Revised August 15, 2025
OVERVIEWThis Applicant Privacy Policy (“Policy”) describes how
Modu, including its affiliates and subsidiaries (“Modu”, “Company”, "we", "us" and "our"), collects, uses, and discloses information about individuals who are applicants for engagement with Modu as an employee, contractor, consultant, or other contingent worker of the Company (hereinafter “Applicants”, and "you").
We may update this Policy from time to time. We may also provide you with additional privacy policies regarding our collection, use, or disclosure of information, as applicable. When we update this Policy, we will take appropriate measures to inform you, consistent with the significance of the changes made. We will obtain your consent to any material Privacy Policy changes if, and where, required by applicable data protection laws in Kazakhstan.
You can see when this Policy was last updated by checking the
“Effective Date” displayed at the top of this Policy. We encourage you to check back here periodically to be aware of the most recent version of this Policy.
This Policy does
not apply to the Company’s handling of data gathered about Applicants arising from their role as a user of Modu products and services. When interacting with the Company in that role, the
Modu Privacy Policy associated with the relevant service applies.
Please read this Policy and any other privacy policies carefully.
DATA COLLECTIONModu collects, stores, and uses various types of personal information through the application and recruitment process. Modu collects such information either directly from Applicants or (where applicable) from another person or entity, such as an employment agency or consultancy, background check provider, or other referral sources.
The categories and specific Applicant personal information Modu collects and/or processes include:
- Identification and Contact Information and Related Identifiers, such as real name, alias, preferred name, pronouns, home postal address, home telephone number, personal email address, personal mobile number, online account name/screen name or handle, and similar information about an Applicant’s beneficiaries or emergency contacts.
- Recruitment, Employment, or Engagement Information, such as application forms, resume, cover letter, or information provided through any application and recruitment process, including communication regarding recruitment and Modu’s evaluation of your performance during the interview process. May also include websites and professional networking addresses. Where permitted by law and required by job responsibilities, criminal background check information may be collected.
- Personal Characteristics and Voluntary Demographic Data, such as race, ethnic origin, sexual orientation, preferred pronouns, or gender.
- Sensory Information, such as videos and recordings of audio interviews.
- Government-Issued Identification Numbers, such as driver’s license, operator’s license, passport number, social security number, birth certificate number, or other government-issued IDs.
- Financial Information, such as credit history or credit checks, where relevant.
- Education Information, such as degrees or schooling, licenses and professional memberships, certifications, trainings, academic record, and other non-publicly available educational record information held by an educational institution.
- Professional or Employment-Related Information, such as job titles, work history, work dates and locations, employment, service or engagement agreements, contact and identification information about references, appraisal and performance information, skills, qualifications, experience, publications, speaking engagements, preferences (e.g., mobility), absence and leave records, disciplinary and grievance information, and termination information.
DATA USEModu collects, uses, shares, and stores personal information from job applicants for operational purposes related to recruitment and hiring. This includes, but is not limited to, the following:
Purpose: RecruitmentProcessing applications; tracking applications through the recruitment process; evaluating applicants for current and, as permitted by applicable laws in Kazakhstan, future job opportunities (including matching skills and interests to applicable job requirements); making hiring decisions.
Examples of personal information that may be processed:
Information concerning your application, including personal details, education and qualification details, recordings of interviews, assessment of your application, records of your application, references, verification checks or background checks (including criminal and credit history), any tests required for your position, and information related to your right to work in Kazakhstan.
Where relevant, information concerning your health or disability in connection with adjustments to working arrangements.
Potentially legally protected classification information, as required or permitted by law.
Indirect identification information, such as publicly available social network profiles provided by you.
Grounds for processing, if applicable under law: Legal obligation, Legitimate interests.
Purpose: Contacting you or others on your behalfCommunicating with applicants throughout the hiring process; contacting references / beneficiaries with Applicant authorization; (as permitted by applicable laws) contacting you in the future about other opportunities if you are not hired.
Examples of personal information that may be processed: Your address and phone number; emergency contact information and relevant beneficiaries / references. In case you authorize us to contact beneficiaries and references, you warrant that you have their authorization to provide their personal information, and you are responsible for informing them the terms and reasons for which we will contact them and, if applicable, the processing of their personal information in accordance with this Policy, as well as the means to access the full content thereof.
Grounds for processing, if applicable under law: Consent, Contract, Legitimate interests.
Purpose: Verifying your residency and right to workExamples of personal information that may be processed: Information including your citizenship; passport data; and details of residency or work permit in Kazakhstan.
Grounds for processing, if applicable under law: Legal obligation.
Purpose: Supporting and managing any health concernsExamples of personal information that may be processed: To the extent required or permitted by local law, information concerning your health, including self-certification forms, fit notes and medical and occupational health reports.
Grounds for processing, if applicable under law: Contract, Legal obligation, Legitimate interests, Vital interests.
Purpose: Physical and system securityExamples of personal information that may be processed: Information used in detecting security incidents, debugging and repairing errors, and preventing unauthorized access to our computer and electronic communications systems (including biometric identification information) and preventing malicious software distribution; and monitoring.
Grounds for processing, if applicable under law: Legal obligation, Legitimate interests.
Purpose: Internal AnalysisUnderstanding the applicants who apply and to improve Modu’s recruitment and interviewing process
Examples of personal information that may be processed: Information related to your experience as a Modu applicant (e.g. via applicant feedback surveys) including: your name; title; unit/department applied for; and location.
Grounds for processing, if applicable under law: Legitimate interests.
Purpose: Monitoring of diversity and equal opportunitiesExamples of personal information that may be processed: To the extent required or permitted by local law, information on your nationality, racial and ethnic origin, gender and gender pronouns, sexual orientation, religion, disability and age.
Grounds for processing, if applicable under law: Legitimate interests, Consent.
Purpose: Disputes and legal proceedingsModu may sometimes need to use applicant information for legal purposes, such as in connection with any challenges made to Modu’s hiring decisions.
Examples of personal information that may be processed: The Company may sometimes need to use applicant information for legal purposes, such as in connection with any challenges made to Modu’s hiring decisions.
Grounds for processing, if applicable under law: Legitimate interests, Legal obligation.
Purpose: Compliance with any other legal requirementsExamples of personal information that may be processed: Information relevant to our tax records, auditing requirements.
Information about Union membership, professional association membership, and licensure-related organizational memberships.
Grounds for processing, if applicable under law: Legal obligation.
The following purposes are considered secondary purposes under applicable data protection laws: (i) evaluating applicants for future job opportunities; and (ii) contacting you in the future about other opportunities if you are not hired. If you do not want your personal information to be processed for these secondary or accessory purposes, you may reach out to the People team and opt-out at
people@modu.ai.We may also use personal information for any other legally permitted purpose (subject to your consent, where legally required).
As identified in the table above, under Kazakhstan data protection laws, there are various grounds on which we can rely when processing your personal information. Similar grounds may apply outside Kazakhstan or some grounds may be inapplicable in some jurisdictions. In some contexts more than one ground applies. We have summarized these grounds as Contract, Legal Obligation, Legitimate Interests, Vital Interests, and Consent and outline what those terms mean below.
Term: ContractGrounds for processing: Processing necessary for performance of a contract with you or to take steps at your request to enter a contract
Explanation: We need your personal information to perform a contract for services with you. This covers carrying out our contractual duties and exercising our contractual rights.
Term: Legal ObligationGrounds for processing: Processing necessary to comply with our legal obligations
Explanation: Ensuring we perform our legal and regulatory obligations in particular in the area of labor and employment law, social security and protection law, data protection law, tax law, and corporate compliance laws in Kazakhstan. For example, providing a safe place of work and avoiding unlawful discrimination.
Term: Legitimate InterestsGrounds for processing: Processing necessary for legitimate interest
Explanation: We or a third party have legitimate interests in carrying on, managing, and administering our respective businesses effectively and properly and in connection with those interests processing your data.
Your data will not be processed on this basis if our or a third party's interests are overridden by your own interests, rights and freedoms.
This includes:
– implementation and operation of a group-wide matrix structure and group-wide information sharing
– to help us conduct our business more effectively and efficiently – for example for general HR resourcing, IT security/management, accounting purposes, or financial planning
– prevention of fraud, misuse of Modu IT system, or money laundering
– operation of a whistleblowing/compliance hotline
– addressing physical security, IT and network security, and
– conducting internal investigations.
Term: Vital InterestsGrounds for processing: Processing necessary to protect your vital interests or those of another person
Explanation: We may use your information where it is necessary to protect your or someone else's life, physical integrity, or safety. This could include providing law enforcement agencies or emergency services with information necessary to protect health or life in an emergency circumstance (e.g., if you have a medical emergency at one of our offices and paramedics request information about your allergies / diabetes / etc.).
Term: ConsentGrounds for processing: You have given specific consent to processing your data
Explanation: In general, processing of your data in connection with employment will not be conditional on your consent. However, there may be occasions where we do specific things such as contacting a referee, seeking to monitor diversity, or obtaining medical reports and rely on your consent to our doing so.
Certain information we collect may be “sensitive Personal Information”, “special category data” or otherwise sensitive under the data protection laws applicable in Kazakhstan. Any such processing is undertaken in compliance with applicable laws.
For Kazakhstan Residents, except where you provide such information voluntarily on your resume or in your application, or for the purpose of requesting an accommodation during the recruitment process, or if you provide government identification or driver’s license information, we do not collect personal information that is considered “sensitive” under applicable law during the recruitment process. We do not use or disclose such information other than for disclosed and permitted business purposes for which there is not a right to limit under the applicable law.
If we process special category data (or criminal conviction data) about you, we will ensure that one or more of the following legal grounds applies:
(i) you have provided your explicit consent;
(ii) the processing is necessary for the purposes of your or our obligations and rights in relation to employment in so far as it is authorized by law or collective agreement;
(iii) the processing protects your or our legitimate interests and relates to data about you that you have made public (e.g., if you inform us about a medical condition);
(iv) the processing protects your or our legitimate interests and the processing is necessary for the purpose of establishing, making, or defending legal claims; or
(v) the processing is necessary to protect you or someone else's vital interests (e.g., if you have a medical emergency at one of our offices and paramedics request information about your allergies, diabetes, or other relevant health conditions).
Further, we will ensure that any processing satisfies the additional conditions for processing under Kazakhstani law, including labor, data protection, and health-related regulations.
Sensitive Personal Data: Criminal HistoryConditions for processing: Performing or exercising obligations or rights imposed or conferred by law on you or us in connection with employment, social security, or social protection. Protecting the public and complying with regulatory requirements relating to unlawful acts and dishonesty.
Sensitive Personal Data: Union membership informationConditions for processing: Insurance purposes, occupational pensions, and other benefits as required under Kazakhstani labor law.
Sensitive Personal Data: Biometric informationConditions for processing: Preventing fraud and unauthorized access to Modu systems and services.
Sensitive Personal Data: Health information and gender informationConditions for processing: Assessment of the working capacity of an applicant, compliance with occupational health and safety requirements under Kazakhstani law.
Sensitive Personal Data: Religious or philosophical beliefsConditions for processing: Identifying or monitoring the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category, with a view to promoting or maintaining such equality.
Sensitive Personal Data: Racial/ethnic origin, sexual orientation, and/or disability statusConditions for processing: Identifying or monitoring the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category, with a view to promoting or maintaining such equality. This may also include assessing suitability for senior positions within Modu or affiliated entities, in accordance with applicable Kazakhstani regulations.
