Candidate Information Notice

PRIVACY NOTICE ON THE PROCESSING OF JOB CANDIDATES’ PERSONAL DATA

At Oredata Yazılım Anonim Şirketi (“Oredata” or the “Company”), we value the protection of your personal data. Through this privacy notice (the “Privacy Notice”), we wish to inform you, under Law No. 6698 on the Protection of Personal Data (the “KVKK”), of how and why your personal data is processed, the legal grounds for processing, the recipients to whom and purposes for which it may be transferred, and your rights under the applicable law.

In all personal data processing activities we carry out, we act in accordance with the obligations and principles prescribed by applicable legislation, particularly the KVKK, and take the necessary technical and administrative measures, including those implemented within the scope of our ISO 27001 information security management system, to ensure that your personal data is processed securely.

1.DATA CONTROLLER

Under the KVKK, your personal data is processed by Oredata in its capacity as data controller and solely for the purposes described below.

2.PERSONAL DATA WE PROCESS

As Oredata, we process the following personal data about you in your capacity as a job candidate:

3.SCOPE, PURPOSES AND LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA

Your personal data will be processed as explained in detail below on the legal grounds set out in Articles 5 and 6 of the KVKK:

3.1.Conducting recruitment, interview, selection and placement processes

For the purposes of receiving and evaluating your job application to Oredata; conducting the candidate application, preliminary telephone interview, HR interview conducted by People & Culture, technical interview, case study, reference check, salary offer and placement processes; communicating with you about your application; planning our human resources processes; determining your salary expectations; and making you an offer:

• Your identity, contact, professional experience, employment, visual and audio records and other information will be processed on the legal grounds that processing is necessary for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed, under Article 5(2)(f) of the KVKK, and that processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract, under Article 5(2)(c) of the KVKK;
• Your health data will be processed on the legal ground that processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance under Article 6(3)(f) of the KVKK.

This data will be processed accordingly.

3.2.Conducting information security processes

For the purposes of operating the information technology and data-processing processes required for our business activities and internal and external communications; using the necessary applications, programs and systems, including Google Workspace, the Workable recruitment management system and Atlassian Jira/Confluence; and carrying out the operations required to store the personal data you share with our Company securely in electronic environments:

• Your identity, contact, professional experience, employment, visual and audio records and other information will be processed on the legal grounds that processing is necessary for the legitimate interests of the data controller under Article 5(2)(f) of the KVKK and that processing is directly related to the establishment or performance of a contract under Article 5(2)(c) of the KVKK.

3.3.Assessing health conditions and disabilities in connection with a job application

For the purpose of assessing, as part of your job application, information concerning a disability or other health condition that may arise from the employment relationship for which you have applied and may affect your ability to perform the role:

• Your identity, contact, professional experience, employment and other information submitted as part of your job application will be processed on the legal ground that processing is necessary for the establishment, exercise or protection of a right under Article 5(2)(e) of the KVKK;
• Your health data will be processed on the legal ground that processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance under Article 6(3)(f) of the KVKK.

This data will be processed accordingly.

3.4.Retaining data in the candidate pool following an unsuccessful application

If your job application is unsuccessful, for the purpose of retaining your personal data so that you may be considered for positions that may become available at Oredata in the future:

• Your identity, contact, professional experience, employment, visual and audio records and other information will be processed on the basis of your explicit consent under Article 5(1) of the KVKK;
• Your health data will be processed on the basis of your explicit consent under Article 6(2) of the KVKK.

This data will be processed accordingly.

3.5.Conducting reference checks

For the purpose of conducting reference checks by contacting the individuals you identify as references in connection with your application:

• Your identity, contact and professional experience information will be processed on the basis of your explicit consent under Article 5(1) of the KVKK.

3.6.Transferring your CV to a client

If the position for which you have applied requires project-based assignment to an Oredata client, for the purpose of sharing your CV and assessment notes with the relevant client:

• Your identity, contact, professional experience and employment information will be processed on the basis of your explicit consent under Article 5(1) of the KVKK.

3.7.Internship processes (Oredata Academy)

For the purposes of evaluating your internship application, placing you in a training program and conducting follow-up processes within Oredata Academy, your personal data will be processed on the legal grounds described above.

4.HOW WE COLLECT YOUR PERSONAL DATA

In addition to obtaining your personal data directly from you, we may collect personal data about you from third parties. These third parties may include references you identify and provide to us, service providers such as LinkedIn Recruiter and LinkedIn InMail, public records to the extent permitted by applicable laws and regulations, the candidate pool created through referrals by Oredata employees under the Oredata Employee Referral Program, and publicly available professional profiles on websites and/or social media platforms such as LinkedIn and GitHub. This personal data may be obtained before and during your application process.

For the purposes listed above and on the legal grounds set out in Articles 5 and 6 of the KVKK, your personal data is collected and processed by automated means or, provided that it forms part of a data filing system, by non-automated means, through:

• The Workable Recruitment Management System, which is based in the United States and involves an international data transfer;
• LinkedIn Recruiter / InMail, based in the United States;
• The Oredata careers email address (careers@oredata.com);
• Employee referrals under the Oredata Employee Referral Program;
• Recommendations from People Partners working through Catalyst People Partner / External Search channels; and
• Telephone calls and email correspondence with you, and interviews conducted in person or online through Google Meet.

Your personal data is collected and processed through these channels by oral, written and electronic means.

5.TRANSFER OF YOUR PERSONAL DATA

5.1.Domestic transfers

To the extent necessary to achieve the purposes described above and fulfill obligations arising from Company policies, and strictly limited to those purposes, your personal data is transferred under Article 8 of the KVKK to the following recipients located in Türkiye:

• On the legal ground that processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract, under Article 5(2)(c) of the KVKK, your identity, contact, professional experience, visual and audio records and other information submitted as part of your job application are transferred, for the purposes of conducting your onboarding processes and establishing the employment relationship, to service providers from which we receive consultancy services; Vet İstanbul, our payroll and HR service provider, only if your employment is confirmed; and Kolay İK, our HR management system.
• On the legal ground that processing is necessary for the establishment, exercise or protection of a right under Article 5(2)(e) of the KVKK, your identity, contact, professional experience, visual and audio records and other information submitted as part of your job application, and your health data under Article 6(3)(d) of the KVKK, may be transferred to lawyers, consultants, courts, enforcement offices, notaries and other competent authorities and bodies.
• Your identity, contact, professional experience, employment, health, visual and audio records and other information are transferred to public authorities legally authorized to receive them, including the Social Security Institution (SGK), the Ministry of Labour and Social Security and İŞKUR, on the legal ground that processing is necessary for the data controller to comply with its legal obligations under Article 5(2)(ç) of the KVKK.
• On the basis of your explicit consent, if your application relates to a position conducted exclusively for a specific Oredata client, your CV, professional experience and assessment notes may be shared with the relevant client company.

5.2.International transfers

Your personal data will be transferred abroad through the parties listed below, provided that one of the appropriate safeguards under Article 9 of the KVKK is established, namely a Standard Contract announced by the Personal Data Protection Board or your explicit consent:

Under Article 9(4)(c) of the KVKK, your personal data is transferred to the parties listed above that are located abroad or process personal data abroad pursuant to the Standard Contract announced by the Personal Data Protection Board. The Standard Contract addresses matters including the categories of data, the purposes of the transfer, the recipients and recipient groups, the technical and administrative measures to be implemented by the recipient, and additional safeguards for special categories of personal data. A copy of the relevant Standard Contract provisions will be provided to you free of charge upon request.

6.RETENTION OF YOUR PERSONAL DATA

The Company retains appropriate records containing your personal data in order to conduct its business activities and comply with its legal obligations. If your job application is unsuccessful, relevant records relating to your application will be retained only for the period prescribed by the local law applicable to your application or where they are retained for the purposes described in this section. When your personal data is no longer required, the necessary measures are taken to ensure that it is securely and promptly destroyed in accordance with Oredata’s Retention and Destruction Policy.

In addition to the general retention periods described in this section, if you consent to joining the candidate pool during your application process, we may retain your personal data for up to 2 years so that we can match you with other suitable opportunities that may arise at Oredata from time to time. We will retain your personal data only for as long as your consent remains valid, and you may withdraw that consent at any time.

7.YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Under Article 11 of the KVKK, every individual whose personal data is processed may apply to our Company and request:

• To learn whether their personal data is being processed;
• To request information if their personal data has been processed;
• To learn the purpose for which their personal data is processed and whether it is used in accordance with that purpose;
• To learn the identity of third parties in Türkiye or abroad to whom their personal data has been transferred;
• To request the correction of personal data that has been processed incompletely or inaccurately, and to request that the correction be communicated to third parties to whom the personal data has been transferred;
• To request the deletion, destruction or anonymization of personal data where the grounds requiring its processing no longer exist, and to request that the action taken be communicated to third parties to whom the personal data has been transferred;
• To object to any outcome that is detrimental to the individual and results from the analysis of processed data exclusively by automated systems; and
• To claim compensation for damage suffered as a result of the unlawful processing of personal data.

You may submit requests concerning these rights by completing the Data Subject Application Form or by preparing your own request in accordance with the requirements specified by the Personal Data Protection Authority, and sending it to our registered electronic mail address or physical postal address below using one of the methods prescribed by the Authority. Depending on the nature of the request, Oredata will respond free of charge as soon as possible and no later than 30 days after receipt.

• Application Address: Çiftehavuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. C1 Blok No: 151/1E İç Kapı No: 303 Esenler / İstanbul PK: 34220
• Registered Electronic Mail Address: oredatayazilim@hs01.kep.tr