20191221 WING HR Application Privacy Policy

WING HR Application Privacy Policy

IKARUS INSAN KAYNAKLARI VE YAZILIM HIZMETLERI, INC PRIVACY POLICY

Effective Date: September 4, 2019

This Privacy Policy (“Policy”) describes how IKARUS Insan Kaynaklari ve Yazilim Hizmetleri, Inc. (“Ikarus” or “we” or “our”) treats information collected or provided in connection with an end user’s (“you” or “user”) visit to or use of the website located at https://www.ikarushr.com and https://www.talent.ikarushr.com/ Ikarus’s products (Mobile application: Wing HR) and services (the “Services“). Please note that your use of the Site constitutes your acceptance of and consent to this Policy. When you sign up to use the Services, you also consent to receive electronic notices and disclosures, as set forth in Section 5 below.

Ikarus reserves the right to change this Policy at any time. Please check this page periodically for changes. Your continued use of the Services following the posting of changes to this Policy will mean you accept those changes.

This Policy seeks to answer questions you may have about the Services and Ikarus’s information practices. Please contact us if you have other questions.

What information does Ikarus collect through the Services?
How does Ikarus use the collected information?
When does Ikarus share information about you?
How can you access, change, or delete information about you?
Will you receive notices and disclosures electronically?
Does this Policy apply to third parties?
What choices do you have about online tracking, analytics and email communications from Ikarus?
How does Ikarus protect your information?
Where is your information processed or stored?
Who can use the Services?
How can you contact Ikarus with more questions? See also: Additional Information for Europian Users

1. What information does Ikarus collect through the Services? Information Provided Directly To Us

We may collect information you provide directly through the Services. For example, we may collect your name surname, email address, or other contact information when you access certain Ikarus content available through the Services such as whitepapers, videos, webinars, and other materials, or request additional information about Ikarus or the Services. Ikarus also collects information from you when you fill out any form in the Services such as when you submit surveys, questions or comments.

We bring together our applicants who seek job, follow our career platform with the aim of improving themselves, and applicants that we reach through reference and / or direct sales, and employers looking for competent candidates to work in their institutions on the same platform. We aim to bring together the right candidate with the right employer members and reach the talent in employment faster with resume scoring and verifications via Machine learning algorithms with the help of over 30 evaluation criteria (resume scoring data includes the survey results and CV data filled out by our users via the link (https://www.talent.ikarushr.com/) or reached via mobile application and / or reference and / or direct sales). As a company, we are able to process your personal data from time to time in order to achieve these goals and to provide better service to all our members through some research and marketing activities.

If you share your resume with us or by entering data on the platform, or if necessary, your personal data may be processed by us as follows:

Identity Data	Your name, surname, Your identity number, date and place of birth, gender, marital status, nationality
Contact Data	Your e-mail address, address, province / district, home – work and / or mobile phone number
Personally Qualified Data	Information about membership of associations, foundations, trade unions, political parties, religious or philosophical opinion, ethnic origin and race or information about your race, information about your health or your personal data.

Education Data	Educational status, certificate and diploma information, specialist knowledge, foreign language knowledge, training and skills, seminars and courses you have attended, computer knowledge
Work Experience Data	Total experience, working status, title, work experience (company names, periods, projects, job description)
Competences	Personal and / or technical competencies, projects, IT and / or all other professional information
Visual Data	Photo of real person
Website / Application Usage Data	Date of membership, frequency / times to login to the site / application, user of ios / android / mobile site / website, CV update date, registered criteria for job search module, Interview questions review and simulation participation scores for the data subject to scoring (CV Upload, Enneagram detailed report, CV score, number of views of the resume viewed by employers, interview simulation scores, application usage frequency scores…), last login date, first membership date, application deleted (yes / no), the modules used / logged in the application, the most searched and / or used modules, the usage information of the applications (each movement and selection made within the application)
Other	Driver’s license data, competencies, hobbyist, salary expectation, military status, reference information (name of the reference person, title, workplace, phone, e-mail) and CV, if any, all kinds of words, excel, presentation files, Profile ID, Login ID, IP address, log records, additional information that Client Employer may request from candidates

Please note that, Ikarus gathers data from your CV Uploads (pdf/word), survey answers and your app usage rates. So we highly recommend we recommend that you do not include any information that you do not want to be processed except for the mandatory data for the resume/answers.

Your data will be stored in our systems for five (5) years from the last date you access your system with your user name and password in accordance with the legal legislation we are bound to perform due to our employment mediation activities.

Disability status information, which is not asked to you during uploading resumes to our systems, is personal data due to being health data. Since your resume will be uploaded to your platform in PDF and / or Word format with your own will,

we recommend that you do not include any information that you do not want to be processed except for the mandatory data for the resume.

As mentioned; We process your CV by recording your personal data in the questionnaire and resume you filled in. In this context, we recommend that you do not enter your personal information in the manually populated fields unless you choose to not give usage permission.

Customers

If you want to use the Services to screen applicants (“Customers”), Ikarus may collect the following information (collectively, the “Customer Information”), including, but not limited to:

Account creation information, including your name surname, email address, and a custom password;

Contact information such as address and phone number; Corporate and license information;

Hiring practice information such as employee work location and salary necessary for the application of state and federal consumer reporting laws

If you are an employer, employer identification number; and Payment information, including credit card and/or bank account information and billing address.

Please note: We do not store the credit card or bank account numbers you may use to make payments in the Services. Such information is passed on to our third- party payment processor, iyzico. You can review information on Stripe’s privacy practices at https://www.iyzico.com/destek/yardim-merkezi

Applicants

If you are an applicant who will be the subject of a screening or background check (“Applicants”), Ikarus may collect the following information (collectively, the “CV Check Information”), including, but not limited to:

Account creation information, including your full name, e-mail address, survey, and custom password;

Contact information, including phone number and address;

Identity verification information, including Social Security Number (or Social Insurance Number), date of birth, current title, last graduated degree; and Additional information or supporting documentation you submit or upload regarding identity, background, evidence of rehabilitation, or a dispute.

Examples include an uploaded picture, a driver’s license, or court records.

Automatically Collected Information

When you visit or use the Services, we automatically gather certain technical and usage information, which may be associated with your user account. This technical and usage information (“Technical Information”) includes usage information, such as information on when, how often and for how long you use the Services; and server log data such as a computer’s IP address, browser type, device type, operating system and version, or the webpage you were visiting before you came to the Services.

Technical Information also includes “Cookies,” which are small text files containing a string of alphanumeric characters that are downloaded by your web browser when you visit a website. Like many online services, we may use both session cookies and persistent cookies when you access and use the Services. Cookies are used to remember your user account information and your preferences, to customize the Services for you and to assist us in measuring and analyzing utilization of the Services.

Third-party web analytics services providers we engage, such as Google Analytics, may use cookies in order to provide analytics services for the Services to us. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to the Services. Persistent cookies can be removed. Please review your web browser’s documentation to learn the best way to modify your cookie settings and see Section 7 below.

2. How does Ikarus use the collected information?

Ikarus uses the information it maintains about you (including information you provide, Customer Information, Background Check Information, and Technical Information):

For the purposes for which you provided it;

To create your account and enable you to use the Services; To verify your identity;

To provide the features and functionality of the Services; For customer support and to respond to your inquiries; To respond to and fulfill your requests;

With your consent, to contact you by text message regarding your account and certain services or information you have requested;

To improve the Services;

For internal record-keeping purposes and for legal purposes;

To address fraud or safety concerns, or to investigate complaints or suspected fraud or wrongdoing; and

To resolve disputes, to protect ourselves and other users, and to enforce any legal terms that govern your use of the Services.

Ikarus uses the contact information that you provide to access Ikarus content available in the Services (such as whitepapers) or to obtain more information about Ikarus or its Services to provide such content and information. Ikarus may also use this information to provide you with additional information regarding products and services from Ikarus or our business partners that may be of interest to you. Ikarus does not use CV Check Information for this purpose. If you do not wish to receive such communications, please see Section 7 below.

Ikarus uses CV Check Information as reasonably necessary to: verify applicant identity;

scoring the competencies and technical background called as “Competency Score”;

conduct background checks; investigate disputes;

enable Customers to reach applicants; or

provide certain communications, including adverse action notices. We may use Customer Information to:

contact you regarding your use of the Services;

process billing and payment;

send you product announcements and special promotions from Ikarus or our business partners, or to administer participation in special events, surveys, contests and sweepstakes; or

send you communications regarding updates or modifications to the Services. We may use Customer Information and Technical Information to:

personalize the content that you and others see based on personal characteristics or preferences;

troubleshoot problems;

provide you with required notices, in connection with disputes between you and another user; or

alert you to changes in our policies or agreements that may affect your use of the Services.

Ikarus may also use Technical Information to analyze your use of the Services to help us improve the Services and develop and improve other products and services.

3. When does Ikarus share information about you?

We may share the information we collect from and maintain about you as follows:

Employers or Other Customers Requesting Background Reports. We provide Applicant reports, short / long lists, which may include CV Check Information (include your Competency Score), about Applicants to the requesting employer or Customer. We may also provide an employer or Customer other communications related to background reports such as notification of a dispute. Furnishers and Researchers. We provide CV Check Information to entities that research and furnish data contained in all reports, short / long lists.

Your personal data mentioned above is processed for the Service we provide to you for the following purposes:

To accelerate the recruitment of our employer members to the right talents

and employment processes

To support your entire recruitment process and to share with you important

data on your career path

To prepare you for work and meet with employers, to make exact matches between you and customers/employers with CV Check information (score, ranking and parsing)
To ensure that your resume is visible to all employers and to search for

qualified candidates

To meet your e-mail / in-app comments and support needs
If there is a complaint about the Services we provide, finalize the
In accordance with your request and / or social media complaints, by our top authorities (Turkey Republic and / or local law that governs our members who use our service / law pursuant to the entire organization) if the complaints Wing platform, and / or (https: // talent.ikarushr.com/) review your data and your account through website
Budget management and reporting

Service Providers. We may provide access to your information to select third parties who perform services on our behalf. These third parties provide a variety of services to us, including without limitation conducting components of CV checks, parsing, ranking, scoring, billing, fulfillment, data storage, analysis and processing, identity verification, fraud, accounting, auditing, and legal services. Affiliates. We may share information with our affiliates for use as described in this Policy.

Legal Requirements. We will use and disclose information where we, in good faith, believe that the law or legal process (such as a court order, search warrant or subpoena) requires us to do so or in other circumstances where we believe is necessary to protect the rights or property of Ikarus, our users, or third parties. De-identified information. We may share de-identified information with third parties, including without limitation: (1) sharing aggregated, de-identified information about our user base and its interests and usage patterns and (2) providing de-identified information to third-party partners for our business

arrangements, including without limitation to jointly offer a product or service to you or create interoperability between our products and services and theirs. Consent. We may disclose your information to nonaffiliated third parties based on your consent to do so.

Business Transfer. In the event of a merger, sale of capital stock or assets, reorganization, consolidation or similar transaction involving Ikarus, or in contemplation of such a transaction (e.g., due diligence), the information we possess may be transferred as a corporate asset to the acquiring entity.

Analytics. We use Google Analytics, for purposes of analyzing usage of the Services. You can find more information about Google privacy practices here.

Note that Ikarus will not provide your personally identifiable information to third parties for their own marketing purposes without your consent.

Also note that your disability status information, which is not asked to you during uploading resumes to our systems, is your personal data due to being health data, so we recommend that you do not enter your personal information in your CV uploads. Since your resume will be uploaded to your platform in PDF and / or Word format with your own will, we recommend that you do not include any information that you do not want to be processed except for the mandatory data for the resume.

4. How can you access, change or delete information about you?

Applicants should promptly update their contact information if it changes or is inaccurate. Applicants may review, access, and change certain account information such as email address, phone number and mailing address via the Wing mobile application on the Services. Requests to change certain other information may require verification before the change is accepted. Applicants can request deletion of certain information in Ikarus’s control by contacting Ikarus as set forth at the end of this Policy.

Once a Customer, such as an employer, has received a CV check report, Ikarus

does not control the Customer’s retention of such information.

Our policy is to retain personally identifiable information only as long as reasonably necessary to provide the Services or as otherwise required for legal compliance purposes. For example, we may retain information, including from closed accounts, in order to comply with the law, prevent fraud, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations of any user, enforce our Terms of Use, and/or for any other purposes otherwise permitted by law that we deem necessary in our sole discretion.

5. Will you receive notices and disclosures electronically?

Yes. The Services are offered through Ikarus’s website, mobile site, and app. To obtain Services from us, you must login an online account to Web Portal and you must login to app with your Google or Facebook account and (1) be able to access Services on a computer or other device that is capable of accessing the Internet, (2) have an active email account, and (3) consent to our use of our website, app, or email to provide you any written information that we may be required to send you in connection with the Services, your account, and/or background checks and reports.

Your Consent to Electronic Disclosures

By creating an account and/or authorizing a CV check, you acknowledge and agree:

you can access and read information we post on our website or mobile app;

to provide an email address that is active and effective for receiving emails from us;

to receive electronically on our website, app, or via email the notices and disclosures, required by law related to your account and the Services; and

you have received the following disclosures as required by the federal Electronic Signatures in Global and National Commerce Act (“ESIGN”).

Please read this Federal ESIGN disclosure and consent carefully and keep a copy for your records. Your consent is voluntary, but we cannot provide the Services to you if you do not consent. If you are unwilling to receive these disclosures and notices electronically, you may terminate the creation of your account by closing your browser at any time before you create an account and/or authorize a CV check.

Scope of Communications to Be Provided in Electronic Form

Your consent to receive electronic communications and transactions includes, but is not limited to, all legal and regulatory notices or disclosures and communications associated with your account, the Services, your request for a CV check, and any product or service we agree to provide you (each, a “Communication”).

Method of Providing Communications to You in Electronic Form

All Communications that we provide to you in electronic form will be provided either (1) via email, telephone or text, (2) by making it available online and accessible via your account portal, or (3) by requesting you download a PDF file containing the Communication.

How to Withdraw Consent

You may at any time withdraw your consent to receive Communications in electronic form. To begin receiving Communications in paper form, please contact us at the following address: Hasanpasa Mh. Nabizade Sk. No:82/1 Kadikoy / Istanbul / Turkey. Please specify the information you wish to receive in paper form. Be sure to state that you are requesting a copy of the disclosures, notices, etc., and include your name and mailing address. Your request will apply only to those specific items you designate. We will not impose any fee to process the withdrawal of your consent to receive electronic Communications. Any withdrawal of your consent to receive electronic Communications will be effective only after we have a reasonable period of time to process your withdrawal.

How to Update Your Records

It is your responsibility to provide us with true, accurate and complete email address, contact, and other information related to your account, and to maintain and update promptly any changes in this information. You can update information through your web portal / app. If you give us an incorrect email address or fail to update or correct your email address, an electronic Communication will be deemed provided to you if we use the email address in our records for the electronic Communication.

Required Equipment

In order to use the Services and to view and retain a copy of this Policy and certain Communications, you understand that you must have a computer or device equipped with at least: a browser with 128-bit encryption, a current version of a software that can open and display PDF files (e.g., Adobe), and either a printer or other electronic storage device.

Retaining Copies of the Communications

To retain a copy of any Communication we provide electronically, you can download an electronic copy to your computer or a storage device (such as a disk or USB storage device), request a copy by email, or print copies on a printer attached to your computer. You will not be charged for a downloaded or emailed copy.

6. Does this Policy apply to third parties?

No. The Services may contain links to third-party websites, but this Policy does not apply to information that you may provide to or that may be collected by such third parties. We encourage you to review such third parties’ privacy policies and terms and conditions before engaging with such third parties.

7. What are your choices regarding online tracking, analytics and certain email communications from Ikarus?

Online Tracking and Cookies. Like many websites, the Services do not currently respond to “do not track” browser headers. But you can take steps to limit tracking by erasing cookies from your computer’s hard drive and by setting your browser to block all cookies or warn you before a cookie is stored. If you disable

cookies, you may be prevented from taking full advantage of the Services because they may not function properly without cookies.

Analytics. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on by clicking here. Promotional Emails. As discussed in this Policy, subject to any restrictions under applicable laws, we may send periodic promotional or informational emails to you. You may opt-out of such communications by clicking unsubscribe in the email. Please note that it may take up to 10 business days for us to process opt- out requests. If you opt out of receiving emails about recommendations or other information we think may interest you, we may still send you emails about your account or any services you have requested or received from us. You can re- enroll by emailing us at wing@ikarushr.com.

8. How does Ikarus protect your information?

Ikarus maintains safeguards to help protect the security of information we maintain about you. We may use encryption, passwords, and physical security measures to help protect your information against unauthorized access and disclosure. However, no security measures are 100% effective and we cannot guarantee your information will not be collected, disclosed and/or used by others. You should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, keeping your log-in and password private, and not recycling passwords from other websites or accounts. Ikarus is not responsible for the unauthorized use of your information nor for any lost, stolen, or compromised passwords, or for any activity on your account via unauthorized password activity. WE EXPRESSLY DISCLAIM ANY REPRESENTATION OR WARRANTY, WHETHER EXPRESS OR IMPLIED, WITH RESPECT TO ENSURING, GUARANTEEING, OR OTHERWISE OFFERING ANY DEFINITIVE PROMISE OF SECURITY IN CONNECTION WITH YOUR INFORMATION OR TECHNICAL INFORMATION.

9. Where is your information processed or stored?

Ikarus uses servers located in Turkey. Ikarus may also use partners or affiliates located in other countries besides Turkey to store and process your information. By using the Services, you consent to the transfer of information outside of your country, even if your country has more rigorous data protection standards.

10. Who can use the Services?

You must be 16 years of age or older to use the Services. If you are a parent or guardian and believe that your child under the age of 13 has provided personally identifiable information to us through the Services, please contact us at the contact information listed below. If we discover that an individual under 13 has provided us with personal information, we will take steps to delete the account and any such personally identifiable information to the extent required by applicable law.

11. How can I contact you with more questions?

If you have any questions, concerns or complaints about this Policy or Ikarus’s handling of your personal information, or if you would like to access or update personal information that is not available via the applicant portal, please contact us at wing@ikarushr.com or at:

Ikarus, Inc.

Attn: Privacy Questions

Hasanpaşa Mh. Nabizade Sk. No:82/1 Kadikoy / Istanbul / Turkey

Additional Information for European Users

European Union data protection laws make a distinction between organizations that process personal data for their own purposes (known as “data controllers”) and organizations that process personal data on behalf of other organizations (known as “data processors”)

Under applicable law, Ikarus is considered the “data controller” of the personal data we handle under this Privacy Policy. We retain the personal data for as long as necessary to provide the Services, or for other important purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements.

Our legal grounds for using personal data are as follows:

Contractual Commitments: We may use, share, or disclose information to honor our contractual commitments to you. For example, to comply with our Terms, which you by using our Service.

With Your Consent: Where required by law, and in some other cases, we use, share, or disclose information on the basis of your consent.

Legitimate Interests: In many cases, we use, share, or disclose information on the ground that it furthers our legitimate business interests in ways that are not overridden by the interests or fundamental rights and freedoms of the affected individuals, such as customer service, analyzing and improving our business, providing security for our Services, preventing fraud, and managing legal issues. Legal Compliance: We need to use, share, and disclose information in certain ways to comply with our legal obligations.

Your Legal Rights Under Local Law:

Your local laws (e.g., laws of the E.U.) may permit you to request that we: provide access to and/or a copy of certain information we hold about you; prevent the processing of your information for direct-marketing purposes; (including any direct marketing processing based on profiling)

update information which is out of date or incorrect; delete certain information that we are holding about you;

restrict the way that we process and disclose certain of your information; transfer your information to a third party provider of services; and revoke your consent for the processing of your information.

Please note, however, that certain information may be exempt from such requests in some circumstances, which may include needing to continue processing your information for our legitimate interests or to comply with a legal obligation. We may request you provide us with information necessary to confirm your identity before responding to your request.

To exercise any of these rights, you may review the information provided in Sections 4, 5, and 7, or contact us as described in the “How can I contact you with more questions?” section above. In addition to those rights, you have the

right to lodge a complaint with the relevant supervisory authority. However, we encourage you to contact us first, and we will do our very best to resolve your concern.

As described above, Ikarus uses servers located in Turkey. Ikarus may also use partners or affiliates located in other countries besides Turkey to store and process your information. By providing us with your information, you acknowledge any such transfer, storage or use. If we provide any information about you to any such non-EU third party information processors, we will take appropriate measures to ensure such companies protect your information adequately in accordance with this Privacy Policy and applicable law.