Section A: Provisions for Users in the European Union (EU/EEA) & Global Markets (GDPR & EU AI Act)

If you reside in or access our services from the European Economic Area (EEA), the United Kingdom, or jurisdictions with similar privacy frameworks, the processing of your personal data is governed by the EU General Data Protection Regulation (GDPR).

Legal Grounds for Processing (GDPR Article 6)

• Contractual Necessity (Art. 6(1)(b)): To execute our Terms of Service, register your account, and deliver job application and assessment services.
• Legitimate Interests (Art. 6(1)(f)): To improve our AI models anonymously, secure our Platform, and prevent fraudulent usage.
• Legal Obligation (Art. 6(1)(c)): To satisfy tax, accounting, and regulatory compliance obligations.
• Consent (Art. 6(1)(a)): For optional promotional communications or specific processing of sensitive candidate data when required.

Automated Decision-Making & AI Profiling (GDPR Article 22 & EU AI Act)

Recrugate utilizes artificial intelligence algorithms to evaluate candidate responses, analyze resume data, and provide suitability scores. In full alignment with GDPR Article 22 and EU AI Act principles:

• Human Oversight ("Human-in-the-loop"): Recrugate's AI outputs serve as advisory decision-support tools for recruiting teams. Final hiring or rejection decisions are always made by human recruiters or hiring managers.
• Right to Human Intervention: Candidates have the right to request human review of their AI assessment scores, express their point of view, and contest automated evaluations.

Your Data Subject Rights under GDPR

• Right to Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / Unutulma Hakkı (Art. 17):Candidates can delete their account and associated data directly at any time via Candidate Account Settings > Delete Account, or by contacting our Data Protection Officer.
• Right to Data Portability (Art. 20): Request your personal data in a structured, commonly used, and machine-readable format.
• Right to Restrict or Object to Processing (Art. 18 & 21): Object to processing based on legitimate interests or request processing restrictions.

Section B: Specific Provisions for Users Subject to Turkish Legislation (KVKK Law No. 6698)

Türkiye Cumhuriyeti mevzuatına ve 6698 sayılı Kişisel Verilerin Korunması Kanununa ("KVKK") tabi kullanıcılarımız için Recrugate, "Veri Sorumlusu" sıfatıyla hareket etmektedir.

KVKK Madde 11 Kapsamındaki Haklarınız

KVKK'nın 11. maddesi uyarınca, veri sahibi olarak aşağıdaki haklara sahipsiniz:

• Kişisel verilerinizin işlenip işlenmediğini öğrenme, işlenmişse buna ilişkin bilgi talep etme.
• Kişisel verilerin işlenme amacını ve bunların amacına uygun kullanılıp kullanılmadığını öğrenme.
• Yurt içinde veya yurt dışında kişisel verilerin aktarıldığı üçüncü kişileri bilme.
• Kişisel verilerin eksik veya yanlış işlenmiş olması hâlinde bunların düzeltilmesini isteme.
• KVKK 7. maddede öngörülen şartlar çerçevesinde kişisel verilerin silinmesini veya yok edilmesini isteme (Adaylar bu işlemi hesap ayarları üzerinden kendileri de gerçekleştirebilir).
• İşlenen verilerin münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle kişinin kendisi aleyhine bir sonucun ortaya çıkmasına itiraz etme.
• Kişisel verilerin kanuna aykırı olarak işlenmesi sebebiyle zarara uğraması hâlinde zararın giderilmesini talep etme.

Section C: Google API Services User Data Policy & Limited Use Disclosure

Recrugate integrates with Google APIs (specifically Google Calendar API) to provide seamless interview scheduling and calendar synchronization for recruiters and candidates.

1. Data Accessed & Purpose

When you connect your Google account, Recrugate requests access to your Google Calendar events (https://www.googleapis.com/auth/calendar.events) and basic profile information (openid, email). This data is strictly utilized to:

• Display and check your calendar availability for interview slots.
• Create, update, and manage candidate interview events with automatic Google Meet video conferencing links.
• Synchronize interview schedule changes and cancellations directly to your Google Calendar.

2. Data Sharing, Transfer, and Disclosure

We do not share, sell, rent, or disclose Google user data to any third parties, data brokers, or advertising networks. Google user data is only processed internally to perform the core calendar and interview scheduling functionalities requested by the user.

3. Artificial Intelligence (AI) & Machine Learning (ML) Restrictions

Under no circumstances is Google user data (including raw, aggregated, or derived data received from Google Workspace APIs) used, transferred, or disclosed to develop, train, fine-tune, or improve generalized or foundational artificial intelligence (AI) or machine learning (ML) models. All AI evaluation features on Recrugate operate in complete isolation from Google Workspace data.

4. Affirmative Limited Use Compliance Statement

"Recrugate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

Section D: Slack Integration & Workspace Data Policy

Recrugate offers an optional integration with Slackto deliver real-time recruitment notifications, candidate interview alerts, and calendar status updates directly to your organization's authorized Slack channels.

1. Data Accessed & Requested Scopes

When an authorized recruiter or administrator connects Recrugate to their Slack workspace via OAuth 2.0 or incoming webhook, Recrugate accesses the following minimum required data:

• Workspace & Channel Identifiers: Team ID, workspace name, and public/private channel names and IDs (channels:read, groups:read) solely to allow recruiters to choose where notification cards are posted.
• Message Posting Permissions: Permission to post structured notification messages and cards (chat:write, chat:write.public, incoming-webhook).
• Access Tokens: Encrypted OAuth Bot access tokens used exclusively to authenticate API calls on behalf of your workspace.

2. Purpose of Processing

Slack integration data is used strictly to:

• Send interview scheduled, rescheduled, and cancellation alerts with join links to designated recruiting channels.
• Send candidate application updates and evaluation summaries configured by the employer.

3. Data Sharing, Sale & AI Training Restrictions

• No Data Sale or Third-Party Transfer: We do not sell, rent, monetize, or transfer Slack workspace data or channel communications to any third parties, data brokers, or advertisers.
• No AI Model Training on Slack Data: Under no circumstances are messages, metadata, or workspace information received from Slack used to train, develop, fine-tune, or improve artificial intelligence (AI) or machine learning (ML) models.
• No Message Reading: Recrugate does not read, index, or store incoming user messages from your Slack channels. The integration operates solely as an outbound notification dispatcher.

4. Disconnection & Data Deletion

Recruiters can disconnect the Slack integration at any time directly via Settings > External Integrations > Disconnect. Upon disconnection, stored Slack OAuth tokens and webhook configurations are immediately and permanently revoked and deleted from our active databases.

5. International Data Transfers

As an international platform, your personal data may be stored or processed in servers located outside your country of residence (including EU and US data centers). Where cross-border transfers occur, we implement European Commission-approved Standard Contractual Clauses (SCCs) and statutory transfer safeguards under KVKK Art. 9 to guarantee data protection.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, provide user accounts, comply with legal/statutory requirements, or resolve disputes. Upon account deletion, candidate profile data is permanently purged or anonymized in accordance with retention schedules.

7. Support, Data Protection Officer (DPO) & Contact Information

If you have technical questions, require assistance with your integrations, or wish to exercise any of your data protection rights under GDPR or KVKK, please contact our team:

• Product & Integration Support: help@recrugate.com (Typical response within 24–48 business hours)
• Privacy & Data Protection: privacy@recrugate.com / dpo@recrugate.com
• Website: www.recrugate.com

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect regulatory changes or service enhancements. Any modifications will be effective upon posting the revised policy with an updated "Last Updated" date.