Vindy Candidate Privacy Notice

Last update: 16 June 2026

We are committed to protecting your privacy and taking our responsibilities for your personal data seriously.

This Privacy Notice explains how your personal data is collected and used when you participate in an interview conducted through Vindy (“Vindy”), our interview platform, as part of a recruitment process.

Vindy is used by organisations (“Clients”) to conduct interviews with candidates and support their recruitment activities. This Notice applies to individuals (“Candidates”, “you”, “your”) who take part in a telephone interview using Vindy.

About Us

We are Vinter Yazılım ve Yapay Zeka Teknolojileri Anonim Şirketi (“Vinter”, “we”, “us”, “our”), a software provider offering recruitment intelligence solutions. We are registered with the İzmir Trade Registry Office under number 258415 and have our registered office at Adatepe Mah. Doğuş Cad. No: 207Z İç Kapı No: 1, Buca, İzmir, Türkiye.

Vinter acts as a data controller when processing personal data for its own operational purposes. This includes maintaining the security and integrity of the Vindy system, ensuring the integrity, reliability and performance of the service, complying with legal obligations and, where you choose to participate, managing a voluntary candidate pool for potential future opportunities.

Where you participate in an interview conducted through Vindy in connection with a specific job application, the relevant Client acts as the data controller for the recruitment process. In those circumstances, Vinter processes personal data on the Client's behalf and in accordance with its instructions, in order to provide the technical infrastructure required to conduct the interview.

Vindy enables Clients to contact candidates, present interview questions determined by the Client, record candidate responses and generate interview transcripts and structured outputs. These outputs are used to support the Client's assessment process and do not replace human decision-making. Recruitment assessments and hiring decisions are made exclusively by the relevant Client.

For information about how your personal data is used within the recruitment process, please refer to the Privacy Notice provided by the relevant Client.

If you have any questions about how your personal data is processed through Vindy, or about the respective roles of Vinter and the relevant Client, please contact us using the details provided in this Notice.

What personal data do we collect?

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Information includes first name, last name and any previous names.
• Contact Information includes telephone number and email address used to schedule and conduct the interview.
• Professional Information includes information relating to your education, qualifications, work experience and skills, to the extent shared during the interview or provided by the Client.
• Interview Information includes audio recordings of your telephone interview, transcripts of your responses, and related metadata such as the date, time and duration of the interview.
• Communication Information includes communications with us in connection with your interview, including support requests, feedback, survey responses, complaints or other enquiries submitted through available communication channels.
• Technical Data includes operational data generated in connection with the conduct of the interview and the operation of the system, such as call logs, connection type (e.g. outbound), call duration, timestamps, call status (e.g. completed, busy, disconnected), call termination reasons, IP address or domain information associated with the call infrastructure, and system performance logs.

We may also process anonymised or aggregated data that does not identify you for purposes such as maintaining and improving system performance, reliability and security.

How we collect your personal data

We use different methods to collect data from and about you including through:

• Information provided by Clients. Our Clients may provide us with your identity information, contact details and limited application-related information in order to schedule and conduct your interview.
• Information provided directly by you. You may provide personal data during the telephone interview conducted through Vindy, including through your responses to interview questions. You may also provide personal data when communicating with us through available channels such as email or telephone, including when submitting enquiries, feedback, complaints or survey responses.
• Information collected automatically. When you participate in an interview, certain data is automatically generated as part of operating the system. This includes audio recordings, transcripts, interview timing information, call logs and related operational metadata.
• Information received from third parties. We may receive limited technical and operational data from service providers that support the operation of Vindy, such as infrastructure providers, cloud hosting providers and system monitoring providers.

Why do we use your personal data

Where we act as a data controller, we are required under applicable data protection laws to have a lawful basis for processing your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you, where we need to perform the contract we are about to enter into or have entered into with you;
• Legitimate interests, where processing is necessary for our legitimate business interests and does not override your rights and freedoms;
• Legal obligation, where processing is necessary to comply with applicable laws or regulatory requirements;
• Consent, where we have obtained your clear and specific agreement for a defined purpose.

The table below sets out the purposes for which we use your personal data, the categories of personal data involved, and the legal bases on which we rely.

Disclosures of your personal data

We may share your personal data with the categories of recipients described below where this is necessary for the purposes set out above. The nature and extent of any disclosure will depend on our role (as a data processor or independent data controller) in relation to the relevant processing activity.

• Clients. Your interview recordings, transcripts, and related interview information are shared with the Client to which you have applied. The Client acts as the data controller in relation to recruitment decisions and determines how your personal data is used within its recruitment process. Where applicable and subject to appropriate safeguards (including your consent), your personal data may also be shared with other Clients for the purpose of assessing potential suitability for relevant roles.
• Service Providers. We engage carefully selected service providers to support the operation, hosting, security, and maintenance of Vindy. These may include telephony infrastructure providers, cloud hosting and secure storage providers, system monitoring providers, and IT support providers. These providers process personal data solely on our behalf, in accordance with our written instructions and contractual safeguards, and may not use your personal data for their own purposes.
• Artificial Intelligence Services. Vindy incorporates AI-supported functionalities to facilitate structured interviews. Where third-party AI infrastructure providers are used, personal data may be processed by those providers to enable the relevant functionality within the Vindy system. Contractual safeguards are in place to ensure that personal data is not used to train or improve the provider's general-purpose models or reused for services provided to other third-party customers.
• Professional Advisers. We may disclose limited personal data to professional advisers such as legal advisers, auditors, insurers, or other consultants where necessary for compliance, risk management, or the establishment, exercise, or defence of legal claims.
• Regulatory Authorities and Law Enforcement. We may disclose personal data where required to do so by law or where we reasonably believe that disclosure is necessary to comply with a legal obligation, respond to lawful requests from public authorities, protect our rights or safety, or prevent fraud or security incidents.
• Corporate Transactions. If we sell, transfer, merge, or reorganise parts of our business or assets, personal data may be disclosed to prospective or actual purchasers and their advisers. In such circumstances, personal data will continue to be processed in accordance with this Privacy Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

Vinter uses cloud infrastructure located within the European Economic Area (“EEA”). Personal data processed through Vindy may therefore be transferred to, or accessed from, jurisdictions outside the EEA or the United Kingdom (“UK”). Some of these countries may not provide a level of data protection that is considered adequate under EEA or UK data protection laws.

Whenever personal data is transferred outside the EEA or the UK, we ensure that appropriate safeguards are in place to provide a level of protection that is essentially equivalent to that required under applicable data protection laws. In particular, where a country benefits from an adequacy decision we rely on that decision; where no adequacy decision applies, we implement appropriate contractual safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal or regulatory obligations.

Personal data processed in connection with interviews conducted through Vindy is processed on behalf of the relevant Client and retained in accordance with the Client's instructions. Once the relevant recruitment process has been completed, such data is retained only for as long as necessary under our data retention and deletion policies and is then deleted or anonymised, unless continued retention is required to comply with legal obligations or for the establishment, exercise or defence of legal claims.

If you choose to join the voluntary candidate pool, your personal data may be retained to facilitate potential matching with future opportunities offered by other Clients. Candidate pool data is generally retained for up to twelve months unless you withdraw your consent earlier. You may withdraw your consent to participate in the candidate pool at any time. If you do so, your information will be removed from the candidate pool in accordance with our deletion procedures.

Once data is no longer required for the purposes described above, it will be securely deleted or anonymised. Anonymised information may be used for research, statistical analysis or system improvement purposes.

Your legal rights

You have a number of rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances, where there is no good reason for us continuing to process it. Note that we may not always be able to comply for specific legal reasons, which will be notified to you where applicable.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party). In some cases, we may demonstrate compelling legitimate grounds to process your information which override your right to object.
• Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Request restriction of processing of your personal data in certain scenarios, such as where you want us to establish the data's accuracy, where our use of the data is unlawful but you do not want us to erase it, where you need us to hold the data to establish, exercise or defend legal claims, or where you have objected to our use of your data pending verification of overriding legitimate grounds.

If you wish to exercise any of the rights set out above, please submit your request via our online Data Subject Request Form or using the contact details below.

No fee usually required. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or refuse to comply with your request in these circumstances.

What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests; in this case, we will notify you and keep you updated.

Complaints

We are committed to working with you to resolve any concern you may have regarding your privacy or the way your personal data is handled. We encourage you to contact us in the first instance so that we can seek to address the issue promptly.

You have the right to lodge a complaint with a supervisory authority if you believe that your personal data has been processed in a manner that does not comply with applicable data protection laws. If you are located in the United Kingdom, you may contact the Information Commissioner's Office (ICO) at www.ico.org.uk. If you are located in the European Union, you may lodge a complaint with the supervisory authority in your country of residence or the place of the alleged infringement.

Changes to this privacy notice

We may update this Notice from time to time. When we do, we will take appropriate measures to inform you, consistent with the significance of the changes we make. You can see when this Notice was last updated by checking the “last updated” date displayed at the top of this notice. It is important that the personal data we hold about you is accurate and current; please keep us informed if your personal data changes.

Contact details

If you have any questions about this privacy notice or about the use of your personal data, or you want to exercise your privacy rights, please contact us:

Vinter Yazılım ve Yapay Zeka Teknolojileri Anonim Şirketi
Adatepe Mah. Doğuş Cad. No: 207Z İç Kapı No: 1, Buca, İzmir, Türkiye
dpo@vinter.me