Which data is processed in Eşik, Başlangıç and Norm Check-up sessions, why, and for how long.
Last updated: September 2026
1. Controller and processor
—The controller is the employer who invited you (named in the invitation email).
—NormSignal processes data on the employer's behalf and instructions. Contact: privacy@normsignal.com
2. Data processed
—Details entered by the employer: full name, email and, if given, role and team.
—Your choices in the session (the option and strength you chose in each dilemma; in team rounds only, your guess of what most of this team would choose), time spent on each question, and any note you choose to add to your report.
—Invitation, opening, consent and completion times.
—Not processed: camera, voice, facial expression, CV, social media, location. Session pages use no analytics or advertising cookies.
3. Purpose
—Eşik: structuring the final-stage interview and, if you're hired, preparing your start.
—Başlangıç: helping you and your manager get to know each other faster when you start.
—Norm Check-up / team calibration: seeing the team's decision habits only in aggregate, and building the team comparison in hiring reports.
4. Legal basis
—Eşik (candidate): your explicit consent (KVKK art. 5/1). You consent separately before starting; without it the session doesn't start, and this doesn't affect your application.
—Başlangıç: after you're hired, your separate consent is asked before a note is created from your candidate session. New hires invited directly are informed before the session.
—Norm Check-up (employee): the employer's legitimate interest (KVKK art. 5/2-f). Participation is voluntary; results are used only as an aggregate of at least 5 people.
5. Who sees what
—You: you see your own report as soon as you finish.
—Eşik: the employer's people involved in the hiring decision.
—Başlangıç: your manager and HR, only if you consent.
—Norm Check-up: nobody sees your individual result; only the aggregate of at least 5 people is shown.
6. No automated decisions
—The report makes no decision, doesn't rank candidates and may not be the sole basis for a hiring, promotion or performance decision; this is written into the contract with the employer.
—You keep the right to object to a result based solely on automated processing (KVKK art. 11/1-g).
7. Retention
—Candidates not hired: deleted 30 days after the decision is recorded, or 90 days after the session if no decision is recorded.
—If hired: the candidate record is deleted within 30 days. If you agree to the Başlangıç note it is kept for 12 months; if you decline, your data is deleted immediately.
—Norm Check-up: individual answers are deleted when the round closes; only the team aggregate remains.
—To measure whether the service is useful, only numeric usage information is kept — without your name, email, answers or anything you wrote (whether the session was completed, its length, whether a decision was recorded, whether HR found the questions useful).
—Unused invitation links expire after 14 days.
8. Transfers
—Hosting: Google Cloud europe-west1 (Belgium). Email delivery: Resend (US). This is a cross-border transfer under KVKK art. 9; its terms are in the contract with the employer.
—Data is not shared with or sold to any other third party.
9. Your rights
—Under KVKK art. 11 you can ask whether your data is processed, request information, correction, deletion, and object.
—Send requests to the employer or to privacy@normsignal.com; requests for the employer are forwarded without delay.