Your application, and your data.

The data controller — veri sorumlusu — is Hublinkly Ai Software Technology Ltd., trading as HublinkTech:

Hublinkly Ai Software Technology Ltd. Şişli, Abide-i Hürriyet Cd. No:211, Bolkan Center No.2 34381 Istanbul, Türkiye

For anything in this notice, write to [email protected]. That address receives applications, so quoting your reference number reaches the right file fastest.

From the form, when you send it:

• Your full name and email address. Both are required — we cannot assess an application we cannot attribute, or reply to one we cannot reach.
• Your phone number, if you give one. Optional, and an application without it is treated no differently.
• The area of interest you select, and the short note you write, if you write one.
• Your LinkedIn profile address, if you give one. We read the profile; we do not store a copy of it.
• Your CV, as the file you upload. We store the file itself.
• The language of the page you applied from, the moment you gave consent, and a reference number we generate for you. None of these come from you.

Your CV will usually contain more than the form asks for — education, employment history, sometimes a photograph or a date of birth. We do not require any of it, and we do not ask for special categories of personal data: health, religion, political opinion, union membership, criminal records or biometric data. If your CV contains any of that, you are sending it on your own initiative, and it plays no part in how we assess you.

We do not record your IP address against your application. The form does count requests per IP address to stop automated abuse, and those counters hold an address and a number for up to 24 hours. They are not joined to your application and cannot be used to find it.

Three purposes, and nothing else:

• To read your application and decide whether there is a fit, now or later.
• To contact you about it — to ask a question, to arrange a conversation, or to tell you there is nothing suitable.
• To keep your details on file for the period in section 5, so we can come back to you when a suitable role opens.

We do not use application data for marketing, we do not add you to a mailing list, and we do not use it to train any model.

Your explicit consent, given by ticking the box on the form — KVKK Article 5(1), and GDPR Article 6(1)(a) where the GDPR applies to you.

Consent rather than a contract or a legitimate interest, because you are not applying for an advertised position: you are asking us to keep your details until something suitable exists. Holding a CV on that basis is only reasonable with your agreement.

Because the file is stored in the European Union rather than in Türkiye (section 6), your consent also covers the transfer of that data abroad under KVKK Article 9.

You can withdraw consent at any time, and withdrawing costs you nothing except the application itself — we delete it and stop there. Section 8 says how.

Twelve months from the day your application reaches us. At the end of that period we delete both the record and the CV file; we keep no archive copy and no summary of it.

If you withdraw consent or ask for deletion before then, we delete it when you ask rather than waiting out the twelve months.

If we hire you, your application data becomes part of an employment record with its own legal basis and its own notice, and this notice stops applying to it.

One processor, named:

• Supabase, Inc. hosts both the database record and the CV file as our data processor. The project's database and file storage are located in the European Union — Frankfurt, Germany.
• The CV store is private. There is no public web address for it, no link that can be shared or guessed, and files are readable only by our own server using a credential that is never sent to a browser.

We use no recruitment agency, no applicant tracking service, and no CV-screening or ranking service. We do not sell application data, and we share it with nobody outside HublinkTech.

Inside HublinkTech, access is limited to the people involved in hiring.

Under KVKK Article 11, and under the GDPR where it applies to you, you can ask us to:

• Tell you whether we hold personal data about you, and if so, what.
• Explain the purpose it is processed for, and whether it is being used in line with that purpose.
• Name the third parties it has been transferred to, in Türkiye or abroad.
• Correct anything inaccurate or incomplete.
• Delete it. No reason is needed, and it costs you nothing.
• Treat your consent as withdrawn from the moment you say so.
• Object to a decision reached solely by automated processing — though we make none: every application here is read by a person.
• Claim compensation for damage caused by unlawful processing.

Write to [email protected] and say what you want — a copy, a correction, or deletion. Include your reference number if you still have it; it makes the file immediate to find, but we will find it without one.

We answer within thirty days, which is the deadline KVKK sets. Deletion requests we act on straight away and confirm when they are done.

You can also complain to the Turkish Personal Data Protection Authority — Kişisel Verileri Koruma Kurumu — and if you are in the EU or EEA, to your own supervisory authority. You do not have to write to us first.

If we change how applications are handled — for instance when the form starts sending a confirmation email — we update this notice and the date at the top of it before the change goes live.