Job Applicant Privacy Notice
This Privacy Notice for job applicants has been prepared to ensure compliance with the Personal Data Protection Law No. 6698 (the “Law”) in relation to the personal data that we have obtained or will obtain from you (“Data Subject”) within the scope of the products and services we provide.
Data Controller under the Law
In accordance with Article 3 of the Law, the Data Controller is:
SANUS SIGORTA BROKERLIĞI ANONIM ŞIRKETI (“Sanus”)
Harbiye Mah. Asker Ocağı Cad. Süzer Plaza No: 6 İç Kapı No: 120 Şişli / İstanbul
Tax ID: 7441222438
Trade registry number: 1094833 / Istanbul Trade Registry
Sanus processes personal data of users in compliance with the Law and related secondary regulations.
Principles Governing the Processing of Personal Data
Personal data are processed in accordance with the following principles, pursuant to Article 4 of the Law:
Lawfulness and fairness
Being accurate and kept up to date where necessary.
Being processed for specified, explicit and legitimate purposes.
Being relevant, limited and proportionate to the purposes for which they are processed.
Being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.
Legal Grounds for Processing Personal Data (Article 5 and 6)
Personal data are processed in accordance with Articles 5 and 6 of the Law. Personal data shall not be processed without explicit consent of the data subject.
Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met (Article 5 of the Law):
It is expressly provided for by the laws.
It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to physical disability or whose consent is not deemed legally valid.
Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
It is necessary for compliance with a legal obligation to which the data controller is subject.
Personal data have been made public by the data subject himself/herself.
Data processing is necessary for the establishment, exercise or protection of any right.
Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Personal data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance, membership in associations, foundations or trade unions, data concerning health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data. Special categories of personal data may be processed in accordance with the rules of the Law, and only in cases stipulated by law, provided that sufficient administrative and technical security measures are taken.
It is prohibited to process special categories of personal data. However, such processing is permitted under the following conditions under Article 6 of the Law:
Data subject has given his/her explicit consent,
It is explicitly provided by laws,
It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person who is unable to explain his/her consent due to physical disability or whose consent is not deemed legally valid,
It relates to personal data that have been made public by the data subject, and processing is in consistent with data subject’s intention to make such data public,
It is necessary for the establishment, exercise or protection of any right,
It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and for the planning, management and financing of health-care services by persons subject to legal obligation of confidentiality or by competent public institutions and organizations,
It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance,
It relates to the current or former members and affiliates of foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, or to individuals who are in regular contact with these organizations, provided that such processing complies with the applicable legislation governing these organizations and their objectives, is limited to the organizations’ fields of activity, and does not involve disclosure of data to third parties.
Purposes of Processing Your Personal Data
Your personal data are collected by Sanus for the purpose of providing services to you, through automatic or non-automatic means via registration, through channels such as e-mail, relevant websites and mobile applications, and through the accounts to which you have granted access, in electronic environments, as well as through the call center channel or physically via mail/cargo, based on the following legal grounds set forth in Article 5 of the Law.
Candidates wishing to work at Sanus may submit their applications through our website or via e-mail. Applications may also be submitted through LinkedIn, Kariyer.net, and similar career platforms.
Personal data will be processed for the following purposes
To receive, review, evaluate, and conclude your job application for open positions within Sanus and our group companies,
To assess your knowledge, experience, competencies, qualifications, and suitability for the requirements of the relevant position; to conduct the recruitment processes; and to plan human resources activities,
To contact you throughout the application process and to organize interviews and assessment activities,
To verify and evaluate reference information, and to contact references,
To carry out recruitment procedures and to fulfill legal obligations in the event that the application is successful,
To evaluate the candidate for future suitable positions and to contact the candidate for such opportunities, provided that the candidate has given explicit consent where the application is not considered suitable for the relevant position,
To manage, develop, and report on the Sanus' recruitment processes,
To fulfill obligations arising from applicable legislation and to respond to requests and to provide information to public institutions and authorities,
To prevent and manage legal disputes and to exercise the Sanus' rights of defense where necessary,
To monitor, manage, and complete activities related to legal affairs, finance, accounting, marketing, corporate communications, and logistics.
Personal Data Being Processed
| Personal Data | Purpose of Process |
|---|---|
| Identity Information(Information contained in identity documents, including first name, last name, title, Turkish Republic Identity Number, Foreign Identity Number or passport number, trade registry number, tax office, tax identification number, date of birth, nationality, gender, and place of birth.) | Article 5 – 2 (c): Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.Article 5 – 2 (ç): It is necessary for compliance with a legal obligation to which the data controller is subject.Article 5 – 2 (d): Personal data have been made public by the data subject himself/herself.Article 5 – 2 (e): Data processing is necessary for the establishment, exercise or protection of any right. |
| Contact Information(All types of contact information, including home and workplace addresses, telephone numbers (mobile, home and work), fax number, email addresses, and registered electronic mail (KEP) addresses.) | Article 5 – 2 (c): Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.Article 5 – 2 (ç): It is necessary for compliance with a legal obligation to which the data controller is subject.Article 5 – 2 (d): Personal data have been made public by the data subject himself/herself.Article 5 – 2 (e): Data processing is necessary for the establishment, exercise or protection of any right. |
| Other Information(Professional experience information (previous employers, job titles, employment period, professional competencies and reference information, other information included in the CV, cover letter submitted by the candidate during the application process, interview notes and evaluation information, and, if requested, foreign language proficiency and professional qualification information, diploma and certificate information). | Article 5 – 2 (c): Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.Article 5 – 2 (ç): It is necessary for compliance with a legal obligation to which the data controller is subject.Article 5 – 2 (d): Personal data have been made public by the data subject himself/herself.Article 5 – 2 (e): Data processing is necessary for the establishment, exercise or protection of any right. |
The personal data contained in your CV, cover letter, and other application documents submitted to us as part of your job application will be processed for the purposes of evaluating your application and conducting our recruitment processes. Please note that any personal data you voluntarily include in your application documents, beyond the information specifically requested, may also be processed within the scope of the recruitment process.
Should your application be successful and an employment decision be made, the CV, application form, interview evaluations, reference information, and other relevant information and documents provided during the recruitment process may be processed for the purposes of carrying out recruitment procedures, managing human resources processes, fulfilling legal obligations, creating and maintaining your personnel file, and retaining records relating to the establishment of the employment relationship. Such information may be retained for the periods prescribed under applicable legislation.
For job applications submitted via the website of Sanus;, including user identification information (username and password), IP address information, system access logs, user activity records (records related to actions such as password creation and password reset), website login and logout information, and device identifiers (device ID) and token information of the device used for access, are processed for the purposes of ensuring technical, administrative, legal and commercial security, and providing the services.
Such personal data are processed on the following legal bases: (i) processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract; and/or (ii) data processing is necessary for the establishment, exercise or protection of any right and/or (iii) processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Transfer of Personal Data to Third Parties and/or Abroad
Your personal data may be transferred to third parties and/or abroad in accordance with the conditions specified in Articles 8 and 9 of the Law for the purposes stated above, based on your explicit consent where required.
Accordingly, your personal data may be transferred to third parties and/or abroad for the purposes stated above under the following circumstances:
It is expressly provided for by the laws.
It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to physical disability or whose consent is not deemed legally valid.
Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
It is necessary for compliance with a legal obligation to which the data controller is subject.
Personal data have been made public by the data subject himself/herself.
Data processing is necessary for the establishment, exercise or protection of any right.
Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Personal data may be transferred abroad if one of the conditions specified in Articles 5 and 6 of the Law is met and there is an adequacy decision regarding the country, sectors within the country, or international organizations to which the transfer will be made. Transfers are conducted in compliance with the principles of the Law.
Your personal data may be transferred, in line with the purposes stated above and within the framework of the conditions set forth in Articles 8 and 9 of the Law, based on your explicit consent, to (i) domestic and foreign third parties from whom Sanus receives services for storage, archiving, and hosting systems for the purpose of carrying out its information security processes; (ii) domestic and foreign employees and business partners; (iii) authorized public institutions and organizations, where required by applicable legislation; (iv) hosting service providers whose servers are located domestically and/or abroad; and (v) domestic and foreign third parties from whom we receive support for operational activities.
Data Subject Rights under the Law (Article 11)
Pursuant to Article 11 of the Law, data subjects have the right to:
to learn whether his/her personal data are processed or not,
to demand for information as to if his/her personal data have been processed,
to learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose,
to know the third parties to whom his personal data are transferred in the country or abroad,
to request the rectification of the incomplete or inaccurate data, if any,
to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,
to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,
to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
to claim compensation for the damage arising from the unlawful processing of his/her personal data.
You have the right to claim compensation for damages if you suffer harm due to the unlawful processing of your personal data. However, according to Article 28, paragraph 1 of the Law, the rights listed above cannot be asserted in the following cases:
personal data are processed by natural persons within the scope of purely personal activities of the data subject or of family members living together with him/her in the same dwelling provided that it is not to be disclosed to third parties and the obligations about data security are to be complied with.
personal data are processed for official statistics and provided that they are being anonymized for purposes such as research, planning and statistics.
personal data are processed with artistic, historical, literary or scientific purposes, or within the scope of freedom of expression provided that national defence, national security, public security, public order, economic security, right to privacy or personal rights are not violated or the process doesn’t constitute a crime.
personal data are processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorised and assigned by law to maintain national defence, national security, public security, public order or economic security.
personal data are processed by judicial authorities or execution authorities regarding investigation, prosecution, judicial or execution proceedings.
Retention, Deletion, Destruction, and Anonymization of Personal Data
Your personal data are stored for the periods stipulated in the relevant legislation.
In cases where no retention period is stipulated in the law regarding the retention of personal data, it is processed at data controller’s discretion and in accordance with commercial practices for as long as necessary. Upon expiration of this period, personal data are deleted, destroyed, or anonymized.
Personal data whose processing purpose has ended, or which you have requested to be deleted or anonymized, may be retained for purposes such as serving as evidence in potential disputes, asserting a right, or establishing a defense, provided that the retention periods stipulated in the law have also expired.
Even if processed in accordance with the provisions of the legislation, if the reasons requiring its processing cease to exist, personal data will be deleted, destroyed, or anonymized upon Sanus’ decision or your request.
You may submit your requests using one of the application methods listed on the Data Subject Application Form page.
Requests will be concluded as soon as possible and/or within 30 (thirty) days. However, if fulfilling your request incurs additional costs, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.
Sanus reserves the right to update this Privacy Notice unilaterally if required by law.
Want to exercise your rights?
You can submit your requests under data protection law via the Data Subject Application Form.