KVKK Disclosure Notice

This Disclosure Notice explains how your personal data are processed when you use the ProPosted online hiring and matching platform (“Platform”), in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”).

The Platform supports position-based hiring, structured matching, controlled candidate visibility, employers sending contact requests to candidates, candidate approval before controlled communication and messaging, and tracking hiring evaluation steps in one environment.

This notice applies to natural person candidates, company users and their representatives, and limited technical/security data categories. It does not describe marketing profiling; where separate consent is required under law, it is handled through dedicated flows.

Under the KVKK, the data controller for your personal data is the legal entity listed below. The Platform is offered under the ProPosted brand on behalf of that controller.

Depending on your account type (candidate or company), profile completeness and in-product usage, we may process:

• Identity and contact: name, company title, authorised representative details, email, account identifiers. • Security of processing: password hashes, session/security tokens, limited technical logs relating to device/browser and connectivity. • Professional life: profession, specialization, experience, education, skills, work model and location preferences, languages and tools, CVs or uploaded files. • Customer transactions and service records: position definitions, matching and shortlist activity, talent-pool and discovery visibility records, status information for hiring evaluation workflows. • Contact requests and messaging: request content, approval or rejection, in-product message content after approval. • Company verification and security review: verification and review records, moderation notes (as necessary and proportionate). • Legal compliance: records arising from disputes, regulatory requests and statutory obligations.

Special categories of personal data are not processed unless strictly necessary and only as permitted by law.

We process personal data mainly to:

• Create and secure accounts and authenticate users. • Operate position-based hiring, apply structured matching rules, and display lists and visibility consistent with product rules. • Enable employers to send contact requests, obtain candidate approval, and operate secure in-product messaging afterwards. • Implement controlled visibility for candidate profiles, discovery and talent pools without treating the product as a public contact directory. • Verify company accounts, prevent misuse, and conduct moderation and security reviews. • Operate, support and improve the service, including limited logging, backups and incident handling. • Comply with legal obligations and manage regulatory requests and disputes.

We do not sell personal data to third parties for marketing.

Processing relies on the legal bases set out in Articles 5 and 6 of the KVKK, including where applicable:

• Processing expressly permitted by law. • Processing necessary to protect life or physical integrity where consent cannot be validly obtained. • Processing necessary for the performance or establishment of a contract involving the data subject. • Processing necessary for compliance with a legal obligation on the controller. • Processing necessary for the legitimate interests of the controller, provided fundamental rights and freedoms of the data subject are not harmed.

Where explicit consent is required for specific processing, it is collected and recorded separately.

We may share personal data with processors and service providers (e.g. hosting, infrastructure, email delivery, security) bound by contractual safeguards and a need-to-know approach.

If infrastructure is located outside Türkiye, international transfers follow Article 9 of the KVKK and applicable regulations, including where relevant explicit consent, adequacy decisions, standard contractual clauses or other measures required by law. Further detail can be provided on request.

Data are collected through forms and profile fields on the Platform, file uploads, contact requests, messaging, automated or semi-automated technical logs and security tooling, in line with data minimisation.

Relevant in-product actions, security signals and moderation steps may be recorded to maintain an audit trail.

ProPosted is not designed to expose candidates’ direct contact details (such as email or phone) as a public directory. Employers are expected to send a contact request through the Platform first.

Until candidate approval is given, direct contact details are not expected to be disclosed under the product rules and technical controls. After approval, secure messaging and limited sharing flows apply. Before approval, employers may see only a limited profile scope tied to matching and visibility rules.

Records of contact requests may include request content, status, timestamps and related position context. Processing may rely on contract performance, service delivery and legitimate interests consistent with this notice.

Candidate profiles are not presented as an open contact list. Visibility is controlled through candidate preferences, discovery settings, matching rules and position context.

Employers may review candidates through talent pools and discovery results under product rules and permissions, subject to privacy settings and product constraints.

Company accounts and profiles may be subject to limited verification and review to reduce fraud, fake activity and abuse. Relevant application data, domain or corporate email checks, content review and security indicators may be processed.

Moderation and security review are performed only by authorised personnel, under internal policies and law, in a necessary and proportionate manner. Accounts may be restricted or suspended under the Terms of Use and internal policies where appropriate.

A limited set of authorised personnel may access account records, profile and position data, contact requests, message content and technical security logs for service delivery, support, platform security, abuse prevention, moderation, legal compliance, audit and dispute management.

Access is role-based and limited by least privilege. Where unauthorised access is suspected, measures may be taken as permitted by law and you may be informed when appropriate.

Automated or high-volume scraping, data extraction or attempts to impose unfair load may be restricted; suspicious traffic may be logged.

We retain personal data for as long as needed for the processing purposes and for statutory limitation periods where applicable.

On account closure or when purposes end, deletion, anonymisation or destruction is applied in line with law and internal retention policies. Backup systems are addressed where technically feasible.

Legal proceedings, audits or official investigations may require longer retention; you may be informed to a reasonable extent.

Data subjects may exercise rights under Article 11 of the KVKK, including to:

• Learn whether personal data are processed, • Request information if processed, • Learn the purpose of processing and whether data are used accordingly, • Know third parties to whom data are transferred domestically or abroad, • Request rectification of incomplete or inaccurate data, • Request deletion or destruction under Article 7 of the KVKK, • Request notification of rectification/deletion to third parties where applicable, • Object to outcomes produced solely by automated processing that are adverse to you, • Claim compensation for unlawful processing where you suffer damage.

Requests are handled within legal timelines, subject to identity verification where needed.

You may submit requests to the data controller in writing or through methods announced by the Turkish Personal Data Protection Authority.

Contact: support@proposted.com

If you do not receive a response within the statutory period or are not satisfied, you may lodge a complaint with the Authority.

This notice may be updated for legal, operational or product changes. Updates are tracked via the “Last updated” line and, where appropriate, in-product notices. Material changes may require additional notices as required by law.

Document versions may be stored for technical and audit purposes.