How do you manage the hiring process? Tracking candidates from application to offer

What are the stages of the hiring process?

Hiring starts when a position is approved and ends when the candidate starts work. In between come the posting, applications, screening, interviews and the offer. If you decide in advance what to record at each stage, you can explain every decision later.

1. Define the need. Write down the position, department, working arrangement and budget. Record: who approved it, and when.
2. Post the job. Publish the job description and requirements on the careers page and share the link on other channels. Record: posting text, publication date and closing date.
3. Receive applications. The candidate fills in the form and reads the privacy notice. Record: application source, time of acknowledging the notice and, if any, explicit consent.
4. Screen. Sort applications against minimum criteria written beforehand. Record: the reason for rejection.
5. Interview. Each interviewer scores against the same criteria and writes a note. Record: interviewer, date, score and recommendation.
6. Offer and close. Make the offer to the chosen candidate, then inform and close the others. Record: the decision and the closing reason.
7. Onboard. Transfer the details of the candidate who accepts into the employee record and start the onboarding steps.

How do you keep candidate assessment notes consistent?

Consistent assessment means scoring every candidate against the same criteria on the same scale. Write the criteria before the interview, have each interviewer score separately, and collect scores before interviewers can influence each other. When notes and scores are read together, the decision becomes defensible.

• Set three to five criteria for the position (such as technical knowledge, communication and experience) and define each in one sentence.
• Use one short scale; a 1–5 scale reduces differences in interpretation between interviewers.
• Write observations, not impressions: “described an example project” is an observation, “seems likeable” is not.
• Do not ask about or note topics unrelated to the job, such as marital status, age or health.

What does KVKK say about candidate data?

A job candidate is also a data subject under KVKK (Türkiye's Personal Data Protection Law No. 6698). The employer informs the candidate at the time of application under Article 10, and once the reason for processing ends, deletes, destroys or anonymises an unsuccessful candidate's data under Article 7.

The privacy notice states at least: the data controller's identity, the purpose of processing, to whom and why the data may be transferred, the collection method and legal basis, and the candidate's rights under the law. The Personal Data Protection Authority stresses that the duty to inform also applies to processing not based on explicit consent (KVKK: Duty to inform).

The law sets no number of days for unsuccessful applications. Your business sets the period and writes it into its retention and destruction policy; for employers obliged to register, the regulation on deletion and destruction states that the periodic destruction interval cannot exceed six months. Text of the law: Law No. 6698; for the difference between deletion, destruction and anonymisation, see the Authority's explanation (in Turkish).

Where does hiring with email and Excel break down?

When hiring runs on email and spreadsheets, information stays with individuals. The same candidate arrives through two channels and is assessed by two people, an interview note disappears inside a thread, and unsuccessful candidates' CVs sit in inboxes for years.

• CVs land in several people's inboxes; nobody knows who got back to which candidate.
• The candidate's stage is updated by hand in a spreadsheet; the sheet falls behind and two people tell the candidate different things.
• Interviewers see each other's notes and score accordingly; independent assessment is lost.
• There is no deletion date for unsuccessful candidates, and CVs also remain in downloaded copies.
• The hired candidate's details are retyped into the employee list, and a typo travels all the way to payroll.

How does the hiring process work in Sora İK?

In Sora İK, job postings appear on the company's careers page, applications gather on each posting's candidate board, and candidates move from the New stage through Screening, Interview and Offer to Hired. Once a candidate is hired, their employee card is created from the candidate record, so nobody retypes the details.

• Careers page: postings listed in Turkish and English under a web address that uses the company's short name; posting pages include JobPosting structured data.
• Application form: the CV is collected as a link, not a file; the candidate acknowledges the privacy notice and, where defined, ticks a separate, optional consent box. Cloudflare Turnstile protects the form against automated submissions.
• Duplicate applications: if one email address applies twice for one posting, the second attempt is refused.
• Assessment: notes are kept with date and author; each assessor enters one 1–5 score, a recommendation and a comment, and the average shows on the board.
• Retention: you enter the period in months; closed candidates past that period are listed, and HR deletes the record together with its notes.

Candidates from other channels are added to the board one at a time; there is no bulk import, and postings are not pushed to job boards automatically. An “application received” email to the candidate, a drag-and-drop board, company-specific stages and CV file upload are on the roadmap; interview scheduling, offer letters and AI-assisted CV screening are also on the roadmap as separate modules. Plans are based on the number of active employees, and candidates do not count towards it (Sora İK pricing). Details: Applicant Tracking & Careers Page — full feature list.

What should IT and management watch for with candidate data?

Candidate data belongs to people the company has no employment relationship with yet, and it is often the most scattered personal data a company holds. Getting CVs out of email, narrowing access to candidate records and protecting the public application form are the three basic safeguards.

• Do not forward CVs by email; give interviewers access to the record instead of sending them a file.
• It should be possible to trace who opened a candidate record; in Sora İK, the audit log notes each time someone opens a candidate card.
• Keep default access narrow; in Sora İK, the company owner and HR see candidate data, and team managers get access through a custom role.
• A public form attracts bots and spam applications; do not publish one without verification and rate limiting.
• For a manually added candidate, the system holds no acknowledgement of the privacy notice; inform these candidates separately.

The general framework of permission design is in the HR software security guide, and the legal side of candidate and employee data in the KVKK in HR guide.

Modules that work with recruitment

Hiring does not end when the candidate accepts the offer; onboarding, performance and permission rules continue the same record. The guides below cover the next steps of the process.

• Onboarding and offboarding checklist: Paperwork, SGK notification, account and equipment steps for joiners and leavers, with owners and timing.
• 360-degree performance review guide: Review cycles built on KPI and competency criteria: form design, choosing raters and using the results.
• HR software security guide: A vendor-neutral IT checklist for role-based access, two-step verification and audit logs.
• KVKK in HR guide: KVKK compliance for employee and candidate data: privacy notices, legal bases, retention, destruction and access.

Frequently asked questions

What is an applicant tracking system, and who uses it?

An applicant tracking system (ATS) is software that keeps job postings, applications, candidate stages and assessment notes in one record. The HR specialist moves candidates through stages, interviewers enter notes and scores, and managers follow the status of each posting. Even a company that hires only a few people a year uses one to get CVs out of email inboxes.

How long can you keep data from unsuccessful job applications?

The law sets no number of days. Once the reason for processing ends, the data is deleted, destroyed or anonymised; as data controller, you set the period and write it into your retention and destruction policy. If you want to consider a candidate for another position later, say so clearly in the privacy notice and agree the period with your legal adviser.

Can you use an ATS without a careers page?

Yes; an ATS earns its value less from where applications come from than from tracking everything afterwards in one place. Without a careers page, though, every application is entered by hand and the candidate's acknowledgement of the privacy notice is not recorded in the system. In Sora İK, candidates from other channels are added to the board one by one, so you must inform them separately.

Does Sora İK include interview scheduling?

Today the interview is a stage on the candidate board: you move the candidate to the Interview stage and, after the meeting, enter your note, 1–5 score and recommendation on the candidate card. Calendar-based interview scheduling and scorecards are on the roadmap as a separate module; until then, you arrange interview times in your own calendar.

Who should be able to see candidate assessment notes?

As a general rule, only the people involved in the hiring decision should see notes; other department heads or the system administrator do not need access. In Sora İK, candidate records are visible by default to the company owner and HR roles; the author of each note shows on the card, and every opening of the card is written to the audit log.