Octopot is an AI-powered recruitment and career platform. Companies and recruitment or HR consultancies (including white-label use under their own brand) use it to publish jobs, receive applications, pre-screen candidates with AI, run interviews and manage their hiring pipeline; candidates use it to apply to jobs, build and optimise their CV, write cover letters and take interviews. This privacy policy, prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act (PDPA) and the Hong Kong Personal Data (Privacy) Ordinance (PDPO), explains which personal data Octopot processes and in which role.
🏢 Data Controller and Data Processor Roles
Octopot processes personal data in two different roles:
Data processor (on behalf of clients): Data of candidates who apply to a client company's jobs, are added to its talent pool or are invited to interviews is processed on behalf of, and on the instructions of, that client company. The company the candidate applied to is the data controller, and candidates exercise their rights primarily against that company.
Data controller (for our own services): Octopot is the data controller when candidates use tools such as CV creation, CV optimisation, cover letters and interview preparation with their own account, and for the account data of client users (HR teams, managers, agency users), platform security logs, website visitors, and people who contact us through sales or contact forms.
The following categories of personal data are processed through the platform:
Candidate account data: Candidate account, CVs created and optimised, cover letters, job preferences and interview preparation content
Candidate identity and contact data: Name, email, phone number, location, photo (if the candidate provides one)
Candidate professional data: CV, experience, education, certificates, skills, answers to screening questions, job-fit scores
Interview data: Audio and video recordings of AI interviews, transcripts, answer evaluations and interview reports; records of phone and WhatsApp interviews
Process data: Application status, stage history, HR notes and labels, offer, reference, form, survey and document records
Client user data: Name, email, role, department and session records of company users
Technical data: IP address, cookie data, device and browser information, usage and error logs
Billing data: The client company's invoicing and payment details (card details are held by the payment provider)
Public professional data: Information from public professional profiles (e.g. LinkedIn) obtained in a client's candidate search
⚖️ Legal Basis and Purposes of Processing
Personal data is processed on the following legal bases and for the following purposes:
Client instructions / performance of contract: Publishing jobs, receiving applications, CV analysis, screening, running interviews, comparing candidates and managing the hiring process
Performance of contract with candidates: Providing candidate services such as CV creation and optimisation, cover letters, interview preparation and application tracking
Legal obligation: Statutory retention, tax and accounting obligations, requests from competent authorities
Legitimate interest: Platform security, abuse prevention, error tracking and service improvement
Explicit consent: Where required by law, for interview recording, international transfers and marketing communications
Establishment of legal claims: Protecting rights in legal disputes
🔒 Security Measures
The following technical and organisational measures protect personal data:
Encryption: SSL/TLS in transit, encrypted storage of sensitive integration credentials
Access control: Role- and department-based permissions; each client company can only access its own data
Audit logs: Critical operations and data access are logged
Security reviews: Regular security testing and vulnerability remediation
Staff training: Training on data security and confidentiality
Infrastructure security: Cloud infrastructure providers with security certifications
🌍 International Data Transfers
To provide the service, data may be transferred to the following service providers, including abroad:
Cloud hosting: The cloud infrastructure where platform data is stored
AI services: OpenAI / Microsoft Azure OpenAI for CV analysis, scoring and interview evaluation
Voice services: Speech-to-text in interviews (Soniox) and voice response generation (Cartesia)
Communication services: Email (Mailgun), phone calls (Twilio) and WhatsApp (Meta)
Payments and monitoring: Payment processing (Stripe), error tracking (Sentry)
Legal safeguards: Transfer mechanisms under KVKK Art. 9, GDPR Art. 46 Standard Contractual Clauses, PDPA Section 26, adequacy decisions
⏰ Data Retention Periods
Personal data is retained for the following periods:
Candidate data: For the period set by the client company; deleted or returned on the client's instruction or when the contract ends
Candidate accounts and CVs: For as long as the candidate account is active; deleted within 30 days of account deletion
Interview recordings: For the period set by the client company
Client user accounts: For as long as the account is active
Billing records: 10 years, as required by law
Sales and contact requests: 2 years from the last contact
Security logs: For the period required by law
Deletion requests: Within 30 days of the request (except statutory retention)
👤 Data Subject Rights
Under KVKK Art. 11, the GDPR, PDPA and PDPO you have the rights below. For your candidate account and CV tools data, contact Octopot. For data relating to an application you made to a company, you exercise these rights primarily against that company; such requests sent to Octopot are forwarded to the company without delay and we help the company fulfil them:
Right to be informed: Learn whether your personal data is processed
Right of access: Request a copy of your data
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your data
Right to data portability: Receive your data in a structured format
Withdrawal of consent: Withdraw your consent at any time
Right to object: Object to processing
Automated decision-making: Object to adverse outcomes based solely on automated processing
🤝 Sharing with Third Parties
Octopot does not sell personal data. Data is shared only with:
Client companies: Candidate data with the company the candidate applied to or was added by (and the users that company authorises); candidates can also allow employers to see their CV through the CV visibility setting
Sub-processors: Hosting, AI, voice, communication and payment providers, to the extent needed to deliver the service
Client integrations: Systems the client company connects itself (e.g. webhooks, calendars, mailboxes)
Legal authorities: Where required by law
Advisers: Legal and financial advisers under confidentiality obligations
🚨 Data Breach Notification
In the event of a personal data breach:
Notifying clients: Breaches affecting data processed on a client's behalf are reported to that client without undue delay
Notifying authorities: For data we control, the competent authority (KVKK Board, relevant DPA) is notified within 72 hours
Notifying individuals: Affected individuals are informed where required
Scope: A description of the data affected
Measures taken: Steps taken to limit the impact of the breach