Applicant Privacy Notice

Effective and last updated: July 28, 2026

This notice applies only to careers enquiries and open applications submitted to Prizmaly. It explains what applicant data we collect, why we use it, how it is collected and shared, how long it is kept, and your rights. Reading or acknowledging this notice is not consent to unrelated processing.

1. Data controller

PRIZMALY YAZILIM TICARET LIMITED SIRKETI
Antalya, Türkiye
Email: info@prizmaly.com

Prizmaly is the data controller for the applicant information described in this notice.

2. Applicant data we collect

We collect only the information you submit or generate when applying:

• Identity and contact data: your name and email address.
• Application preferences: the work area you select.
• Professional data: an optional portfolio, LinkedIn, or other work link; your introduction; the CV or résumé link you share; and the employment, education, skills, projects, qualifications, location, and other professional information available through it.
• Recruitment correspondence: messages, interview notes, feedback, and scheduling information created if we contact you.
• Technical and security data: submission date and time and limited connection, browser, IP-address, and anti-spam information processed by our website and form-hosting provider.

Please do not include government identifiers, financial details, health information, criminal-record information, biometric data, union membership, religious or political views, or other special-category information unless we specifically request it and provide the required notice and lawful basis. If unnecessary sensitive information is submitted, we will disregard and remove it where reasonably possible, subject to legal requirements.

3. Purposes of processing

We process applicant data for the following limited purposes:

• receiving and organizing your application;
• assessing your experience, skills, work, and suitability for the area identified in your application;
• communicating with you and arranging recruitment conversations;
• making and documenting recruitment decisions;
• securing the application form, preventing spam, and investigating misuse;
• establishing, exercising, or protecting legal rights and complying with applicable legal obligations; and
• if you join Prizmaly, preparing the relationship and transferring relevant records into the applicable workforce file.

We do not sell applicant data, use it for unrelated advertising, or make a recruitment decision based solely on automated processing.

4. Collection method and legal bases

We collect applicant data directly from you through the electronic careers form, links you share, email, and later recruitment communications. Technical and security data is collected automatically when the form is loaded or submitted. Information is processed wholly or partly by automated means and, when included in recruitment records, by non-automated means forming part of a data filing system.

Under Article 5(2) of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”), the applicable legal bases are:

• processing directly related to the establishment of a possible employment or service contract, where processing the parties' data is necessary;
• our legitimate interests in conducting a proportionate, secure, and accountable recruitment process, provided your fundamental rights and freedoms are not harmed;
• compliance with a legal obligation to which Prizmaly is subject; and
• processing necessary for the establishment, exercise, or protection of a legal right.

This notice is provided independently of explicit consent. If we later propose a separate activity that legally requires your explicit consent, we will request it separately and make that choice optional where required.

5. Recipient categories and transfers

Applicant data may be disclosed only as needed to:

• authorized Prizmaly directors, managers, and personnel involved in the relevant recruitment decision;
• Netlify, which provides the website, form-processing, and anti-spam infrastructure;
• email and productivity service providers, including Google Workspace, when form notifications, correspondence, scheduling, or controlled recruitment records use those services;
• professional advisers and IT or security providers bound by confidentiality, where reasonably necessary; and
• courts, regulators, law-enforcement bodies, and other public authorities where disclosure is legally required or necessary to protect legal rights.

Netlify, Google Workspace, and their infrastructure or subprocessors may process data outside Türkiye. A transfer abroad is made only where a condition under KVKK Articles 5 or 6 is met and an Article 9 transfer mechanism applies, such as an adequacy decision, an appropriate safeguard including an applicable standard contract, or another transfer ground permitted by law. Provider privacy information is available in the Netlify Privacy Statement and Google Privacy Policy.

6. Retention

We ordinarily keep an unsuccessful application and related correspondence for no longer than six months after the recruitment decision or our last substantive communication, whichever is later. This short retention allows follow-up, accountable recordkeeping, and the establishment, exercise, or protection of legal rights. We do not use the careers form to obtain consent for a separate long-term talent pool.

We may delete information sooner on a valid request or retain limited records longer where a legal obligation or active legal claim requires it. If you join Prizmaly, relevant application information may become part of your workforce records and will be retained under the applicable workforce notice and legal schedule. Netlify or other processors may retain limited backup or security records for a short additional period under their documented deletion cycles.

7. Your rights

Under Article 11 of the KVKK, subject to its conditions and exceptions, you may apply to Prizmaly to:

• learn whether your personal data is processed;
• request information about processing;
• learn the purpose of processing and whether data is used consistently with that purpose;
• know the third parties to whom data is transferred in Türkiye or abroad;
• request correction of incomplete or inaccurate data;
• request erasure or destruction under Article 7 and notification of correction or deletion to recipients where applicable;
• object to a result against you arising from analysis solely by automated systems; and
• claim compensation if you suffer damage because personal data was processed unlawfully.

You may also withdraw your application at any time. To make a request, email info@prizmaly.com with the subject “Applicant data request”. We may request proportionate information to verify your identity and locate the application before acting on a request.

8. Changes and contact

We may update this notice if the careers process, service providers, or legal requirements change. We will publish the revised date here and provide additional notice where required. Questions may be sent to:

PRIZMALY YAZILIM TICARET LIMITED SIRKETI
Applicant Privacy
info@prizmaly.com