Privacy & Data Protection Policy

1. Data Controller Identity

The data controller responsible for personal data processed through SAPBENCH is:
SAPBENCH OÜ (Registry code: Estonia, EU)
Contact: [email protected]

2. Personal Data We Process

We process the following categories of data in connection with our marketplace services:

• Identity & Account Data: Full name, verified business email, profile photographs, country of residence.
• Professional SAP Vetting Credentials: SAP certifications, technical skills, verified work experiences, GitHub/GitLab references, screening scorecards.
• Financial & Escrow Data: Payout accounts (handled via Stripe Connect Express), transaction ledger records, billing addresses, VAT IDs.
• Communications & Workroom Submissions: Encrypted in-platform chat messages, deliverable archives, and dispute evidence submissions.

3. Legal Bases for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Performance of a Contract (Art. 6(1)(b)): To operate marketplace matchmaking, execute contracts, manage escrow balances, and disburse payouts.
• Legal Compliance (Art. 6(1)(c)): To satisfy EU DAC7 tax reporting directives, anti-money laundering (AML), and accounting regulations.
• Legitimate Interests (Art. 6(1)(f)): To maintain platform security, prevent off-platform disintermediation, and combat fraud.

4. Rights of Data Subjects

Under the EU General Data Protection Regulation (GDPR) and Turkish Law on the Protection of Personal Data (KVKK), you possess rights to:

• Request access to your personal data records.
• Request correction or rectification of inaccurate or outdated information.
• Request erasure ("Right to be Forgotten") subject to statutory accounting retention duties.
• Export your data in a structured, machine-readable format (Data Portability).

5. Data Retention

Financial transactions and ledger records are preserved for a statutory period of 7 years to satisfy Estonian and EU financial audit requirements. Inactive accounts may be purged following 24 consecutive months of dormancy upon notification.