrypted backups of the database | weekly copies, each deleted automatically after 90 days |
When a period ends, data is deleted, anonymised or archived.
10. Security
We apply reasonable technical and organisational measures, including access rules in the database, encryption in transit, two-factor authentication for administrators and limits against abuse. No system is completely secure.
11. Your rights
11.1. Depending on the law, you have the right to access, rectify, delete, restrict, port and object to processing of your data, and to withdraw consent.
11.2. You can change most data and notification settings in your profile, and withdraw cookie consent in the cookie settings.
11.3. Other requests are accepted in writing through the contact form, info@rewastehub.com or WhatsApp +90 501 644 76 71 (messages only). We may ask you to confirm your identity and authority, and we respond within the time limits set by law.
11.4. You may lodge a complaint with your data protection authority (in Türkiye, the KVKK Board).
12. Marketing communications
Service notices may be sent without separate consent. Marketing messages are sent only with consent and can be unsubscribed via the link in each email or in your profile.
13. Changes
We may update this Policy by publishing a new version with its effective date and will notify you of material changes.
14. Contact
ReWasteHub Dijital Platform Hizmetleri Ticaret Limited Şirketi, 19 Mayıs Mah. 19 Mayıs Cad. Golden Plaza No: 3/16, Şişli / İstanbul 34363, Türkiye · info@rewastehub.com · WhatsApp +90 501 644 76 71 (messages only). Phone calls are not supported.