HR Module Data Processing Addendum

Human Resources Module Data Processing Addendum

Version: 2026-10 · Effective: the date the company owner accepts it in the panel

This addendum applies to Cvisioner's Human Resources module. The module covers onboarding, employee records, leave, documents, the monthly package and the "Şirketim" area used by employees. The addendum forms an integral part of the Cvisioner Terms of Use. For HR data, it prevails if it conflicts with the Terms of Use.

1. Parties and roles

• Company: the employer that enables the HR module. It is the data controller for employee data.
• Cvisioner: Çelik Yazılım ve Ticaret Limited Şirketi. MERSİS: 0240153782200001 · Email: support@cvisioner.com Address: Kızılırmak Mah. Dumlupınar Bulvarı Next Level No:3 A Kat:4 D.No:11 PK:06520 Çankaya, Ankara, Türkiye It processes data on behalf of the Company and on its instructions, as data processor (KVKK art. 3).
• Recruitment data on the candidate side is not covered by this addendum. The Terms of Use and the Privacy Notice govern that data.

2. Data and data subjects

• Data subjects: the Company's employees, hires who have not yet started, and former employees.
• Data categories:
  • Identity and contact: name, email; Turkish ID number and date of birth (only if entered).
  • Employment: title, unit, manager, start and end dates, probation, employment type.
  • Financial: IBAN (only if entered). Salary is not stored. If a payslip file is uploaded, its content is not read.
  • Leave records; documents (contract, diploma, social security and occupational safety records, etc.); goals and the 90-day plan.
  • Skills declared on the job card. The job card is shared with the Organisation module (section 10).
• Special-category data (medical reports, sick notes, criminal record) is processed only when both conditions hold: the Company or the employee has uploaded it (for example, a sick note the employee attaches to a leave request), and the task is one where the law requires that data. Only authorised HR users and the person concerned can see these documents.
• 1:1 notes are visible only to the two participants of the meeting. No one else can see them, including the Company's HR users.
• Pulse survey answers are not stored linked to the person. Only totals of at least 3 answers are shown.

3. Purpose and instructions

• Cvisioner processes the data only to provide the HR module. It does so following the Company's settings and actions in the panel, which constitute the Company's instructions.
• It does not use the data for its own purposes. There is no marketing, sale, AI model training or candidate matching use.
• An employee's Cvisioner candidate account is kept separate. The Company cannot see what the employee does in their candidate account, including applications to other companies and job searches. While employed by the Company, the employee is not visible to it in the candidate pool.

4. Company obligations

• Informing employees. The notice must also cover processing by Cvisioner and its sub-processors, and transfers abroad. An editable template is provided in the panel; the Company is responsible for its content.
• Legal basis. Relying on a valid legal basis for each item of data, and uploading special-category data only where the law requires it.
• Data and access responsibility. The Company is responsible for:
  • the accuracy of the data it enters
  • who it grants panel access to
  • setting retention periods
• Requests. Responding to employees' requests under KVKK art. 11. Cvisioner assists with this (section 8).

5. Cvisioner security measures

• Encryption: Turkish ID number, date of birth, IBAN, address and emergency contact are encrypted at field level. They are shown masked, and every reveal of the full value is written to the access log.

• Access limits: Access is restricted by role and at row level. An employee sees only their own record. A manager sees only the work information of their direct reports.

• Internal directory: If the directory in Şirketim is enabled, employees can see the following about each other:

  • name, title, unit, manager and profile photo
  • skills, if the person has allowed it

  The Company can switch the directory off per person.

• Documents: Documents are kept in private storage and opened only through short-lived signed links. Every view, download, upload, export and deletion is written to the access log. Employees can see the access history of their own record.

• AI: AI features (marked ✦) never receive names, contact details, ID numbers or special-category data. They receive only work information such as role, skills and goals. Generated text is not shown to an employee until an authorised person approves it.

• Measurement tools: No marketing or advertising measurement tools run on HR pages or in Şirketim (for example, the Meta pixel or Google Analytics).

• Special-category measures: The adequate measures in Board decision 2018/10 (31 Jan 2018) apply.

• Staff confidentiality: Cvisioner staff are bound by confidentiality. They access data only as needed for service and support.

6. Sub-processors

Cvisioner works with the following providers for HR data:

• The Company is notified in the panel and by email at least 30 days before a new sub-processor is added.
• If the Company objects, it may disable the HR module and export its data (section 10).

7. Transfers abroad

Some sub-processors are outside Türkiye.

• For these transfers, Cvisioner signs standard contracts under KVKK art. 9 and the related regulation.
• Cvisioner notifies the Board of these contracts within the period set by law.
• The Company informs its employees about these transfers (section 4).

8. Requests and assistance

• Cvisioner forwards any request it receives directly from an employee to the Company without undue delay.
• The panel provides tools to view, correct, export and delete a person's data. The deletion tool is available for people whose offboarding is complete.
• Cvisioner provides reasonable information and support for the Company's KVKK obligations.

9. Personal data breaches

Cvisioner notifies the Company within 24 hours of becoming aware of a breach affecting HR data. The notice covers the following, as far as they are known at that time:

• the nature of the breach
• the categories of data and people affected
• the likely consequences
• the measures taken

This allows the Company to notify the Board within 72 hours (Board decision 2019/10, 24 Jan 2019).

10. Retention, termination and deletion

• Data is kept while the HR module is enabled.
• For former employees, the panel suggests a default retention period of 10 years. When it expires, HR receives a deletion list. Nothing is deleted automatically; the Company decides.
• Disabling the module and end of service:
  • The Company can disable the HR module in the panel. Once it is disabled, no new records can be created.
  • If the HR module is disabled or the service ends, the Company can export its data within 30 days. If the module is re-enabled within that period, the data is kept.
  • After that period, Cvisioner deletes or anonymises the HR data within 90 days at the latest.
  • The data leaves backups through the backup cycle within 30 days at the latest.
• Organisation data: Unit and job card (skills) data belongs to the Organisation module and is independent of the HR module. It is not deleted when the HR module is disabled. While the Organisation module is used, it remains governed by the Terms of Use and the Corporate Data Processing Addendum.
• Cvisioner's own statutory retention obligations (such as invoicing records) are unaffected.

11. Information and audit

• Once a year, with reasonable prior notice, the Company may request written information about the security measures.
• On-site audits take place only by agreement between the parties, at the requesting party's expense.

12. Effect and changes

• This addendum takes effect when the company owner accepts it in the panel while enabling the HR module. The acceptance date and version tag are recorded.
• Changes are published as a new version and require acceptance again in the panel. The Company has 30 days from publication to accept.
• If the new version is not accepted within that period, no new HR records can be created. Existing data can still be read and exported.