Candidate Privacy Notice

The data controller for your personal data is SAN BİLGİSAYAR TİCARET TURİZM İTHALAT VE İHRACAT AŞ (the “Company”), which operates the octopusplus.com website. Address: Pınarbaşı Mh. Hürriyet Cad. Antalya Teknokent ARGE 5 3F/2 Konyaaltı, Antalya, Türkiye.

Octopus Plus is a product developed under the SAN Companies group. Applications made through the Careers page are assessed by the Company's recruitment staff as part of the group's shared human resources process.

• Identity (first name, last name) and Contact (e-mail, phone) data are processed to run the application process and the candidate selection and placement process, on the legal ground of KVKK Article 5/2-c (processing is necessary for the personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of that contract).
• Professional Experience and CV data (education, work experience, certificates, language skills and any other information in your CV), the LinkedIn or portfolio link you share, your cover letter and the areas of interest you select in a general application are processed to assess your suitability for the position and to run the interview process, on the legal ground of KVKK Article 5/2-c.
• Visual data (your photograph, if included in your CV) is processed to run the application process, on the legal ground of KVKK Article 5/2-c.
• Transaction Security data (IP address, bot-verification result, time of application) is processed to prevent misuse of the application form and to keep the site secure, on the legal ground of KVKK Article 5/2-f (processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject).
• Legal Transaction data (the application record, the date on which you acknowledged this notice and the version of the text, and a record of the explicit consents you did or did not give) is processed for archiving and to meet the burden of proof in a possible dispute, on the legal ground of KVKK Article 5/2-f.

We do not ask for special categories of personal data within the meaning of KVKK Article 6, such as race, ethnic origin, religion, sect, philosophical belief, political opinion, membership of a union, foundation or association, health, blood type or criminal record. If you choose to include such information in your CV or cover letter, it is processed only under the separately provided Consent Declaration and only where you have given explicit consent.

Your personal data is collected electronically and by automated means through the application form you complete on the octopusplus.com Careers page and the CV you upload. Your application is forwarded to the Human Resources team by e-mail the moment the form is submitted; the website does not keep a copy. If your application is shortlisted, your CV is recorded in the Human Resources team's systems for the rest of the assessment process.

Your personal data may be transferred, in accordance with KVKK Article 8, to public authorities and institutions authorised by law, to competent authorities where required to meet legal obligations, and to employees of the relevant SAN Companies group company for the purpose of running the group's shared human resources process.

If you consent to your CV being kept in the talent pool, by default it is visible only to the Company's recruitment staff. Sharing your CV with the other group companies under SAN Companies (Paximum Turizm Ticaret ve Taahhüt A.Ş., Paximum Bilişim Teknolojileri A.Ş.) requires a separate, independent explicit consent.

The octopusplus.com website is hosted on Amazon Web Services (AWS) infrastructure in the Ireland (eu-west-1) region within the European Union; the application form and the CV you upload are processed on those servers and delivered to the Company's corporate e-mail servers hosted in Türkiye. Some of the document viewing and sharing tools and cloud-based collaboration platforms used in the recruitment process may, however, be hosted on servers located abroad. In addition, the application form is protected against automated submissions by Cloudflare Turnstile bot verification, during which your IP address and browser information are processed by Cloudflare. For these reasons your personal data may be transferred abroad within the scope of KVKK Article 9.

The Company is working, within the framework of the “Guide on the Transfer of Personal Data Abroad” published by the Personal Data Protection Authority, to base such transfers on the appropriate safeguards required by the Law (standard contractual clauses, adequacy decisions and similar mechanisms). This notice will be updated as concrete information about the systems used and the safeguard mechanism applied becomes available. Your rights in relation to transfers abroad are the same as those set out in Section 7.

The Company keeps the CV and application details processed during recruitment for 1 (one) year from the conclusion of your application; at the end of that period your personal data is deleted, destroyed or anonymised in accordance with KVKK and the applicable legislation.

If your application is unsuccessful, keeping your CV beyond that period in the talent pool, so that you can be considered for a suitable position in the future, depends solely on your separately given explicit consent. The corresponding Consent Declaration is presented to you on the application form; if you consent, the retention period is a total of 2 (two) years from the application date.

• to learn whether your personal data is processed,
• to request information if it has been processed,
• to learn the purpose of processing and whether the data is used in line with that purpose,
• to know the third parties to whom your data is transferred, in Türkiye or abroad,
• to request correction of incomplete or inaccurate data,
• to request erasure or destruction of your data under the conditions set out in Article 7 of the Law,
• to request that corrections and erasures be notified to the third parties to whom the data was transferred,
• to object to a result to your detriment arising from analysis of your data exclusively by automated systems,
• to claim compensation for damage suffered due to unlawful processing.

You may submit requests concerning the rights listed above by e-mail to info@santsg.com or in writing to Pınarbaşı Mh. Hürriyet Cad. Antalya Teknokent ARGE 5 3F/2 Konyaaltı, Antalya, Türkiye.

Your request must include your first and last name (and signature, if in writing), your Turkish ID number (or nationality and passport number if you are a foreign national), your address for service, your e-mail and phone details if available, and the subject of your request; any related information and documents must be attached. The data controller reserves the right to verify the identity of the applicant.

Requests are concluded free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller; if the process incurs an additional cost, the fee set by the Board's tariff may be charged. If your request is rejected, the response is found insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date.