PRIVACY POLICY

Operator of the website and the Kariyermax CRM system:
Capital Invest Sağlık Hizmetleri Limited Şirketi
Kartaltepe, Şakrak Sk. No: 1
34295 Küçükçekmece, Istanbul, Türkiye
Email: contact@kariyermax.net

1. Overview of Data Processing

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website or use the Kariyermax CRM system. Personal data means any data by which you can be personally identified.

Data Collection on This Website

Your data is collected, on the one hand, when you provide it to us (e.g. by completing a form). Other data is collected automatically by our IT systems when you access the website (e.g. IP address, browser information).

Purposes of Data Processing

Some data is collected to ensure the error-free provision of the website. Other data may be used to analyse user behaviour.

User Rights

Users have the following rights: (generally regulated in Art. 11 KVKK.)

  • Right of access (KVKK Art. 11/1-a: Every person has the right to apply to the controller and, with regard to themselves; …a) to learn whether personal data is being processed,…)
  • Rectification (KVKK Art. 11/1-d: Every person has the right to apply to the controller and, with regard to themselves; …d) to request correction if personal data has been processed incompletely or inaccurately,…)
  • Erasure (KVKK Art. 11/1-e: Every person has the right to apply to the controller and, with regard to themselves; …e) to request deletion or destruction of personal data under the conditions set out in Art. 7,…)
  • Restriction of processing
  • Data portability
  • Withdrawal of consent (corresponds to the principle under KVKK Art. 5 that data may not be processed without explicit consent.)
  • Right to lodge a complaint with the supervisory authority (KVKK Arts. 13-14-15-16)

The competent body may be contacted regarding requests relating to these rights.

2. Hosting

This website is hosted by external service providers. In this context, data such as IP addresses, log files, communication data and metadata may be processed.
Legal basis for processing:

  • Performance of a contract (Art. 6/1-b GDPR) – (KVKK Art. 5/2-c: Provided that it is directly related to the conclusion or performance of a contract and the processing of personal data of the contracting parties is necessary.)
  • Legitimate interest (Art. 6/1-f GDPR) – (KVKK Art. 5/2-e: Provided that data processing is necessary for the establishment, exercise or protection of a right.)
  • Consent, where required (Art. 6/1-a GDPR and Section 25 TTDSG) – (KVKK Art. 5/1: Personal data may not be processed without the explicit consent of the data subject.)

External service providers process the data exclusively in accordance with our instructions.

3. General Information and Legal Bases

Confidentiality

Capital Invest processes personal data confidentially and in accordance with statutory requirements.

Controller

Capital Invest Sağlık Hizmetleri Limited Şirketi
Kartaltepe, Şakrak Sk. No: 1
34295 Küçükçekmece, Istanbul

Storage Period

Personal data is stored until the purpose of processing ceases to apply or statutory retention periods expire. (KVKK Art. 7 and Regulation on the Deletion, Destruction or Anonymisation of Personal Data)

Legal Bases for Processing

The principal legal bases for processing are:

  • Art. 6/1-a GDPR (consent) – (KVKK Art. 5/1: Personal data may not be processed without the explicit consent of the data subject.)
  • Art. 6/1-b GDPR (contract / pre-contractual measures) – (KVKK Art. 5/2-c: Processing is possible without explicit consent provided that it is directly related to the conclusion or performance of a contract and is necessary.)
  • Art. 6/1-c GDPR (legal obligation) – (KVKK Art. 5/2-a: Processing is possible without explicit consent where expressly provided for by law.)
  • Art. 6/1-f GDPR (legitimate interest) – (KVKK Art. 5/2-e: Processing is possible without explicit consent where necessary for the establishment, exercise or protection of a right.)
  • Art. 9/2 GDPR (special categories of personal data) – (regulated under KVKK Art. 6)
  • Section 25 TTDSG (cookie technologies)

Recipients of Personal Data

Data may be transferred to the following recipients:

  • Hosting and IT service providers
  • Analytics tools
  • Competent authorities
  • Business partners involved in the recognition and recruitment phase
  • Other recipients mentioned in this Privacy Policy

Withdrawal of Consent

Users may withdraw consent they have given at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Right to Object under Art. 21 GDPR

Users may object at any time to processing based on Art. 6/1-e or Art. 6/1-f.

Right to Lodge a Complaint

Users may lodge a complaint with the competent supervisory authority in their country or in Germany. (KVKK Art. 14 et seq.)

Data Portability

Users may receive their data in a machine-readable format or request its transfer to another controller.

SSL/TLS Encryption

Data transmissions on this website are protected by SSL/TLS. (KVKK Art. 12)

4. Data Collection on the Website

Cookies

Cookies are used to ensure the user experience and technical functionality.
Legal basis:

  • For technically necessary cookies: Art. 6/1-f GDPR
  • For cookies requiring consent: Art. 6/1-a GDPR and Section 25 TTDSG

Server Log Files

Automatically processed data:

  • Browser type and browser version
  • Operating system
  • Referrer URL
  • Time of the server request
  • IP address

Contact Forms

Data submitted via forms is used exclusively for processing the respective enquiry.
Legal basis:

  • Art. 6/1-b GDPR (in contractual situations) – (KVKK Art. 5/2-c: Processing is possible without explicit consent provided that it is directly related to the conclusion or performance of a contract and is necessary.)
  • Art. 6/1-f GDPR (legitimate interest) – (KVKK Art. 5/2-e: Processing is possible without explicit consent where necessary for the establishment, exercise or protection of a right.)

Email, Telephone or WhatsApp

All transmitted data is stored exclusively for the purpose of processing the enquiry.

5. Analytics Tools and Advertising

The following services may be used with consent: 5 – 1

  • Google Analytics
  • Google Ads
  • Google Tag Manager
  • Facebook / Meta Pixel
  • DoubleClick
  • Google Conversion Tracking

Data may be transferred to the USA on the basis of the European Commission's Standard Contractual Clauses (SCCs). (KVKK Art. 9: Transfer of personal data)

6. Proprietary Services

Accessibility tools (e.g. Eye-Able) operate exclusively with consent or where technically necessary.

Supplement to the Privacy Policy – Use of Artificial Intelligence Systems (Chatbots, Voice Bots, Automations)

Use of AI-Supported Systems (Voice Bots, Chatbots, Automation Software)

On this website, we use various AI-supported systems in communication, support and service processes. These include:
AI chatbots (automated text communication on the website or via messengers),
AI voice bots / AI telephone assistants (automated voice systems for incoming and outgoing calls),
automated response and information systems (e.g. email automation, appointment organisation, applicant information).
These systems are used to support our processes, automate internal workflows, answer general questions, where applicable carry out preliminary applicant screening, and support our employees.

Automatically Generated Content – Notice Regarding Non-Binding Nature

We expressly point out that answers, information, notices, advice or recommendations provided by AI systems are generated fully automatically. Despite careful configuration, the following may occur, among other things:
errors,
incorrect information,
ambiguous wording,
incomplete information.
Automatically generated content is non-binding.
Users are required to independently verify the accuracy, currency and completeness of the information received.
Legally binding declarations, offers, commitments or contractual content arise exclusively through:
written agreements,
preparation by authorised employees
and explicit confirmation.
Answers automatically generated by AI do not establish any rights, do not replace individual advice and have no contractual character.

Processing of Personal Data by AI Systems

When using AI systems, the following data may be processed depending on the type of interaction:
communication content (text or voice),
technically required data (IP address, device, browser, timestamp),
voluntarily provided contact details (name, telephone number, email),
in the case of voice bots, conversation data (transcripts, voice recordings, metadata).
Processing takes place in accordance with Art. 6 GDPR and KVKK Art. 5. In its structure, KVKK Art. 5 corresponds to Art. 6 GDPR and the General Data Protection Regulation (GDPR) of the European Union and regulates, among other things:
“(1) Personal data may not be processed without the explicit consent of the data subject. (corresponds to Art. 6/1-a GDPR.)
(2) If one of the following conditions is met, personal data may also be processed without explicit consent:
a) where expressly provided for by law.
b) where processing is strictly necessary to protect life or physical integrity if the data subject is unable to express consent or their consent has no legal validity.
c) where processing is directly related to the conclusion or performance of a contract and is necessary. (corresponds to Art. 6/1-b GDPR.)
ç) where necessary for the controller to fulfil a legal obligation.
d) where the data has been made public by the data subject themselves.
e) where processing is necessary for the establishment, exercise or protection of a right.
f) where processing is necessary for the protection of legitimate interests, provided that the fundamental rights and freedoms of the data subject are not infringed.” (corresponds to Art. 6/1-f GDPR.)
Further information on storage periods, deletion processes and user rights can be found in the relevant sections of this Privacy Policy.

Use of External AI Service Providers

To provide AI-supported systems, we use external service providers depending on the respective process, in particular:
OpenAI (e.g. ChatGPT, Assistants API)

→ Turkish Privacy Policy: https://openai.com/tr-TR/policies/row-privacy-policy/

Anthropic (e.g. Claude)

→ English Privacy Policy: https://privacy.claude.com/en/

Google (e.g. Gemini)

→ Google Privacy Policy (TR):

https://support.google.com/gemini/answer/13594961?hl=tr

Where required, data processing agreements (DPAs) pursuant to Art. 28 GDPR are concluded with service providers.
Certain providers may transfer data to third countries (e.g. the USA). Such transfers are based on:
EU-US Data Privacy Framework,
Standard Contractual Clauses (SCCs) – Art. 46 GDPR,
additional security measures implemented by the providers.
In this context, the affected party expressly agrees that their data may be subject to a data processing agreement and transferred to third countries insofar as this is required pursuant to KVKK Arts. 9 and 12 as well as Arts. 28 and 46 GDPR and other applicable law.

No Use of Data for AI Model Training

We configure our AI systems so that submitted content is not used to train publicly available AI models.
Certain service providers may be required to process specific data for abuse detection or security purposes; such processing is carried out in accordance with the respective providers' privacy policies.

Alternative Communication Options

Use of AI systems is voluntary.
You may at any time use traditional communication channels (e.g. telephone, email, contact form, personal conversation).

INFORMATION ON DATA PROCESSING FOR APPLICANTS/CANDIDATES (GDPR Arts. 13/14)

1. Controller

Capital Invest Sağlık Hizmetleri Limited Şirketi Istanbul

2. Categories of Data Processed

  • First name, last name, date of birth
  • Contact details
  • Diplomas and educational certificates
  • Language certificates
  • Passport and identity documents
  • References and evidence of professional experience
  • Interview and assessment information
  • Process status
  • Correspondence, messages

3. Purposes of Processing

  • Applicant assessment and matching
  • Interview organisation
  • Implementation of recognition and visa processes
  • Communication
  • Quality control and process monitoring
  • Compliance with legal obligations

4. Legal Bases

  • Art. 6/1-b GDPR – (KVKK Art. 5/2-c: Processing is possible without explicit consent provided that it is directly related to the conclusion or performance of a contract and is necessary.)
  • Art. 6/1-f GDPR – (KVKK Art. 5/2-e: Processing is possible without explicit consent where necessary for the establishment, exercise or protection of a right.)
  • Art. 6/1-a GDPR – (KVKK Art. 5/1: Personal data may not be processed without explicit consent.)
  • Art. 9/2 GDPR (special categories of personal data) – (KVKK Art. 6: Conditions for processing special categories of personal data)

5. Data Transfers

To Employers/Training Institutions
Only after match approval
Exclusively for the specified purpose

To Authorities
Where required:
Recognition authorities
Governorate/state authorities
Immigration authorities
Consulates

To Service Providers
Only on the basis of a data processing agreement (DPA)

6. Storage Period (Regulation on the Deletion, Destruction or Anonymisation of Personal Data Arts. 11-12)

  • During the active process: complete storage
  • After completion of the process: 6 months – 10 years, depending on the legal basis
  • Deletion upon request (where legally possible)

7. Rights of Applicants

Applicants have the following rights:

  • Access
  • Rectification
  • Erasure
  • Restriction of processing
  • Data portability
  • Withdrawal of consent
  • Complaint

8. Data Security

  • TLS encryption
  • ISO-certified servers
  • Role-based access control
  • Penetration tests

9. Data Transfer to Türkiye

The data is processed by Capital Invest.
Legal basis for the international transfer:

  • Standard Contractual Clauses (SCCs)
  • Technical and organisational security measures

INFORMATION ON DATA PROCESSING FOR INSTITUTIONS/EMPLOYERS (GDPR Arts. 13/14)

1. Controller

Capital Invest Sağlık Hizmetleri Limited Şirketi Istanbul

2. Categories of Data Processed

  • Name and contact details of the data subject
  • Institution data
  • Interview appointments
  • Assessments
  • Internal process notes
  • System and log data

3. Purposes of Processing

  • Conducting the matching process
  • Communication with applicants
  • Assessment and forwarding of institutions
  • Process management
  • Legal obligations

4. Legal Bases

  • Art. 6/1-b GDPR
  • Art. 6/1-f GDPR
  • Art. 6/1-a GDPR

5. Data Transfers

  • to applicants, exclusively where required by the process
  • to authorities, where mandatory
  • to service providers, within the scope of a DPA

6. Storage Period

Data is stored for the duration of the business relationship; after completion of the process, deletion takes place in accordance with statutory requirements.

7. Rights of Institutions

Access, rectification, erasure, restriction, withdrawal of consent, right to lodge a complaint.

8. Data Security

  • Encryption
  • Access control
  • Technical security systems