Privacy Notice for candidates

Date of effect: April 21, 2023
Last updated: April 21, 2023

This Privacy Notice ("Privacy Notice" or "Notice") is designed to provide data subjects (individuals) ("You") with information on the processing of Your personal data (any information relating to them) when You interact with Toloka group of companies during the recruitment process. The recruitment process includes processing of Your job application, interview(s) and potentially conclusion of an employment contract.

This Notice is based on the provisions of data protection laws applicable in your country of residence.

This Notice is written in English and can be translated into other languages upon Your request. In case of contradictions between the English version and its translations the English version shall prevail.

1. Controller

The data controller with regard to personal data processed under this Notice is the Toloka legal entity to which You are applying for a job, namely:
Toloka d.o.o. Beograd (Starine Novaka 23, Sprat 4, Belgrade (Palilula). 11000, Belgrade, Serbia);
Toloka.Ru LLC (119021, Moscow, Lva Tolstogo street, house 16, floor 7, room 1, part of room 1);
Toloka B.V. (Gustav Mahlerlaan 300, 1082 ME Amsterdam);
Toloka Technologies LLC (part of premises XII, floor 1, 16 Lva Tolstogo str., Moscow, Russia 119021);
Toloka AI, Inc. (10 State street, Newburyport, MA 01950, United States)
(hereinafter, each data controller is referred to as "Toloka").

As a data controller, Toloka independently determines the purposes and means of the processing of your personal data.

You can contact Toloka on any questions relating to the processing of their personal data under this Notice by email at privacy@toloka.ai, or any other method approved by Toloka and available to You.

2. Purposes and legal basis for processing

2.1. Toloka processes Your personal data based on the necessity for the performance of a contract to which You are party or in order to take steps at Your request prior to entering into a contract. In particular, this is the case when a candidate applies for a position which is currently available at Toloka as part of the recruitment process, and Toloka processes his/her personal data in order to negotiate with such candidate, check his/her qualification and suitability for a position, make an employment decision and conclude an employment agreement with the successful candidate.

2.2. Toloka processes personal data based on its legitimate interest where it overrides Your interests/rights, taking into consideration Your reasonable expectations. In particular, this is the case when:

• Toloka directly contacts You in order to discuss potential employment with the use of publicly available contact information, and
• Toloka checks Your suitability for a position as part of the conflict and independence check. The legitimate interests of Toloka consist of ensuring effective management of HR relations between Toloka and You, recruitment of qualified employees who have no legal obstacles to work at Toloka and protecting Toloka's statutory rights and interests. You can get more information on the legitimate interests pursued by Toloka and relevant balancing tests by sending a request using the contact details specified in section 1 of this Notice.

2.3. Apart from the purposes mentioned above in this section 2 and where required by law, Toloka will process Your personal data based on Your valid consent to the processing of personal data. In particular, Toloka always requests a consent to place Your CV in the personnel system.

3. Categories of personal data processed by Toloka

Under this Notice, Toloka processes the following categories of personal data related to You:

• Name / surname / maiden name
• Date of birth
• Birth certificate number
• Place and country of birth
• Nationality and gender, a copy of their residence permit and work permit (if required)
• Permanent address, city, postal code/place of residence (or address for correspondence)
• ID card number/ passport number and issue authority
• Information about Data Subject's pension and other state benefits
• Details of other employment
• E-mail address
• Phone number / personal phone number
• Education
• Work experience
• Job title (job requirements)
• Information on wages
• Information on health conditions (if required to comply with employment legislation)
• Your photo image
• Preferences regarding equipment and operating system
• Information required for passing conflict and independence check procedures
• Any other details contained in Your CV or otherwise provided when applying for a job
• Other information voluntarily provided by You or required for Toloka in order to achieve purposes mentioned in section 2 of this Notice.

4. Recipients of personal data

Toloka discloses Your certain personal data to the following recipients to the extent permitted by applicable law and/or based on their legitimate and reasonable requests:

• Affiliate entities that are a part of the Toloka group of companies
• Legal, tax and other advisors providing respective services on HR-related matters, conducting audits
• Partners providing background checks services to Toloka in order to verify information provided by job candidates
• Notaries for drafting powers of attorneys and executing other legal documents
• Relocation agencies for providing relocation services
• Travel agencies, hotels, and carriers for purchasing and booking air tickets, railway tickets, hotels, transfers
• Companies providing archival services
• Companies providing technical support to Toloka
• Companies ensuring security and carrying out internal investigations
• Various state and municipal authorities if strictly required to respond to their legitimate formal inquiries
• Other third parties when it is required for compliance with applicable laws or achievement of purposes declared under this Notice.

5. Transfers to third countries

Toloka transfers Your personal data to countries where its affiliated entities and partners are located, including Russia, Switzerland, USA, Israel, Netherlands, Check Republic, Serbia, Ireland ("Third countries"). Some of these countries do not provide for a sufficient level of protection of data subjects' rights under the European Union law.

For the transfer of Your personal data to Third countries Toloka uses different tools to:

• make sure the personal data transfer complies with applicable law;
• help to give Your personal data the same level of protection as it has in the European Union;
• whether the transfer is based on an adequacy decision;
• whether the transfer is subject to appropriate safeguards (GDPR Article 46 tools) such as binding corporate rules or standard contractual clauses (SCCs);
• whether public authorities of the third country may seek access to the data with or without the data importer's knowledge either via legislation, practice, or reported precedent;
• whether public authorities of the third country may be able to access the data through the telecommunication providers or communication channels in light of legislation, legal powers, technical, financial, and human resources at their disposal and of reported precedent.

Toloka uses a variety of protections which are appropriate for each data transfer to Third countries, namely:

• Standard Contractual Clauses adopted by the European Commission; and
• technical protections, such as access control, cryptography, controls against malware, security events monitoring, management of technical vulnerabilities, network security controls, incident management, technical compliance review.

You can get more information on the mechanisms of transfers to Third countries by Toloka by sending a request to the contact details specified in section 1 of this Privacy Notice.

6. Storage periods

Toloka stores personal data for a period of 12 months or longer if required to achieve the purposes of the processing specified in section 2 of this Notice.

7. Basic rights of Data Subjects

Please see Your rights and their descriptions in this table.

To exercise Your rights, You can contact Toloka by using the contact details specified in section 1 of this Privacy Notice. Toloka may ask You to specify Your request in writing and to verify Your identity before processing the request. Toloka may also refuse to fulfil Your request on grounds set out in applicable data protection legislation.

8. Withdrawal of consent

Where processing is based on consent (or explicit consent), You have the right to withdraw consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal. To withdraw consent, You can contact Toloka by using the contact details specified in section 1 of this Privacy Notice.

9. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the supervisory authority, in particular in the member state of the European Union of Your habitual residence or, respectively, place of an alleged infringement of applicable law.

10. Necessity to provide personal data

There are no general statutory or contractual requirements for You to provide Toloka with personal data processed under this Notice. In case such requirements become applicable in the country of Your residency, Toloka will inform You about this.

11. Sources of personal data

Toloka collects personal data from the data subject directly. However, in certain cases, it also acquires personal data from publicly available registers and databases, state authorities, recruitment agencies, former employers of the data subject, or under specific legislation.

12. Changes to this Notice

Toloka may change this Notice from time to time at its sole discretion. If so, Toloka notifies You about material changes by an appropriate method.

13. Difficulty accessing this Privacy Notice

Individuals with disabilities who are unable to usefully access our Privacy Notice online may contact us at the above-listed contact information to inquire how they can obtain a copy of our notice in another, more easily readable format. Under no circumstances, we will collect or otherwise process information about your health or other sensitive data about You in connection with such request.