Candidate privacy notice

Who we are

The data controller is Hiccup E-Ticaret A.Ş., Maslak Mah. Noramin İşmerkezi No:237/1 Kat B5, Sarıyer, İstanbul. For anything about your data, write to [email protected].

What we collect

• Your name, email address and phone number.
• Your LinkedIn link, if you give one.
• Your CV and everything in it.
• Your earliest start date, the role you apply for and where your application came from (for example a LinkedIn post).
• Interview notes and the scorecards our interviewers fill in.
• Recordings and transcripts of interviews, only if you say yes to recording.
• A scrambled (hashed) form of your internet address, used only to stop mass automated submissions.

Please leave out of your CV what we do not need, such as a photo, age, religion, marital status or health.

Why we use it

To assess your application for the role you chose, arrange interviews and keep in touch with you about it. If you tick “Consider me for similar roles”, we also consider you for similar roles during the 12 months we keep your application.

How we use AI

An AI system reads your CV against the role’s published criteria and suggests how well each one is met. If you agree to recording, it also drafts notes from the interview transcript. It is told to ignore gender, age, photo, nationality, religion, marital status and health. The AI never decides. A person reads your application and makes every decision. You can ask for a human review of anything the AI produced, or object to it, at any time (KVKK Article 11(1)(g); for UK roles, UK GDPR Article 21 on objecting and Articles 22A to 22D on automated decisions).

Legal basis

• Your explicit consent, for recording and transcribing interviews and for considering you for similar roles. You can withdraw it at any time; this does not affect what was done before.
• Otherwise, the steps needed before an employment contract (KVKK Article 5(2)(c); UK GDPR Article 6(1)(b)) and our legitimate interest in hiring the right people (KVKK Article 5(2)(f); UK GDPR Article 6(1)(f)).

Who sees it

The hiring team and your interviewers. Our service providers process the data only on our instructions:

• Amazon Web Services and MongoDB Atlas, which host our systems (data centres in London).
• Anthropic, the AI provider.
• Recall.ai, the meeting notetaker (hosted in the EU), only for recorded interviews.
• Cal.com, for booking interviews, and Google, for the calendar invitation and the video call.
• Twilio SendGrid, which sends our emails.

We do not sell your data or use it for advertising.

Transfers abroad

All of these providers process data outside Turkey, in the UK, the EU or the US. We transfer data to them under standard contracts, notified to the Personal Data Protection Board as Article 9 of the KVKK requires. For UK roles, transfers outside the UK use the safeguards UK law approves.

How long we keep it

• Your application: 12 months after the last decision on the role you applied for. Then we delete it or make it anonymous.
• Interview recordings (video and audio): deleted 7 days after the interview, once transcribed. The transcript and the notes stay with your application.
• If you agreed to be considered for similar roles, we do so only during those same 12 months.

Your rights

You can ask whether we process your data, get a copy, learn what it is used for and who receives it, have it corrected or deleted, object to its use or to a result against you that comes only from automated analysis, and claim compensation if unlawful processing harms you (KVKK Article 11; for UK roles, UK GDPR Articles 15 to 21 and 22A to 22D). You can also complain to the Personal Data Protection Board in Turkey or, for UK roles, to the Information Commissioner’s Office (ICO).

How to use your rights

Email [email protected] from the address you applied with. We reply within 30 days, free of charge.