Employee Candidate Privacy Notice

Introduction

This privacy notice has been prepared by Ones Bilişim Teknolojileri Anonim Şirketi (“Company”) pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”) and the “Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform.” It aims to inform job applicants about the collection, processing, transfer and protection of their personal data.

Under Article 10 KVKK, the Company, as data controller, provides you with information on:

  • the identity of the data controller
  • the purposes for which personal data are processed
  • the parties to whom personal data may be transferred and the purposes thereof
  • the method and legal grounds for collecting personal data
  • the rights listed in Article 11 KVKK

Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Special Categories of Personal Data: Sensitive data such as race, ethnic origin, political opinion, religious belief, health, sexual life, criminal conviction, biometric and genetic data.
  • Data Controller: The legal entity that determines the purposes and means of processing personal data.
  • Explicit Consent: A freely given, informed statement of approval relating to a specific matter.
  • VERBİS: The Data Controllers’ Registry Information System managed by the Personal Data Protection Board.

Types of Personal Data Processed

Depending on the nature of the position and legal obligations, the following categories of personal data may be processed. Special-category data are processed only with your explicit consent and for limited purposes; no special-category processing is carried out without such consent.

  • Identity Data: Name, surname
  • Contact Data: Telephone number, e-mail address, postal address
  • Other Data: Position, title and employer information

Purposes of Processing Personal Data

Your personal data may be processed—on the legal grounds in Article 5 KVKK—for the following purposes:

  • Verifying the personal details of the applicant you have referenced
  • Assessing the applicant’s suitability for the position applied for
  • Conducting recruitment and candidate-evaluation processes
  • Carrying out intern/student placement procedures

(For the detailed purpose list, please refer to the Personal Data Processing and Protection Procedure at Personal Data Processing and Protection Procedure.)

Purposes of Processing Special Categories of Personal Data

The Company currently does not process any special-category personal data of job applicants. Should such processing become necessary in the future, explicit consent will be obtained in accordance with Article 6 KVKK.

Methods and Legal Grounds for Collecting Personal Data

Your personal data may be obtained—in written, verbal or electronic form—directly from you, from third parties (e.g., references) or from public authorities during your employment-application relationship with the Company. These data can be collected via application forms, résumés, e-mails, online forms and face-to-face interviews.

Processing is carried out when at least one of the following conditions in Articles 5 and 6 KVKK applies:

  • It is expressly required by law,
  • It is directly related to the conclusion or performance of a contract,
  • It is necessary for the Company to fulfil its legal obligation,
  • It has been made public by the data subject,
  • It is necessary for the establishment, exercise or protection of a right,
  • It is necessary for the Company’s legitimate interests, provided fundamental rights and freedoms are not harmed,
  • The data subject has given explicit consent.

Parties to Whom Personal Data May Be Transferred and Purposes

Your personal data may be shared only with the relevant internal units of the Company for reference-checking purposes. No transfer is made to third parties. If a future transfer becomes necessary, it will be carried out solely in compliance with Articles 8 and 9 KVKK and on a lawful basis.

Technical and administrative measures—such as encryption, access control, log management, confidentiality agreements and periodic audits—defined in the Personal Data Processing and Protection Procedure are applied to safeguard personal data.

Retention Period of Personal Data

Your personal data are retained throughout the recruitment process and the evaluation period. After the evaluation ends, they are deleted, destroyed or anonymised in accordance with the retention and destruction schedule specified in the Personal Data Processing and Protection Procedure / Deletion, Destruction and Anonymisation of Data.

Rights of the Data Subject

Under Article 11 KVKK, you have the right to:

  • Learn whether your personal data are processed;
  • Request information if they are processed;
  • Learn the purpose of processing and whether they are used appropriately;
  • Know the third parties to whom they are transferred at home or abroad;
  • Request correction of incomplete or inaccurate data;
  • Request deletion, destruction or anonymisation when processing reasons cease;
  • Request notification of corrections or deletions to third parties to whom data were transferred;
  • Object to results produced solely by automated processing;
  • Claim compensation for damage caused by unlawful processing.

Application Procedure

You may submit requests regarding your rights under Article 11 KVKK to the Company in writing or via registered electronic mail (KEP), secure electronic signature or your e-mail address registered in our system, in accordance with the “Communiqué on the Principles and Procedures for Applications to Data Controllers”:

  • Written application: Complete the “KVKK Application Form” and send it with wet signature by post to the Company address.
  • KEP: Send via our KEP address.
  • E-mail: Send from your registered e-mail address to ik

Your request will be concluded free of charge within 30 days of its receipt. If the action requires a cost, the tariff set by the Board will be applied.