Job Candidates Privacy Statement

This Statement applies to all personal data about candidates applying for a role at PayU (prospective employees), including where applicable contractors, temporary, part-time, secondees or similar (“you”) that is collected, maintained or used by any PayU Group company (“PayU,” “we/us”) as part of a prospective employment relationship.

The Privacy Statement for PayU Job Candidates supplements our Global Privacy Statement, which gives you specific information on how we process personal data obtained from you when visiting our website, using our services and other non-application-specific topics.

For the purposes of this Policy:

Applicable Law means: (i) the GDPR and any amendments and/or replacement legislation related to data protection, information privacy and professional secret laws of the relevant Member State of the European Union; and (ii) any other data protection and information privacy laws enacted in the countries where the PayU Group of companies hire employees, contractors, consultants or trainees.

PayU Group means MIH Fintech Holdings B.V. and all of its subsidiaries.

We generally process the following personal data about you over the course of recruitment:

• Your biographical information, including your name, previous job history, education details, nationality;
• Your contact information, including your home and postal address, telephone number, email address, country of residence;
• Your current employment including your current position, date of the employment, date of termination of the contract (where applicable);
• Your salary expectation and expected benefits;
• Hiring and training history, including prior work experience data (including references from previous employers), qualifications and job history, vocational training, conferences and seminars, education, references, background check information (in accordance with Applicable Law) and search reports by recruitment companies (where applicable);
• Feedback from interviews and other engagements in the course of recruitment; and
• Your identification number and information about residency and work permit status, where required or allowed under Applicable Law.

We most often collect personal data about you directly from you in the course of your application.  We may also use sources such as your profile on business networking services (e.g., LinkedIn).  We will not check your accounts or profiles on non-business social media like Facebook, Instagram, etc. nor contact any of your work-related acquaintances without your consent.

PayU is an international organization and the amount of data that we collect, and use might differ depending on the hiring entity and local laws that are applicable, especially in terms of background checks (pre-employment screening).

In the final phase of the recruitment process, subject to the role and Applicable Law, PayU may engage a third party to complete pre-employment screening. In such case, you will be specifically informed, and you will be requested to provide your specific permission to complete such pre-employment screening activities.

We process your personal data because it is needed for the employment agreement between you and the organization, based on a role that you have applied for.  In such situations it is necessary for us to collect this information so we can enter into a contract.  In some countries where we operate, it is a requirement for us to collect your consent before obtaining this information.  In such situations we will request your consent.  We will keep your data as long as it is necessary to finalize the employment contract or to close the recruitment process.

In limited circumstances, we may process your personal data where it is necessary for us to defend, prosecute or make a claim in a court of law. We may also process personal data for something called “legitimate interests” under Applicable Law, in particular in the context of protection of security of our IT assets, our premises and our members of staff. In practice, this means that we must put in place appropriate privacy safeguards to ensure that we are respecting your interests, as well as your fundamental rights.

Your personal data will be shared within the PayU Group (subject to your consent where necessary as per the Applicable Law) for the purposes described in Section 5 above to the extent necessary to carry out these purposes, and as permitted by law.

We are a global Group with a global footprint. Note that your personal data may be processed either locally in the jurisdiction where you work or reside, or in any other jurisdiction where we or our approved third-party service providers operate, worldwide, depending on the needs of the business over the course of the recruitment process, to the extent necessary and as permitted by law. Should your personal data move outside the European Economic Area or another jurisdiction that restricts the international transfer of personal data, we ensure that the appropriate transfer mechanisms under Applicable Law are in place.

Your personal data will only be shared outside the PayU Group with third parties, including with Prosus N.V (i.e. PayU’s shareholder), under the following circumstances: (1) where a third-party service provider retained by us is under contract to assist in administering our Human Resources activities, subject to appropriate confidentiality obligations (2) with private or government authorities only when we have determined that we are required to do so under Applicable Law; (3) to investigate suspected fraud or illegality, to anticipate or defend legal claims; or (4) where you have given us your prior permission to do so.

Individuals have the right to exercise certain rights under data protection laws where the relevant PayU Group entities operate.  Under the GDPR, which is the data protection law for the EU hires, these are described below.

• SUBJECT ACCESS: You have the right to access your personal data in many circumstances;
• RECTIFICATION: You can ask us to have inaccurate personal data amended;
• ERASURE: You can ask us to erase personal data in certain circumstances, recognising that PayU must in any case respect its data retention legal obligations in the field of employment;
• WITHDRAWAL OF CONSENT: You can withdraw any consents to processing that you have given us and prevent further processing if there is no other legitimate ground upon which PayU can process your personal data;
• RESTRICTION: You can require certain personal data to be marked as restricted for processing in certain circumstances as defined in article 18 of the GDPR;
• PORTABILITY: You can ask us to provide you with a copy of your personal data in a such a form that you can send it to a third party;
• OBJECTION: You can object to processing of your personal data when it is based on our legitimate interest;
• RAISE A COMPLAINT: You can raise a complaint about our processing with the data protection regulator in your jurisdiction, or with your Privacy Team (see Section 11 below).

In countries outside of the EU, some of these rights apply as well. In order to know your exact data subject rights in your country, you can reach out to your local PayU HR hiring person or to the PayU Privacy Team for more detailed information.

Maintaining the security and integrity of your personal data is a high priority and we endeavor to maintain appropriate administrative, technical, personnel and physical measures to safeguard personal data against loss, theft, and unauthorized uses or modifications.

We keep records of your personal data no longer than necessary for the purpose for which we obtained them and for any other permitted compatible purposes, including compliance with legal obligations in the field of employment law.

If you agree that we hold your data for future recruitment processes, you will be asked to give your prior consent for us to keep it for a period specified in your consent.  You are free to withdraw your consent at any time and for any reason. Your data will be kept only for recruitment processes among PayU group of entities and will not be shared with third parties.

The controller of your personal data is the relevant PayU entity operating in the country where the position is located, see Schedule 1 for a list of PayU Group of Companies that may act as data controllers.

If you want to exercise your data subject rights, find out more information or ask a question, regarding processing of your data, please contact your local PayU HR hiring person or the PayU Privacy Team.