Candidate Privacy Notice

This notice explains how your personal data is processed when assessing job and internship applications. It is not a consent form. Reading it or submitting an application does not constitute explicit consent.

Identity and contact details: your name, email address and optionally your LinkedIn profile.

Professional and application information: the position applied for, preferred work city, education, employment history and skills in your CV, and optional cover letter.

Process information: application date and source, application status, role-related assessment notes and scores, correspondence and interview scheduling information.

We obtain your data directly from you through the Tally application form, uploaded files, recruitment emails and interviews. Electronic records are processed wholly or partly by automated means; interview and assessment notes are processed by non-automated means as part of a data filing system.

We process identity, contact, professional and application information to receive your application, assess your education and experience for the position, contact you and schedule interviews. The legal ground is the necessity of processing the parties’ data directly related to entering into a contract (Article 5/2-c of Law No. 6698).

Application status, assessment notes and scores are processed to track applications and assess candidates against the requirements of the position. The legal ground is necessity for our legitimate interest in identifying suitable candidates, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f).

Identity, contact and relevant transaction records are processed to respond to data protection requests and lawful requests from competent authorities, as necessary to comply with legal obligations (Article 5/2-ç). Records needed in a dispute are processed only to the extent necessary to establish, exercise or protect a right (Article 5/2-e).

This notice does not cover retaining your application in a candidate pool for other future positions. Such processing requires separate prior information and an appropriate legal ground; if explicit consent is relied on, it must be obtained separately and optionally.

Within the company, recruitment staff and people assessing the position access your data only as needed for their duties.

Tally provides the application form and file upload service; Airtable stores candidate records and tracks assessments. Tally recipient and transferred data categories: [Full name of the provider in the Tally agreement and categories of data transferred to Tally]. Airtable recipient and transferred data categories: [Full name of the provider in the Airtable agreement and categories of data transferred to Airtable].

The email provider used to deliver and store recruitment correspondence and the transferred data: [Full name of the email provider and categories of data transferred to it].

Necessary records may be disclosed to competent public authorities and courts to comply with legal obligations or protect a right. Domestic transfers take place under Article 8/2-a, relying on the legal grounds stated above for the relevant purpose. International transfers additionally require the conditions below.

For international transfers through Tally, Airtable and email services, the countries where data is stored or accessed, subprocessors and the Article 9 safeguard actually established for each transfer must be specified below.

Tally: [Countries receiving data through Tally, subprocessors and the transfer safeguard actually established under Article 9].

Airtable: [Countries receiving data through Airtable, subprocessors and the transfer safeguard actually established under Article 9].

Email service: [Countries receiving data through the email service, subprocessors and the Article 9 transfer safeguard; state if there is no international transfer].

These fields must be completed after verifying the applicable adequacy decision or appropriate safeguard and its scope. Regular international transfers cannot rely solely on reading this notice or blanket consent. Transfers must meet Article 9 requirements.

Application data is retained during assessment. Records that need to be retained after the process closes, the retention purpose and a justified maximum period: [Data categories retained after recruitment closes, retention purpose and justified maximum retention period]. This is not a single statutory period applicable to all candidate data.

Longer retention for a dispute or legal obligation is limited to the necessary records and period. Applicable record types, legal provision or rights-protection justification and period: [Records retained longer for legal reasons, applicable law or rights-protection justification and retention period].

When the grounds for processing cease, data is deleted, destroyed or anonymised on our initiative or upon your request under Article 7 and applicable disposal rules. The disposal schedule, including provider copies and backups: [Data disposal method and schedule, including copies and backups held by service providers].

If you are accepted for employment or an internship, only necessary records are transferred to personnel processes. Their purposes, legal grounds and retention periods are explained separately.

This application form does not request special categories of data such as health, disability, criminal convictions and security measures, biometric or genetic data, beliefs, political views or trade union membership. Please do not include them in your CV or cover letter. Do not provide unnecessary identity document copies, patient information or referees’ contact details.

Voluntarily sharing special categories of data does not constitute explicit consent to process them. If such processing is necessary, an appropriate ground under Article 6, the required safeguards and separate information must be provided.

Under Article 11, you may apply to the controller to exercise the following rights:

Learn whether your personal data is processed and request information about that processing;

Learn the purpose of processing and whether your data is used consistently with that purpose;

Learn which third parties receive your data in Türkiye or abroad;

Request correction of incomplete or inaccurate data, and deletion or destruction when the conditions of Article 7 are met;

Request that recipients are notified of corrections, deletions or destruction;

Object to an adverse outcome resulting solely from automated analysis;

Request compensation for damage caused by unlawful processing.

You may submit requests in writing to [Full company postal address]; via registered electronic mail (KEP) to [Company registered electronic mail (KEP) address]; using a secure electronic signature or mobile signature; or by emailing [Email address for data protection requests] from an email address you previously provided and that is recorded in our system.

Include your name and surname, signature for written requests, Turkish identity number for Turkish citizens or nationality and passport number or identity number if available for foreign nationals, residential or business address for service, email address for notification if available, telephone and fax numbers if available, and your request. You may attach relevant information and documents. These details are requested to exercise your rights, not when applying for a job.

We respond as soon as possible and within 30 days at the latest. Requests are generally free; if additional costs arise, only the tariff set by the Board may apply. Any fee is refunded if the request results from an error by the controller.

If your request is rejected, the response is insufficient or no timely response is received, you may complain to the Board within 30 days of learning of the response and in any event within 60 days of your application. You must first exhaust the application procedure with the controller.