Privacy Notice: job candidates
Version 2026-10-v1 · Updated October 20, 2026
This English translation is provided for convenience. The Turkish text is the governing version.
In brief
This notice explains how we process your personal data when you apply for a job at Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”, “we”). We receive applications by email at [email protected]; there is no application form on the website, and this notice also applies if your application reaches us by any other means. We process your resume only to evaluate your application and to communicate with you; we do not ask for a photo, your Turkish national ID number, or special categories of personal data. If your application is unsuccessful, we keep it for 6 months and then delete it; you are kept in our candidate pool only if you give separate explicit consent.
Data controller
Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller for the personal data described in this notice is Firmanet:
Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]
You can contact us through these details with your questions and requests regarding your personal data.
What data we process
| Category | Data | Source |
|---|---|---|
| Identity | Full name | From you |
| Contact | Email address, phone number; your address, if it appears in your resume | From you |
| Professional experience | Resume, education details, certificates, the team you applied to | From you |
| Evaluation | Interview notes | From our employees who conduct the interviews |
| Reference information | The name and contact details of a reference you provide; the reference’s opinion of you | From you and your reference |
| Application record | The date of your application, the stages of the process, and the outcome | From the records Human Resources keeps throughout the process |
We also process the names and contact details of the people you name as references. We speak with them only with your knowledge. In our first conversation, we tell them who we are and why we are contacting them, and we inform them of this notice.
Information we ask you not to send
We do not need the following information to evaluate your application. Please do not include it in your resume or its attachments:
- A photo.
- Your Turkish national ID number.
- Special categories of personal data: data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and dress, membership of an association, foundation, or trade union, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
If you send a resume or document containing this information, we do not use that information in our evaluation, and we delete it. If you are hired, we will inform you separately, through our employee privacy notice, about the documents required by law and how they are processed.
Purposes and legal bases
We process your data only for the purposes below and on the legal basis stated next to each purpose.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Evaluating your application, scheduling interviews, and communicating with you | Identity, Contact, Professional experience, Evaluation | KVKK Article 5(2)(c) (processing is directly related to the establishment of an employment contract) |
| Speaking with the references you provide | Reference information | KVKK Article 5(2)(f): our legitimate interest in evaluating candidates accurately. References are contacted only with your knowledge |
| Keeping you in our candidate pool and considering you for positions that open within 12 months | Identity, Contact, Professional experience, Evaluation | Your explicit consent (KVKK Article 5(1)). This consent is obtained through a separate text and a separate statement; see the “Explicit consent text for the candidate pool” section below |
| Protecting our rights in a dispute related to the application process and responding to requests from competent public authorities | Application record | KVKK Article 5(2)(e) (establishment, exercise, or protection of a right); for requests from public authorities, KVKK Article 5(2)(ç) (our legal obligation) |
Where we rely on our legitimate interest, we take care that the processing does not harm your fundamental rights and freedoms, and we keep the data limited to the purpose. Your explicit consent is not required for your application to be evaluated.
How we collect data
Application email. You apply by email to [email protected]. We suggest that you write “General application” and the name of the team you are interested in on the subject line, for example “General application: Testing and Analysis”. Our teams are Software Development, Software Support, Training and Implementation, Testing and Analysis, Sales, Marketing, Human Resources, and Accounting. Our teams and how to apply are described on the Careers page.
There is no application form on the website. Everything you send with your email reaches our corporate email system electronically. Applications are forwarded from the general mailbox to Human Resources, and the copy in the general mailbox is deleted.
Interviews. Our employees who conduct the interviews take the interview notes and enter them into Human Resources records; this is collection by non-automated means as part of a data filing system.
References. We obtain the names and contact details of your references from you. We obtain your reference’s opinion of you from the reference, in a conversation we hold with your knowledge.
This notice is for information purposes; you do not need to give consent in order to read it, and we do not ask you for consent. We recommend that you read it before applying.
Who we share data with
Applications are evaluated only by Human Resources; for interviews, Human Resources shares your application only with the manager of the team you applied to. Outside Firmanet, we transfer your data to the recipients below only for the purpose stated next to each recipient and only to the extent that purpose requires.
| Recipient | Data transferred | Purpose |
|---|---|---|
| Microsoft (corporate email service) | Your application email, your resume and its attachments, our correspondence with you | Receiving your application and communicating with you by email |
| References you provide | Your name and the team you applied to | Conducting the reference check |
| Courts and other competent public authorities | Data they request or that the law requires | Fulfilling our legal obligations, and in connection with disputes |
| Persons who provide us with legal advisory services | The application record and correspondence relating to the dispute | Protecting our rights |
Transfers abroad
We use Microsoft for our corporate email service; in doing so, the identity, contact, and professional experience information in your application email, your resume and its attachments, and our correspondence with you is transferred abroad. Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)). In this notice, “the Board” means the Personal Data Protection Board, and “the Authority” means the Personal Data Protection Authority.
How long we keep data
| Record | Period | Period starts from |
|---|---|---|
| Unsuccessful application | 6 months | Notification of the outcome to you, or closure of the process |
| Candidate pool (only with your explicit consent) | 12 months; if you withdraw your consent, deleted within 30 days | Date of consent |
If your application is unsuccessful, we keep it for 6 months so that we can protect our rights in a dispute related to the application process. We do not keep your application to compare it with your later applications or to consider you for other positions; we consider you for other positions only with the explicit consent you give for the candidate pool. If you are hired, we will inform you separately, through our employee privacy notice, about the retention and destruction of your data.
We delete applications whose period has expired from our email system and Human Resources records in the first periodic destruction following the end of the period. We carry out periodic destruction every six months, in January and July, and document it in a written record. If no reason remains that requires us to keep the data, we complete your deletion request within 30 days at the latest, without waiting for the periodic destruction. Our full retention and destruction rules are on the Personal Data Retention and Destruction Policy page.
Your rights and how to apply
Under Article 11 of the KVKK, you have the right to learn whether your data is processed; to request information; to learn the purpose of processing and whether the data is used in line with that purpose; to know the persons to whom it is transferred; to request its correction, deletion, or destruction and the notification of this to the persons to whom it was transferred; to object to a result against you arising from analysis carried out exclusively by automated systems; and to request compensation for your damage. How to apply and the response period are explained on the Data subject requests page.
You can apply in three ways. The first is a written application bearing your wet-ink signature, which you can deliver to our head office address by hand, by mail, or through a notary public. The second is an email signed with a secure electronic signature or a mobile signature. The third is an email sent from an email address that you have previously provided to Firmanet and that is in our records. For the last two methods, you send the email to [email protected]. We record your application and respond in writing or electronically within 30 days at the latest. If your application is rejected, if you find our response insufficient, or if we do not respond in time, you may file a complaint with the Board within 30 days from the date you learn of the response and, in any event, within 60 days from the date of your application.
Explicit consent text for the candidate pool
This section is an explicit consent text separate from the notice above. Your explicit consent is not required for your application to be evaluated; this consent is only for the candidate pool.
| Topic | Details |
|---|---|
| Purpose | After the process for your application ends, considering you for positions that open within 12 months and match your qualifications, and contacting you about those positions |
| Data | Full name, email address, phone number, your resume and its attachments, education and certificate details, the team you applied to, interview notes |
| Who sees it | Human Resources and the manager of the team with the open position. Recipients and transfers abroad are as described in the sections of this notice above |
| Period | 12 months from the date you give your consent; your data is deleted when the period ends |
| How we ask | We ask you by email when the evaluation of your application is complete |
| How you give it | You reply to that email with the statement below. If you do not reply, or give any other reply, you are not added to the candidate pool |
| Not giving consent | Not giving your consent does not affect the outcome of your application |
| Withdrawal | You can withdraw your consent at any time by writing to [email protected]. Withdrawal takes effect for the future; we delete your data within 30 days |
Statement:
I agree to be kept in the candidate pool for 12 months.
A reply you give with this sentence is your explicit consent, limited to the purpose, data, period, and conditions set out in this section.
Changes
Before processing your data for a new purpose not stated in this notice, we update this notice; processing for the new purpose does not begin before the updated notice is published. Our general approach to personal data and our other documents are on the Privacy Policy page.
The version and the date of the last update are shown at the top of the page. When we change this notice, we publish the new version at this address; the change applies from the date it is published.