KVKK notice

01Data controller

The data controller under the KVKK and, where it applies, the GDPR is Hamla Teknoloji Anonim Şirketi (Hamla Teknoloji A.Ş.).

• Name: Hamla Teknoloji Anonim Şirketi (Hamla Teknoloji A.Ş.)
• Headquarters: Reşitpaşa Mahallesi, Katar Caddesi, İTÜ Arı 1 Teknokent Binası, No: 2/5 İç Kapı No: 33, Sarıyer / İstanbul
• Email: info@hamlateknoloji.com
• Phone: +90 (534) 012-4647 and +90 (553) 554-8970
• Product site: https://takeone.com.tr

Use info@hamlateknoloji.com for every request about your personal data. How to apply is set out in «Your rights and how to apply».

02Scope

This policy covers visitors to the product site, people who open an account on the site or in the mobile app, users of the web portal, managers and agents, casting directors and producers, and anyone who emails us.

TakeOne is an intermediary platform. Hamla Teknoloji is not a party to representation, employment, copyright, or production contracts. If another user processes your data for their own purpose outside this policy and the terms of use, that user is responsible. Please tell us if that happens.

You can open an account on the product site or in the mobile app. Sign-in is with email and password, with a Google account through Firebase Authentication, or with Apple through Firebase Authentication. Apple sign-in is offered in the iOS app and, when it is enabled, on the product site. On the site, sign-up asks for a role (talent, manager or agent, or casting and production), a display name, and, for email sign-up, a password. Profiles, auditions, calls, applications, and messages run in the mobile app and in the web portal at https://takeone.com.tr/app. The service does not take payment.

03Personal data we process

What we process depends on your account, your role, and the features you use. The table below is the inventory for the KVKK notice. You may leave optional profile fields empty. Discovery and applications work in a more limited way without some of them.

Data we do not ask for

• We do not keep payment-card, bank-account, or in-app purchase records. The platform does not currently sell a subscription or take payment.
• When you use Google sign-in, we do not access Google Contacts, Gmail, Drive, Calendar, or YouTube. From Google we receive only the basic profile information needed to sign you in.
• We do not identify people by facial recognition and we do not keep a biometric template. The one exception is the optional verified-badge application: with your explicit consent, the front camera takes three short face frames that are used only to check that your profile photos show you (see «Profile verification» below).
• We have no separate field for race, ethnic origin, health, religion, political opinion, trade-union membership, or criminal record. Do not add that information to a profile or a video on your own.
• We do not build advertising profiles, and we do not sell personal data to advertising networks. We do not use an advertising pixel. Google Analytics 4 runs on the product site and the web portal only after you accept analytics cookies. The mobile app does not send usage events to Google Analytics.

Physical appearance (height, build, hair, complexion, and similar casting traits, and the photos and videos that show them) may be special-category personal data under KVKK Article 6. We process it with the explicit consent described below, and only to run casting, discovery, and applications.

04Purposes and legal bases

We process data for the purpose it was collected, in proportion to that purpose, and in line with the principles in KVKK Article 4. The basis for each purpose is below.

You may withdraw explicit consent for the processing that relies on it. Withdrawal does not affect processing that was lawful before the withdrawal. We do not process special-category data where we cannot obtain consent. Without the account data that is necessary to perform the contract, an account cannot be opened.

We do not send commercial electronic messages (promotions, newsletters, campaigns) without a separate opt-in. Messages about account security, the status of an application, and changes to this policy are not commercial messages.

05Collection, transfers, and retention

How we collect data

• Directly from you: profile, uploaded files, applications, email, and messages.
• From Google or Apple, through Firebase Authentication, when you choose that sign-in method. Email-and-password sign-up is entered by you.
• Automatically: device information and security logs. If you accept analytics cookies on the product site or the web portal, we also record usage events (pages viewed, language, role, and funnel steps) through Google Analytics 4. We do not set a language cookie. The mobile app does not send events to Google Analytics.
• From another user: when your manager records a representation link, or when a casting team shortlists you. That record is limited to what the relationship needs.

Who receives data, and why

We do not sell or rent data. Transfers are limited to the recipients below.

A signed-in user of the app or the web portal can open a discovery profile (name, username, photo, age, location, physical traits, skills, and feed videos). Showreels and challenge videos that are marked for the feed can also be listed without a casting account. Application self-tapes and casting-reference videos are kept off that feed. They are shared with the casting account for that call and, where the application is managed, with the linked manager. The marketing pages of the product site do not publish a talent directory.

Transfers abroad

App and portal data are stored on Google Firebase and Google Cloud. Cloud Functions for the live project run in the Google Cloud region us-central1 (United States). Firestore and Cloud Storage use the location configured on that Firebase project; this repository does not name a separate region for them. The same infrastructure may also process data in countries where Google’s subprocessors operate (which may include the European Economic Area and the United States). Videos are also processed by Mux, and push notifications by Expo, which may process data outside Türkiye. The product site is published with Firebase Hosting and may be served outside Türkiye.

Transfers abroad follow KVKK Article 9. A transfer relies on an adequacy decision of the Personal Data Protection Board, or, where there is no adequate protection, on the standard contract published by the Board or on another appropriate safeguard in the Law. In exceptional, occasional cases where a safeguard cannot be put in place, the Law allows a narrow set of grounds, including performance of a contract or explicit consent given after you have been informed of the risks. For Firebase, Google generally acts as a processor. Google’s processing terms and subprocessors are described at https://firebase.google.com/support/privacy and https://firebase.google.com/terms/data-processing-terms

Retention

We do not keep data for longer than the purpose requires, or for longer than the Law requires.

06Your rights and how to apply

Under KVKK Article 11 you may apply to the controller and ask to:

• Learn whether your personal data is processed.
• Request information if it has been processed.
• Learn the purpose of the processing and whether it is used in line with that purpose.
• Know the third parties, in Türkiye or abroad, to whom it is transferred.
• Ask for correction if it is incomplete or inaccurate.
• Ask for deletion or destruction under the conditions in KVKK Article 7.
• Ask that correction and deletion be notified to third parties to whom the data was transferred.
• Object to a result which is to your detriment and which is produced solely by automated analysis.
• Claim compensation if you suffer damage because your data was processed unlawfully.

Whether you are cast is a human decision by a casting director or producer. TakeOne does not evaluate you by a wholly automated decision that produces a legal effect.

How to apply

Send KVKK Article 11 requests to info@hamlateknoloji.com, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We need to be able to verify your identity. An application on behalf of someone else requires a notarised power of attorney or another authority the Law accepts.

• Email: info@hamlateknoloji.com. Put «KVKK başvurusu» in the subject line. Writing from the email on the account makes the identity check faster.
• You may also apply to info@hamlateknoloji.com with a secure electronic signature or a mobile signature.
• In writing: you may deliver a wet-signed petition by hand or by post to the company headquarters at Reşitpaşa Mahallesi, Katar Caddesi, İTÜ Arı 1 Teknokent Binası, No: 2/5 İç Kapı No: 33, Sarıyer / İstanbul.

We conclude the request as soon as the nature of it allows, and in any event within thirty days, free of charge. If the operation itself has a further cost, a fee may be charged that does not exceed the tariff of the Personal Data Protection Board.

If your request is rejected, if you find the answer insufficient, or if it is not answered in time, you may complain to the Personal Data Protection Board under KVKK Article 14. As a rule, you apply to the controller before that complaint.

07Google user data

Google sign-in is one way to open a session, on the mobile app and on the product site, through Firebase Authentication. Email and password, and Apple sign-in, are separate methods and are not Google user data. This section is our commitment under the Google API Services User Data Policy for information received from Google APIs.

Data received from Google

• Name
• Email address
• Profile photo
• The account identifier needed to tie the session to your Google account

Access is limited to the basic profile scopes needed to create an account and sign in. We do not request or read Contacts, Gmail, Drive, Calendar, YouTube, or any other content in your Google account.

What it is used for

• Creating your TakeOne account and authenticating you.
• Showing your name and profile photo on the account.
• Account security, and service messages sent to that email address.
• Deleting the account and the data received from this source when you ask us to.

Data received from Google is not used for advertising. It is not sold, rented, turned into an advertising profile, or shared with data brokers. It is not used for credit scoring, insurance, or any purpose unrelated to this service.

Limited Use

TakeOne’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The policy is published at https://developers.google.com/terms/api-services-user-data-policy

• Google user data is used only to provide or improve the user-facing features of the app.
• It is transferred to others only to provide those features, for security, to comply with the law, or as part of a merger or acquisition with the user’s prior consent.
• It is not used to serve ads. It is not read or examined by humans for personalised, retargeted, or interest-based advertising.
• Humans do not read this data except with your consent, for security, to comply with the law, or for internal operations in aggregated and de-identified form.

You can remove TakeOne or Firebase access from the security page of your Google Account. That cuts the permission on Google’s side. To delete the copy we store, also send the deletion request in the next section.

08Cookies

The product site does not set a cookie to remember your language. The language is part of the address (/tr or /en), and you change it with the language links on the page. The site does not use that choice as an advertising identifier.

The product site (takeone.com.tr) and the web portal (takeone.com.tr/app) use Google Analytics 4 to understand how the service is used. We load the tag only when a measurement id is configured. Until you accept, Google Consent Mode keeps analytics storage denied. Advertising storage, ad user data, and ad personalisation stay denied. We do not use an advertising pixel.

If you accept, we send page views and named product events: sign-up and sign-in method, role, onboarding step and a completion percentage, whether a photo, CV, or video upload succeeded, casting views and publish actions, application steps, shortlist and decision actions, that a message was sent (never its text), that a search or filter was used (filter names only, never the words you typed), language switches, and clicks on store and sign-up buttons. We also send a coarse device and browser signal that Google Analytics adds by default, the page address with personal query parameters removed, and the interface language. We do not send your name, email, phone number, message text, search text, file contents, or application notes.

After you accept, we may set the Firebase user id as the Google Analytics user id so events from the same signed-in account can be joined. That id is a pseudonymous account identifier, not your email or name. Under KVKK it is still personal data. The legal basis is your explicit consent (Article 5/1), not legitimate interest. Signing out clears it. If you have not accepted, we do not attach it.

Analytics cookies such as _ga are written only after you accept. Before that, the tag may send a cookieless consent ping so Google can record that storage was denied. A first-party cookie named takeone_analytics_consent (and the same value in local storage) stores only your accept or reject choice, for 180 days, on takeone.com.tr. That cookie is strictly necessary to remember the choice. It is not an advertising identifier. You can change the choice with Cookie settings in the site footer and in the portal preferences. Rejecting or withdrawing consent does not close the account and does not block features.

Google LLC processes this measurement data as a processor. The same Google Cloud and Firebase data-processing terms that cover the rest of the service apply. The measurement is not used to serve ads. Google signals and ad personalisation are turned off in the tag.

The mobile app does not currently send events to Google Analytics. The same event names are recorded only as on-device diagnostics and, when crash reporting is enabled, as Sentry breadcrumbs. When you sign in on the site, Firebase Authentication keeps the session in browser storage on your device so you stay signed in. That storage is not sold and it is not an advertising identifier.

The mobile app does not use a browser cookie. The session and preferences are kept on your device and in Firebase. A notification permission in the operating system is a device permission, not a cookie. You can turn it off in settings.

09Children and talent under 18

TakeOne is not a service directed at children. The talent profile asks for age as a number. The form accepts 13 to 100 and does not collect a date of birth. The app does not store a separate parental-consent form and does not check the civil registry. Talent under 18 may upload photos and videos and apply to a call only with the consent of a parent or guardian. The person who opens the account is responsible for that consent and for allowing the material to be shown on the platform.

A manager, agent, or casting team may process the data of talent under 18 only where they know that this consent exists. Hamla Teknoloji does not check the civil registry and does not store a separate consent document. A false age or a false statement about consent is the responsibility of the person who makes it, and it is a ground for closing the account.

If you believe a profile for someone under 18 was opened without permission, write to info@hamlateknoloji.com. On a request whose identity we can verify, we take the profile and the materials down. Content that is child sexual abuse material is removed at once and reported to the competent authorities.

10Profile verification and face frames

The verified badge is optional. With explicit consent, an applicant takes three short face frames with the front camera. The frames are used only to check that the profile photos show the applicant. They are not shown on the profile and are not available to other users or to the client apps. They are deleted 30 days after approval, or at once when the account is deleted.

Applications (photos, face frames, CV, and profile text) may get an AI-assisted first review through the Google Gemini API. We use the paid tier, so the data is not used to train models. When the AI is unsure or finds a mismatch, our team makes the final decision. Legal basis: explicit consent under KVKK Article 6/3-a. To withdraw consent or contest a decision, email info@hamlateknoloji.com. Withdrawing consent affects only the verified badge.

11Deleting your account and data

You can delete your account yourself in the mobile app: Profile > Settings > Delete account. Once you confirm, the account and the data listed below start being deleted at once. If you cannot reach the app, follow the steps at takeone.com.tr/account-deletion or email info@hamlateknoloji.com from the address on the account with «Hesap silme talebi» in the subject line. For email requests we do not delete an account before we have verified your identity.

Deletion removes the profile, the username, the name, email, and profile photo received from Google or Apple sign-in, uploaded photos, logos, and CV files, videos held for playback (including copies processed by Mux), applications, the representation link, the push token, and the face frames taken for the verified badge. Messages you sent may stay in the other person’s chat history. Backups leave the cycle within 90 days.

The following may remain longer: records covered by an open dispute or a legal retention duty; copies a casting team keeps for its own legal duty and which we cannot delete; and technical traces detached from your identity until the 12-month security-log period ends. Content that belongs to another user is not deleted.

Removing Google Account permissions does not, by itself, delete the copy held in TakeOne. We recommend both steps. We reply to a deletion request within 30 days.

12Security

We protect data against unauthorised access, loss, and alteration with access control, encryption in transit (HTTPS/TLS), and the infrastructure security measures of Firebase and Google Cloud. Access is limited to people who need it to operate the service.

No method gives absolute security. The security of Google or Apple sign-in also depends on that account’s password and two-step verification. An email-and-password account depends on the password you choose. If a breach meets the notification conditions in the KVKK, we notify the Board and, where the risk requires it, the data subjects.

13Users in the EU and the EEA

If you are in the European Union or the European Economic Area, this section is an additional explanation under Regulation (EU) 2016/679 (GDPR). The controller is still Hamla Teknoloji Anonim Şirketi. The contact address is info@hamlateknoloji.com.

Legal bases

• Article 6(1)(b): opening the account and running the profile, audition, and application is performance of a contract.
• Article 6(1)(c): a legal obligation.
• Article 6(1)(f): securing the service and preventing abuse is a legitimate interest. You may object to that interest.
• Article 6(1)(a) and Article 9(2)(a): explicit consent for optional notifications and for data that may be special category, such as appearance and photos or videos. Withdrawing consent does not affect processing that was lawful before the withdrawal.
• Article 6(1)(a): consent for analytics cookies on the product site and the web portal. Refusing that consent does not block the service.

Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection to legitimate interests or to direct marketing, and withdrawal of consent. These rights are not absolute; the exceptions in the law apply. You may also complain to the supervisory authority in your country and to the Personal Data Protection Board in Türkiye.

Transfers abroad

Data may be transferred to the controller in Türkiye and to Google infrastructure outside Türkiye. Where the European Commission has not issued an adequacy decision, we use appropriate safeguards under GDPR Article 46, in particular standard contractual clauses. Google’s Firebase data-processing terms relate to those safeguards: https://firebase.google.com/terms/data-processing-terms

Children

For information-society services, GDPR Article 8 requires parental consent below the age set by the Member State (between 13 and 16). In addition, TakeOne requires parent or guardian consent for every talent profile under 18. The product records age as a number and does not store a separate consent form. That rule is higher than the Member State age.

We do not carry out solely automated individual decision-making under GDPR Article 22. A casting decision is a human decision.

14Changes to this policy

We may update this notice. The last-updated date at the top of the page will change. A material change is announced on this page and, where appropriate, in the app. If the scope of processing that relies on explicit consent expands, we will ask for your consent again for the new processing. Continuing to use the service does not replace consent.

15Contact

Hamla Teknoloji Anonim Şirketi · TakeOne

• Email: info@hamlateknoloji.com
• Phone: +90 (534) 012-4647 and +90 (553) 554-8970
• Headquarters: Reşitpaşa Mahallesi, Katar Caddesi, İTÜ Arı 1 Teknokent Binası, No: 2/5 İç Kapı No: 33, Sarıyer / İstanbul
• KVKK request subject line: «KVKK başvurusu»
• Account deletion subject line: «Hesap silme talebi»

The terms of use govern account rules, the licence to user content, and the obligations of the parties.