GDPR Notice

GoTeam is a service operated in Türkiye by Motivex Intelligence Bilişim Yazılım Robotik Sanayi ve Ticaret Anonim Şirketi. Personal data is processed first of all under Personal Data Protection Law No. 6698 (KVKK, the Turkish Data Protection Law). If you reach the service from the European Union, you can exercise the rights granted to you by the General Data Protection Regulation (GDPR) in the same way.

This page does not replace the other legal texts, it stands beside them. Which personal data is processed for which purpose is set out on the KVKK Privacy Notice page, and where the data is stored and how it is protected on the Privacy Policy page. Only the points on which the GDPR differs are explained here.

For the data of candidates who apply for a job, the data controller is the employer company the application was made to; GoTeam acts as a data processor on that company's instructions. When you send us a request as a candidate, we pass it to the employer company concerned and write to you telling you whom we sent it to. The division of duties is detailed on the Data Processing Agreement page.

Each of the rights below is granted by a separate article of the Regulation. You do not have to state which article you are relying on when you write your request; writing what you want is enough.

• Access (Art. 15): you can ask which data is held about you and for what purpose it is processed, and request a copy.
• Rectification (Art. 16): you can ask for the correction of information recorded incompletely or incorrectly.
• Erasure (Art. 17): you can ask for your data to be deleted if the purpose of processing has disappeared, or if the processing rests on consent and you have withdrawn it.
• Restriction of processing (Art. 18): while you contest the accuracy of a record, you can ask for that record not to be used but only stored.
• Data portability (Art. 20): you can receive the data you gave us yourself, and which is processed on the basis of a contract or consent, as a machine readable file.
• Objection (Art. 21): you can object to processing that rests on legitimate interest. If we have no overriding ground left after your objection, we stop that processing.

Article 6 of the GDPR requires us to write down which basis each processing operation rests on. The bases we use and the concrete counterpart of each are as follows.

• Performance of a contract (Art. 6/1-b): opening your account, running the subscription, producing the report you bought and delivering it to you.
• Legal obligation (Art. 6/1-c): issuing the invoice and keeping financial records for the period the law requires.
• Legitimate interest (Art. 6/1-f): the security of the service, checks against fraud and abuse, and keeping error logs.
• Explicit consent (Art. 6/1-a): analysing a CV with AI, and non-essential cookies.

Article 44 and the following articles of the GDPR require that a transfer of data outside the European Economic Area be written down clearly for the reader. The transfer does take place and this is how.

CV files are hosted by our cloud file storage provider established outside Türkiye and are sent to our AI provider established outside Türkiye for analysis. These two providers are the places where the data is processed outside Türkiye. The transfer falls within Article 9 of Law No. 6698 (KVKK, the Turkish Data Protection Law) and is necessary for the service to be provided; for the analysis service your explicit consent is obtained in addition. You can learn the identity of the providers through the channel described on the Data Subject Request page. If you do not give consent, no analysis can be carried out; on its own this leads to no other consequence.

The full list of the providers that touch your data is published in the sub-processor list, and that list is the first place updated when it changes.

Article 22 of the GDPR provides protection against decisions based solely on automated processing that produce legal effects concerning a person. Article 11 of Law No. 6698 contains the same protection. The two provisions apply together here: whichever you rely on, the result is the same.

The assessment is AI assisted. The score is produced against a fixed, evidence based rubric, and the final decision always belongs to a person. If you believe that an exclusively automated analysis has produced a result to your detriment, you may object under Article 11 of Law No. 6698 (KVKK, the Turkish Data Protection Law).

What the AI does, what it does not do and how the score is produced are set out on the AI Transparency Notice page. When you send an objection in writing, the analysis is reviewed again by a person and we write to you with the outcome.

You may send your requests under Article 11 of Law No. 6698 (KVKK, the Turkish Data Protection Law) to [email protected]. Your request is concluded within 30 days at the latest. How the request is made and which information it must carry is set out on the Data Subject Request page.

Article 12/3 of the GDPR requires a request to be answered within one month. The 30 day period we apply stays within that limit, which is why we do not publish two different periods.

We share no personal data before verifying that you are the person making the request. For that we ask you to write from the e-mail address registered on your account, or, if you have no registered account, to add the information that lets us match the request to your identity.

If you want to send a written request by post, our address is: Muradiye Mah. Celal Bayar Üniversitesi Kampüsü Küme Evleri Teknokent No: 22 Ofis No: Z-27, 45140 Yunusemre / Manisa. You can ask questions by phone (0551 406 11 90), but a request has to be in writing to be placed on record.

If you find our answer insufficient or receive no answer within the period, you have the right to complain. Under Article 77 of the GDPR you can apply to the data protection authority of the European Union member state where you live, where you work or where the infringement took place.

You can also take the same matter to the Personal Data Protection Board in Türkiye. Article 14 of Law No. 6698 requires that you first apply to us and that the 30 day period expires or that you receive a negative answer. There is no such precondition on the GDPR route.

Taking the complaint route does not remove your right to go to court.