Privacy Policy
Octopot is an AI-powered recruitment and career platform. Companies and recruitment or HR consultancies (including white-label use under their own brand) use it to publish jobs, receive applications, pre-screen candidates with AI, run interviews and manage their hiring pipeline; candidates use it to apply to jobs, build and optimise their CV, write cover letters and take interviews. This privacy policy, prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act (PDPA) and the Hong Kong Personal Data (Privacy) Ordinance (PDPO), explains which personal data Octopot processes and in which role.
🏢 Data Controller and Data Processor Roles
Octopot processes personal data in two different roles:
- Data processor (on behalf of clients): Data of candidates who apply to a client company's jobs, are added to its talent pool or are invited to interviews is processed on behalf of, and on the instructions of, that client company. The company the candidate applied to is the data controller, and candidates exercise their rights primarily against that company.
- Data controller (for our own services): Octopot is the data controller when candidates use tools such as CV creation, CV optimisation, cover letters and interview preparation with their own account, and for the account data of client users (HR teams, managers, agency users), platform security logs, website visitors, and people who contact us through sales or contact forms.
- Company: Octopot
- Email: privacy@octopot.co
- KVKK Representative: privacy@octopot.co
- GDPR Representative: privacy@octopot.co
- PDPA Contact: privacy@octopot.co
📋 Categories of Personal Data Collected
The following categories of personal data are processed through the platform:
- Candidate account data: Candidate account, CVs created and optimised, cover letters, job preferences and interview preparation content
- Candidate identity and contact data: Name, email, phone number, location, photo (if the candidate provides one)
- Candidate professional data: CV, experience, education, certificates, skills, answers to screening questions, job-fit scores
- Interview data: Audio and video recordings of AI interviews, transcripts, answer evaluations and interview reports; records of phone and WhatsApp interviews
- Process data: Application status, stage history, HR notes and labels, offer, reference, form, survey and document records
- Client user data: Name, email, role, department and session records of company users
- Technical data: IP address, cookie data, device and browser information, usage and error logs
- Billing data: The client company's invoicing and payment details (card details are held by the payment provider)
- Public professional data: Information from public professional profiles (e.g. LinkedIn) obtained in a client's candidate search
⚖️ Legal Basis and Purposes of Processing
Personal data is processed on the following legal bases and for the following purposes:
- Client instructions / performance of contract: Publishing jobs, receiving applications, CV analysis, screening, running interviews, comparing candidates and managing the hiring process
- Performance of contract with candidates: Providing candidate services such as CV creation and optimisation, cover letters, interview preparation and application tracking
- Legal obligation: Statutory retention, tax and accounting obligations, requests from competent authorities
- Legitimate interest: Platform security, abuse prevention, error tracking and service improvement
- Explicit consent: Where required by law, for interview recording, international transfers and marketing communications
- Establishment of legal claims: Protecting rights in legal disputes
🔒 Security Measures
The following technical and organisational measures protect personal data:
- Encryption: SSL/TLS in transit, encrypted storage of sensitive integration credentials
- Access control: Role- and department-based permissions; each client company can only access its own data
- Audit logs: Critical operations and data access are logged
- Security reviews: Regular security testing and vulnerability remediation
- Staff training: Training on data security and confidentiality
- Infrastructure security: Cloud infrastructure providers with security certifications
🌍 International Data Transfers
To provide the service, data may be transferred to the following service providers, including abroad:
- Cloud hosting: The cloud infrastructure where platform data is stored
- AI services: OpenAI / Microsoft Azure OpenAI for CV analysis, scoring and interview evaluation
- Voice services: Speech-to-text in interviews (Soniox) and voice response generation (Cartesia)
- Communication services: Email (Mailgun), phone calls (Twilio) and WhatsApp (Meta)
- Payments and monitoring: Payment processing (Stripe), error tracking (Sentry)
- Legal safeguards: Transfer mechanisms under KVKK Art. 9, GDPR Art. 46 Standard Contractual Clauses, PDPA Section 26, adequacy decisions
⏰ Data Retention Periods
Personal data is retained for the following periods:
- Candidate data: For the period set by the client company; deleted or returned on the client's instruction or when the contract ends
- Candidate accounts and CVs: For as long as the candidate account is active; deleted within 30 days of account deletion
- Interview recordings: For the period set by the client company
- Client user accounts: For as long as the account is active
- Billing records: 10 years, as required by law
- Sales and contact requests: 2 years from the last contact
- Security logs: For the period required by law
- Deletion requests: Within 30 days of the request (except statutory retention)
👤 Data Subject Rights
Under KVKK Art. 11, the GDPR, PDPA and PDPO you have the rights below. For your candidate account and CV tools data, contact Octopot. For data relating to an application you made to a company, you exercise these rights primarily against that company; such requests sent to Octopot are forwarded to the company without delay and we help the company fulfil them:
- Right to be informed: Learn whether your personal data is processed
- Right of access: Request a copy of your data
- Right to rectification: Request correction of inaccurate data
- Right to erasure: Request deletion of your data
- Right to data portability: Receive your data in a structured format
- Withdrawal of consent: Withdraw your consent at any time
- Right to object: Object to processing
- Automated decision-making: Object to adverse outcomes based solely on automated processing
🤝 Sharing with Third Parties
Octopot does not sell personal data. Data is shared only with:
- Client companies: Candidate data with the company the candidate applied to or was added by (and the users that company authorises); candidates can also allow employers to see their CV through the CV visibility setting
- Sub-processors: Hosting, AI, voice, communication and payment providers, to the extent needed to deliver the service
- Client integrations: Systems the client company connects itself (e.g. webhooks, calendars, mailboxes)
- Legal authorities: Where required by law
- Advisers: Legal and financial advisers under confidentiality obligations
🚨 Data Breach Notification
In the event of a personal data breach:
- Notifying clients: Breaches affecting data processed on a client's behalf are reported to that client without undue delay
- Notifying authorities: For data we control, the competent authority (KVKK Board, relevant DPA) is notified within 72 hours
- Notifying individuals: Affected individuals are informed where required
- Scope: A description of the data affected
- Measures taken: Steps taken to limit the impact of the breach
- Contact: Questions about a breach: privacy@octopot.co
👶 Children's Privacy
The platform is used for recruitment:
- Age limit: The platform is not intended for people under 16, and we do not knowingly collect their data
- Applicants under 18: Processed only where the law allows, under the client company's responsibility and with the required parental/guardian consent
- If detected: Data found to belong to someone under 16 is deleted after informing the relevant company
🤖 Automated Processing and AI
The platform uses AI to help candidates with their CV and interview preparation and to support client companies' hiring decisions:
- Candidate tools: CV creation and optimisation, cover letter and interview question suggestions; the candidate reviews and can edit the output
- CV and fit score: Scoring how well a CV matches a job's requirements
- Screening: Evaluation against screening questions and rules defined by the client company
- Interview evaluation: Evaluation of AI interview answers, transcripts and expression analysis from video
- Human decision: Hiring decisions are made by the client company; AI outputs support those decisions
- Right to object: You can contest automated evaluation and request human review
- Model training: Client and candidate data is not used to train general AI models without the client's approval
📞 Contact and Complaints
Contact us about data protection:
🍪 Cookies and Tracking Technologies
Our website and platform use cookies and similar technologies:
- Strictly necessary cookies: Required for sessions and security
- Performance cookies: Usage statistics (with your consent)
- Functional cookies: Remembering preferences such as language
- Marketing cookies: Only with your consent
- Managing cookies: Use the cookie banner settings and your browser to manage your preferences
📊 Data Analysis and Statistics
To improve the service, data may be analysed in anonymised and aggregated form:
- Anonymisation: Personal identifiers are removed
- Aggregate analysis: Usage statistics and performance measurement
- Client reports: Client companies only receive reports on their own processes
- Data minimisation: Only the data needed is processed
🔄 Policy Updates
This privacy policy may be updated from time to time:
- Notice of changes: Material changes are emailed to client companies
- Website notice: The current version is always published on this page
- Effective date: Each update states its effective date
- Renewed consent: Consent is requested again where required
Octopot
Log in