in the SoBes recruitment automation system

Personal data operator:

Limited Liability Partnership "SoBes" (BIN 220740015088)

Address: Republic of Kazakhstan, Almaty, Almalinsky District, 78B Baitursynov Street, Building 58, 050022

This Policy defines the procedure for collecting, storing, using, transferring, and protecting the personal data of candidates undergoing selection and/or online interviews using the SoBes system.

1. General provisions

1.1. The Company processes candidates' personal data in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and other applicable regulatory legal acts of the Republic of Kazakhstan.

1.2. The policy applies to data obtained: (a) when uploading/transferring a resume; (b) when filling out a questionnaire; (c) when undergoing automated screening; (d) when conducting an online interview (including audio/video, if recording is used); (e) when using the SoBes web interface.

1.3. SoBes is a software platform that provides recruitment automation tools to employers (hereinafter referred to as "Customers"). Depending on the processing scenario, the Company may act:

as a personal data operator — when it determines the purposes and means of processing within the framework of the platform's operation;
as a person processing on behalf of the Customer — when it processes candidate data for the purposes of the Customer's recruitment.

1.4. If you are interviewed at the invitation of a specific employer, decisions on hiring and most recruitment procedures are made by the relevant Customer. The Company provides technological data processing and information protection within the platform.

2. Terms and definitions

2.1. "Personal data" means information relating to a specific or identifiable personal data subject.

2.2. "Personal data subject" means a candidate (applicant) whose personal data is being processed.

2.3. "Personal data processing" means actions aimed at collecting, recording, systematizing, accumulating, storing, modifying, supplementing, using, distributing (transferring), depersonalizing, blocking, and destroying personal data.

2.4. "Online interview" means an interview conducted remotely using the SoBes functionality, including (if available) audio and video communication, chat, test assignments, and recording.

2.5. "Technical data" means information automatically recorded when using the platform (e.g., IP address, device type, session identifiers, date and time of actions, event log data).

3. Categories of data processed

3.1. The company processes only the data necessary for the purposes of personnel selection and platform operation. In particular:

identification data: full name (if available), date of birth (if requested by the employer), city/region of residence;
contact details: phone number, email address, messengers (if specified);
resume and questionnaire data: education, work experience, skills, desired position, salary level (if specified), portfolio/links;
data obtained during the assessment: answers to questions, test results, rating scales, and interviewers' comments;
online interview data: audio/video stream and/or recording, text chat, files provided by the candidate;
technical data and metadata: IP address, browser/device information, cookies (if any), activity and error logs.

3.2. The Company does not request special categories of personal data (e.g., health, political views, religious beliefs). If such information is contained in the candidate's resume/messages, it is processed only to the extent necessary to consider the candidate's application and within the limits permitted by law.

3.3. The Company does not intend the platform to be used by persons under the age of 18. If you are under the age of 18, we recommend that you only attend interviews if there are legal grounds for doing so and in accordance with the requirements of the law.

4. Purposes and legal grounds for processing

4.1. Purposes of personal data processing:

organizing and conducting stages of personnel selection (including resume screening, testing, online interviews);
verifying the candidate's compliance with the job requirements and forming a personnel reserve (if agreed with the Customer);
providing feedback to the candidate, sending invitations, notifications, and official messages;
ensuring information security, preventing abuse, and investigating incidents;
improving the quality and usability of the platform, fixing bugs, and developing functionality.

4.2. Legal grounds for processing:

consent of the personal data subject (candidate) — in cases where it is required by law;
the need to perform actions at the request of the candidate and/or the Customer as part of the recruitment process;
fulfillment of obligations provided for by the legislation of the Republic of Kazakhstan;
the legitimate interests of the Company and/or the Customer, provided that the rights and freedoms of the personal data subject are respected.

5. Automated processing and decision-making

5.1. The SoBes platform may use automated tools for preliminary screening of resumes and responses (e.g., ranking by job criteria, highlighting key skills).

5.2. Unless otherwise specified by the Customer, final decisions on invitations, continuation of selection, or rejection are made by people (representatives of the employer). Automated results are auxiliary.

5.3. The candidate has the right to request clarification from the Customer regarding the logic of processing in relation to automated tools to the extent permitted by law and contractual obligations with the Customer.

6. Candidate consent and data collection procedure

6.1. Before the start of the online interview, the candidate is shown a link/text of this Policy. By clicking the "Start Interview" button (or equivalent), the candidate confirms that they have read the Policy and agrees to the processing of personal data under the terms of the Policy, if such consent is required.

6.2. If audio/video recording is provided for in a specific interview, the system displays a recording notification. By continuing the interview, the candidate consents to the recording and subsequent processing of the relevant data for recruitment purposes.

6.3. The candidate has the right to refuse to provide certain data. However, in this case, it may not be possible or may be limited to complete the interview or participate in the selection process.

7. Transfer of personal data and access to it

7.1. Access to candidate data is granted to:

authorized employees of the Company — to the extent necessary to support the platform and ensure security;
authorized representatives of the Customer (employer) who initiated the interview — for the purposes of personnel selection;
authorized state bodies of the Republic of Kazakhstan — if there are legal grounds and in accordance with the procedure established by law.

7.2. The Company does not disclose personal data to third parties without legal grounds. The transfer may be carried out to contractors providing infrastructure (e.g., hosting/communication/support), provided that they comply with confidentiality and security requirements.

8. Cross-border transfer

8.1. The Company may carry out cross-border transfer of personal data (including when using infrastructure and services located outside the Republic of Kazakhstan) only in compliance with the requirements of the legislation of the Republic of Kazakhstan.

8.2. In cases where processing is carried out on behalf of the Customer, the terms of cross-border transfer are also determined by the Customer's documents and agreements between the Company and the Customer.

9. Storage periods and destruction of personal data

9.1. Personal data shall be stored for no longer than is necessary for the purposes specified in section 4, or for the periods established by the legislation of the Republic of Kazakhstan.

9.2. Standard storage periods depend on the Customer's requirements and may include storage of data in the personnel reserve. If the Customer has not set other terms, the Company shall be guided by reasonable terms necessary to complete the selection process and resolve any possible disputes.

10. Personal data protection measures

10.1. The Company applies legal, organizational, and technical protection measures, including, but not limited to:

differentiation of access rights and control of user actions;
use of encryption when transmitting data over communication networks (where applicable);
backup and recovery of data;
monitoring and logging of security events;
employee training and application of internal regulations;
use of contractual confidentiality mechanisms with counterparties.

11. Rights of the candidate (personal data subject)

11.1. The candidate has the rights provided for by the legislation of the Republic of Kazakhstan, including the right to:

receive information about the processing of their personal data;
request clarification, blocking, or destruction of personal data if there are grounds for doing so;

12. Contact information and procedure for appeals

12.1. Requests regarding the processing of personal data can be sent:

to the Company's postal address indicated at the beginning of the Policy;
through the contact channels specified in the SoBes interface;
as well as to the Customer (employer) who invited you to the interview — for questions related to hiring decisions.

12.2. It is recommended that you include the following in your request: your full name, contact details, a description of your request, and information that will help identify the interview/vacancy (e.g., the date of the interview or the invitation ID).

13. Changes to the Policy

13.1. The Company has the right to make changes to the Policy in the event of changes in legislation, business processes, or platform functionality. The current version of the Policy is provided to the candidate before the interview begins and/or is posted on the SoBes interface.

13.2. Continued use of the platform after the changes come into effect means that you agree to the updated version of the Policy, unless otherwise required by law.