Privacy and Explicit Consent Text on the Processing of Personal Data

1. Identity of the Data Controller

This Privacy and Explicit Consent Text (the "Text") has been prepared under Personal Data Protection Law No. 6698 (the "KVKK", the Turkish Data Protection Law, or the "Law") and the related secondary legislation, in order to inform the natural persons ("User" or "Data Subject") who use the GoTeam CV Analysis tool (the "Tool" or the "Service") operated by Motivex Intelligence Bilişim Yazılım Robotik Sanayi ve Ticaret Anonim Şirketi (in short the "MotiveX Intelligence" or the "Company") in its capacity as data controller, about the procedures and principles concerning the processing of their personal data, and in order to obtain explicit consent where this is required under the first paragraph of Article 5 of the Law.

The contact details of the data controller are as follows: address Muradiye Mah. Celal Bayar Üniversitesi Kampüsü Küme Evleri Teknokent No: 22 Ofis No: Z-27, 45140 Yunusemre / Manisa; Mesir Vergi Dairesi, tax identification number 6232288048; e-mail [email protected]; phone 0551 406 11 90. The Tool is offered at goteamx.app.

The Company regards the protection of fundamental rights and freedoms, and in particular the privacy of private life, as one of its foremost priorities in the processing of personal data. All processing activities within the scope of this Text are carried out in accordance with the principles set out in Article 4 of the Law: lawfulness and fairness, accuracy and, where necessary, being up to date, being processed for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which they are processed, and being retained for the period provided for in the relevant legislation or required for the purpose for which they are processed.

2. Categories of Personal Data Processed

Within the scope of the use of the Tool, the following are processed: (i) the identity data you include in the content of the curriculum vitae ("CV") file you upload (name, surname and, if present in your CV, date of birth and similar identifying information), (ii) contact data (e-mail address, phone number, city of residence), (iii) professional experience data (employers, roles and titles, periods of employment, job descriptions and achievements), (iv) education data (institutions attended or completed, departments, degrees, grade averages, certificates and training programmes attended), (v) competence data (technical and soft skills, foreign languages and levels, tools and technologies used), (vi) any other information and links you choose to include in your CV (including links to a personal website, a portfolio and professional social network profiles).

In addition, so that the Service can be provided securely, without interruption and in compliance with the legislation, the following are processed: transaction security data (Internet Protocol (IP) address, browser type and version, operating system information, access dates and times, session identifiers), your verified e-mail address, the number and timing of analysis requests linked to your account, and the records relating to the consent box (the moment of consent, the version of the text consented to).

3. Purposes of Processing Personal Data

Your personal data listed above is processed for the following purposes: (i) providing the CV analysis service, producing the analysis report and delivering it to you, (ii) carrying out the identity verification processes (a single use verification link or signing in with a third party identity provider) that ensure only you can access your report, (iii) measuring the quality of the analysis and detecting and remedying errors, (iv) preventing misuse of the Service, fraud attempts and automated (bot) traffic, and applying daily usage limits, (v) fulfilling obligations arising from the legislation in force and meeting the requests of competent authorities and institutions, (vi) where your explicit consent exists, developing, validating, testing and improving our analysis technologies and assessment models as explained in detail in section 4 below.

4. The Scope of Your Explicit Consent

Ticking the consent box in the Tool means that you have read and understood this Text and that you give your explicit consent, of your own free will, to ALL of the processing activities set out below: (a) the processing of your CV file and the personal data it contains by automated means in order to produce an analysis report specific to you; (b) the storage of your CV file and the structured data derived from it, and its processing limited to those purposes, for the purpose of developing, training, validating, testing and improving the Company's CV assessment technologies and AI assisted analysis models; (c) the retention of the report output produced by the analysis in connection with your account.

Your consent also covers the transfer abroad explained in section 6: your file is sent to providers abroad so that it can be analysed, and where consent is not given no analysis can be carried out.

Your explicit consent may be withdrawn at any time, without giving any reason and free of charge, for processing activities other than those strictly necessary for providing the Service. Withdrawal of consent does not affect the lawfulness of the processing carried out up to the moment of withdrawal. To withdraw your consent: While your session is open you can use the "Delete my data" link in the footer of the CV Analysis pages, including your report page; the link works with a two step confirmation. If you prefer, you can also use the application channel in section 10.

5. Legal Grounds for Processing Personal Data

Your personal data is processed on the following legal grounds: on the basis of your explicit consent under the first paragraph of Article 5 of the Law (providing the analysis service and storage for the purpose of developing the analysis technologies and models); under subparagraph (c) of the second paragraph of Article 5, the necessity of processing personal data belonging to the parties to a contract provided that it is directly related to the formation or performance of that contract; under subparagraph (ç), the necessity of processing for the data controller to fulfil a legal obligation; and under subparagraph (f), the necessity of processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (ensuring information security, preventing misuse, measuring service quality).

6. Place of Storage and Security Measures

CV files are hosted by our cloud file storage provider established outside Türkiye and are sent to our AI provider established outside Türkiye for analysis. These two providers are the places where the data is processed outside Türkiye. The transfer falls within Article 9 of Law No. 6698 (KVKK, the Turkish Data Protection Law) and is necessary for the service to be provided; for the analysis service your explicit consent is obtained in addition. You can learn the identity of the providers through the channel described on the Data Subject Request page. If you do not give consent, no analysis can be carried out; on its own this leads to no other consequence.

In order to prevent the unlawful processing of and unlawful access to the data, and to ensure that the data is kept safe, the Company takes the technical and organisational measures aimed at providing an appropriate level of security under Article 12 of the Law. Those measures include encryption in the transmission layer (TLS), encryption in file storage, limiting access permissions on the basis of role, keeping access logs, applying the principle of data minimisation, and ensuring that only the verified session owner can access your report.

7. Retention Periods

Your data is kept for the duration of the relationship between us and throughout the limitation periods set out in the legislation. Payment and invoice records are kept for 10 years under Article 82 of the Turkish Commercial Code (at least 5 years under Article 253 of the Tax Procedure Law); even if you delete your account, these records are held for that period and are then anonymised by severing the links to you.

For the Tool's own data, that general rule applies as follows: (i) analysis requests for which e-mail verification is never completed, and the CV files attached to them, are permanently deleted from our systems at the end of seven (7) days following the date of upload; (ii) your analysis report and account data are kept until you make a deletion request; (iii) where your explicit consent is withdrawn, the data falling within the scope of that withdrawal is deleted, destroyed or anonymised within the shortest reasonable time; (iv) transaction security records are retained subject to the minimum retention periods provided for in the relevant legislation.

You exercise your right of deletion yourself: While your session is open you can use the "Delete my data" link in the footer of the CV Analysis pages, including your report page; the link works with a two step confirmation. The moment you confirm, your account, your analysis records, your reports and the CV files you uploaded are removed irreversibly; the files are deleted from the storage provider as well.

The only exception to this is financial records. If you bought a paid service, the collection record for that purchase (transaction number, amount, date) must be kept for the period stated above. That record is anonymised together with your deletion request: the link to your identity (your account, your analysis record and, if any, your invoice details) is removed and only financial data that cannot be linked to a person remains. The same obligation applies to official e-Arşiv invoices that have been issued.

8. Transfer of Personal Data

Your personal data is transferred, limited to the realisation of the purposes listed above, to the providers listed below by name, which act as data processors and are under contractual confidentiality and data protection obligations. Beyond that, transfers may be made to competent public authorities and institutions where they are requested within the scope of fulfilling our legal obligations.

If you buy a paid service, your name and surname, your Turkish national ID number if any, your invoice address, your e-mail address and your purchase details are transferred to Turkcell e-Şirket, the brand we buy our e-document service from, and ePlatform Bulut Bilişim A.Ş., the company behind that brand, which holds a special integration licence from the Turkish Revenue Administration so that the official document can be issued; the document issued is sent through that channel to the systems of the Turkish Revenue Administration. The legal ground for this transfer is the case in Article 5/2-ç of the Law, "the data controller fulfilling a legal obligation"; it is not subject to explicit consent and, if it is refused, the paid service cannot be provided.

Your CV and your analysis report are not sold or rented to third parties for commercial purposes and are not shared with any third party outside the cases stated in this Text. Sharing your profile with prospective employers would be possible only within a separate service that may be offered in the future and only with your separate and explicit consent given specifically for that service.

There is no third party other than the recipients below that accesses your personal data. The full list of the providers that touch your data is published in the sub-processor list, and that list is the first place updated when it changes.

• Cloud file storage provider established outside Türkiye: Storing the CV and document files that are uploaded. Data transferred: CV and document files. At this provider the data is processed outside Türkiye.
• AI analysis provider established outside Türkiye: Analysing and scoring CV content. Data transferred: CV text and position criteria. At this provider the data is processed outside Türkiye.
• Site usage measurement provider established outside Türkiye: Measuring how the site is used. Data transferred: Device, browser and browsing data. At this provider the data is processed outside Türkiye.
• Bot protection provider established outside Türkiye: Verifying that forms are filled in by a person. Data transferred: IP address and browser verification record. At this provider the data is processed outside Türkiye.
• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.: Collecting the payment. Data transferred: Full name, e-mail, transaction amount and payment result.
• ePlatform Bulut Bilişim A.Ş. (Turkcell e-Şirket): Issuing the official e-Arşiv invoice. Data transferred: Invoice title, tax details, address, e-mail and amount.

9. Information About the Automated Analysis Process

The assessment is AI assisted. The score is produced against a fixed, evidence based rubric, and the final decision always belongs to a person. If you believe that an exclusively automated analysis has produced a result to your detriment, you may object under Article 11 of Law No. 6698 (KVKK, the Turkish Data Protection Law).

The scores, assessments and suggestions produced by the Tool are created by processing the content of your CV by automated means against a predetermined assessment rubric. The score is calculated from the share of the items in that rubric that are met in your CV. The report produced is for information only; it does not constitute a hiring decision, it is not shared automatically with any employer, and it is not part of an automated decision making mechanism that produces legal effects concerning you.

10. Your Rights as a Data Subject

Under Article 11 of the Law you have the right to: learn whether your personal data is processed, request information if it has been processed, learn the purpose of the processing and whether the data is used in line with that purpose, know the third parties in Türkiye or abroad to whom the personal data has been transferred, request correction where the personal data has been processed incompletely or incorrectly, request deletion or destruction of the personal data within the conditions provided for in Article 7 of the Law, request that correction and deletion be notified to the third parties to whom the data was transferred, object to a result arising to your detriment from the analysis of the processed data exclusively by automated systems, and claim compensation if you suffer loss because the personal data has been processed unlawfully.

You may send your requests under Article 11 of Law No. 6698 (KVKK, the Turkish Data Protection Law) to [email protected]. Your request is concluded within 30 days at the latest. How the request is made and which information it must carry is set out on the Data Subject Request page.

Your application is concluded free of charge; if the operation also creates a cost, the fee set out in the tariff determined by the Personal Data Protection Board may be requested.

11. Changes to This Text

The Company may update this Text in line with changes in the legislation, updates to the scope of the Service or changes in its data processing operations. The current text is always published on this page and every consent is placed on record linked to the version of the text in force at the moment of consent. Where changes are significant, you are asked to give consent again to the current text for new analysis requests.