PeopleBox Applicant Tracking System Privacy Policy

Purpose and Scope

This Privacy Policy ("Policy") has been prepared to explain the procedures and principles regarding situations where Lityum Yazılım Anonim Şirketi ("Lityum") processes personal data as a data controller within the scope of the PeopleBox Applicant Tracking System ("PeopleBox" or "Platform") offered by Lityum. With respect to personal data of applicants within the scope of PeopleBox, PeopleBox customers are essentially the data controllers, whereas Lityum acts as a data processor. This Privacy Policy applies to limited and specific cases where Lityum acts as a data controller.

Information Notice for Applicants

Personal data of applicants submitted through job applications on PeopleBox are processed for purposes determined by the company to which the application is made. Lityum acts solely as a technical infrastructure provider without any discretionary authority over such data. Applicants must exercise their rights regarding their personal data by contacting the company to which they have applied.

Definitions

Personal Data: Refers to any information relating to an identified or identifiable natural person.

Platform: Refers to the PeopleBox Applicant Tracking System.

Data Subject: Refers to the natural person whose personal data is processed.

Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data.

Data Processor: Refers to the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Personal Data Processed as Data Controller

Personal data processed by Lityum as data controller is listed below:

a) Personal data of customer users

• Name and surname
• Company information
• Job title / position information
• Corporate email address
• Mobile phone number
• User transaction records (log records)

b) Personal data of website visitors

• IP address
• Cookie information
• Website usage data

c) Data relating to sales, marketing and communication processes

• Identity and contact information shared through contact forms and demo requests

Purposes of Processing Personal Data as Data Controller

Lityum processes personal data as data controller for the purposes listed below:

• Providing access to the PeopleBox platform and managing user accounts.
• Fulfillment of contracts concluded with our customers and improvement of service quality.
• Maintaining traffic records in accordance with Law No. 5651 and conducting information security processes.
• Improving website experience, conducting technical analyses and ensuring website security.
• Responding to demo requests and sending commercial electronic messages upon consent.

Legal Grounds for Processing Personal Data

Personal data processed by Lityum as data controller are processed based on the legal grounds specified below within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK") and other relevant legislation:

a) Data of website visitors

• Fulfillment of legal obligations pursuant to KVKK Article 5/2-ç
• Legitimate interests of Lityum pursuant to KVKK Article 5/2-f

b) Data of customer users

• Establishment and performance of contract pursuant to KVKK Article 5/2-c
• Legitimate interests pursuant to KVKK Article 5/2-f

c) Data relating to sales, marketing and communication processes

• Responding to pre-contractual requests pursuant to KVKK Article 5/2-c
• Explicit consent of the data subject where necessary for commercial electronic messages

Transfer of Personal Data and International Data Transfer

Personal data may be transferred to technical infrastructure, hosting and cloud service providers, and third parties providing information security and technical support services for the purpose of providing PeopleBox services and in compliance with KVKK. In case of international transfer of personal data, the conditions stipulated in KVKK and relevant secondary legislation are fulfilled; explicit consent is obtained from data subjects where necessary, or transfers are made to countries with adequate protection announced by the Board. Necessary technical and administrative measures are taken within the scope of the European Union General Data Protection Regulation (GDPR).

Personal data of applicants are processed by Lityum not as data controller but as data processor in accordance with customers' instructions; responsibility for data transfer with respect to such data belongs to the relevant customers. Lityum regularly evaluates the compliance of third-party service providers to whom personal data are transferred with current data protection legislation and relevant data security standards; and prefers to work only with third parties determined to be compliant with relevant data protection regulations.

Retention Period of Personal Data

Personal data are retained for the period required by the processing purposes and limited to the retention periods stipulated in relevant legislation; upon expiration of the period, they are deleted, destroyed or anonymized.

Security of Personal Data

Lityum undertakes that, pursuant to the relevant provisions of Law No. 6698 on the Protection of Personal Data, it has taken the necessary administrative and technical measures to prevent unlawful processing of personal data under its control and stored on the PeopleBox platform and unlawful access to such data, and to ensure the preservation of personal data. Lityum is responsible for the security of personal data only within the scope of its own platform and technical infrastructure, whether acting as data controller or providing services as data processor.

Cookies

Cookies are used on the PeopleBox website to improve user experience and ensure effective delivery of services. Detailed information regarding the use of cookies is provided in the Cookie Policy.

Rights of Data Subjects and Application Procedure

With respect to cases where PeopleBox is the data controller; pursuant to Article 11 of KVKK, by applying to Lityum, you have the right to learn whether your personal data is being processed, to request information regarding this if it is processed, to learn the purpose of processing of your data and whether it is used in accordance with its purpose. You also have the rights to learn the persons to whom your data is transferred domestically or abroad, to request correction of incomplete or incorrect data, to request destruction of your data within the framework of the provisions of Article 7 of KVKK, to object to the results of analysis made with automated systems, and to request compensation for damages arising from unlawful processing.

With respect to cases where PeopleBox is the data processor; PeopleBox customers are the data controllers with respect to personal data of applicants. Your rights and requests for destruction regarding your personal data in this scope must be directed to the relevant PeopleBox customers who are the data controllers.

You may submit your requests regarding the rights specified above by sending them to kvkk@lityum.com from your email address registered in our system, together with information and documents that will verify your identity, or by applying to our Company in writing. Additional verifications (such as SMS transmission or phone call) may be requested from you in order to confirm that the application belongs to you personally and to protect your rights.

Application requests will be concluded free of charge within a maximum of 30 (thirty) days according to their nature. However, if the transaction requires an additional cost for PeopleBox, the fee in the tariff determined by the Board may be applied. In case of destruction requests, the appropriate method among deletion, destruction or anonymization of data will be evaluated by PeopleBox according to the circumstances of the specific case.

Contact Information

Company Name: Lityum Yazılım Anonim Şirketi

MERSIS No: 0609-1151-7780-0001

Contact Email: destek@lityum.com

Address: Caferağa Mah. General Asım Gündüz Cad. Bahariye Plaza Kat: 4/K No: 62 Daire No: 41 Kadıköy / İstanbul