All Collections
FREQUENTLY ASKED QUESTIONS (FAQ)
Rakuna's GDPR Privacy Policy Notice
Rakuna's GDPR Privacy Policy Notice
M
Written by Minh Tong
Updated over a week ago

INTRODUCTION

Thank you for using Rakuna! As the leading recruiting technology solutions provider for employers, transparency has always been a cornerstone of our values - we are committed to being accountable and protecting the privacy and security of your personal information.

In an effort to expand EU data subjects’ control over their personal data, a landmark privacy law called General Data Protection Regulation (GDPR) goes into effect on May 25, 2018 in the European Union (EU). All organizations that market, track or handle EU personal data are legally required to comply.

The GDPR builds upon and modernizes existing EU Data Protection and Privacy rules and will replace them with one single set of rules which govern how personal information is collected and processed. It also specifically addresses the export of personal data of EU citizens outside the EU, and sets clear guidelines for companies who operate between the EU and other global markets with different legal structures and approaches to data transfer and its commercial use.

OUR COMMITMENT AND APPROACH TO THE GDPR

Protecting and defending user privacy is at the heart of our work. Rakuna is committed to the following foundational principles built into the DNA of our company:

  1. Transparency
    We inform and educate our users and customers of our data policies. We do this through in-product notifications, campaigns, and direct conversations with our customers to ensure people understand how their data is being used.

  2. User Control
    We provide people with the ability to control how their data is used.

  3. Accountability
    We are committed to sticking to our practices of protecting data, getting frequent feedback from regulators, policy makers, privacy experts, and improving how we protect personal information.

DATA WE COLLECT

From RECRUITERS

I. Information that is necessary for the use of Rakuna

1.1. Personal account information

When you sign up for a Rakuna account, we require certain information such as your (1) first name, (2) last name, (3) business email address, and (4) phone number.

1.2. Company information

When you sign up for a Rakuna account, we also require information on (1) company name, and (2) company website.

1.3. Communications with Rakuna

When you communicate with Rakuna on our platform (e.g: chat support via Intercom on the Rakuna website), we collect information about your communication and any information you choose to provide.

II. Information you choose to give us

2.1. Additional personal account information

You may choose to provide additional information as part of your Rakuna profile, such as (1) time zone and (2) profile picture.

2.2. Additional company information

You may choose to provide additional information as part of your company profile, such as (1) company logo, (2) company description, (3) Facebook link, (4) Youtube link, (5) Twitter link, and (6) LinkedIn link.

2.3. Prospect information

By providing us with digital copies of prospects’ resumes and their contact information, we have access to their information such as (1) full name, (2) phone number, (3) email address, (4) address, (5) education information.

2.4. Other information

You may otherwise choose to provide us information when you fill in a form, update or add information to your Rakuna account, respond to surveys, submit comments on our blog posts, participate in promotions, communicate with our Customer Success team, share your experience with us (such as through Customer Success Case Study), or use other features of the Rakuna Platform.

III. Information that is necessary for the use of the Payment Services

We need the following information necessary for the adequate performance of the business (event credit and contract) with you and to comply with applicable law (such as anti-money laundering regulations).

3.1. Payment information

When we send an invoice to you to inform a request of payment, we will need your (1) name, (2) email address, and (3) invoice address.

IV. Information we automatically collect from your use of Rakuna 4.1. Usage Information

We collect information about your interactions with Rakuna such as the pages or content you view, your searches, and other actions on Rakuna.

4.2. Log Data and Device Information

We automatically collect log data and device information when you access and use Rakuna, even if you have not created a Rakuna Account or logged in. That information includes, among other things: details about how you’ve used Rakuna (including if you clicked on links to third party applications), IP address, access dates and times, hardware and software information, device information, device event information, unique identifiers, crash data, cookie data, and the pages you’ve viewed or engaged with before or after using Rakuna.

4.3. Cookies and Similar Technologies

We use cookies and other similar technologies when you use our platform, use our mobile app, or engage with our online ads or email communications. We may collect certain information by automated means using technologies such as cookies, web beacons, pixels, browser analysis tools, server logs, and mobile identifiers. In many cases the information we collect using cookies and other tools is only used in a non-identifiable manner without reference to personal information. For example, we may use information we collect to better understand website traffic patterns and to optimize our website experience. In some cases we associate the information we collect using cookies and other technology with your personal information.

V. Information We Collect from Third Parties

Rakuna may collect information, including personal and work information, that others provide about you when they use Rakuna and the Payment Services, or obtain information from other

sources and combine that with information we collect through Rakuna and the Payment Services. We do not control, supervise or respond to how the third parties providing your information process your Personal Information, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.

5.1. Third Party Services

If you link, connect, or login to your Rakuna Account with a third party service (e.g. signing in with Single Sign-On or calendar integration with Google Calendar/Outlook), the third party service may send us account information from that service. This information varies and is controlled by that service or as authorized by you via your privacy settings at that service.

5.2. Other Sources

To the extent permitted by applicable law, we may receive additional information about you, such as demographic data or information to help detect fraud and safety issues, from third party service providers and/or partners, and combine it with information we have about you. For example, we may receive background check results (with your consent where required) or fraud warnings from service providers like identity verification services for our fraud prevention and risk assessment efforts. We may receive information about you and your activities on and off the Rakuna through partnerships, or about your experiences and interactions from our partner and networks.

From PROSPECTS

VI. Information that is necessary for the use of Rakuna

6.1. Personal information

6.1.1. When registering via the “Pre-Event Registration Link”: We ask for your (1) First name, (2) Last name and (3) Email as the three required fields. (4) Phone number and (5) your Resume are optional for you to give.

6.1.2. When scheduling for an interview time slot: We ask for your (1) First name, (2) Last name and (3) Email as the three required fields. (4) Phone number and (5) your Resume are optional for you to give.

6.1.3. When sending in your resume: We ask for your electronic version of your resume (PDF format) that we will store under the customer’s database.

6.2. Communications with Rakuna

When you communicate with Rakuna on our platform (e.g: chat support via Intercom on the Rakuna website), we collect information about your communication and any information you choose to provide.

VII. Information you choose to give us

7.1. Prospect information

By providing event recruiters, and thus Rakuna, with a digital copy of your resume, we have access to your information such as (1) full name, (2) phone number, (3) email address, (4) address, and (5) education information.

7.2. Other information

You may otherwise choose to provide us information when you respond to surveys, submit comments on our blog posts, participate in promotions, communicate with our team, share your experience with us (such as through Customer Success Case Study), or use other features of the Rakuna Platform.

VIII. Information we automatically collect from your use of Rakuna 8.1. Usage Information

We collect information about your interactions with Rakuna such as the pages or content you view, your searches, and other actions on Rakuna.

8.2. Log Data and Device Information

We automatically collect log data and device information when you access and use Rakuna, even if you have not created a Rakuna Account or logged in. That information includes, among other things: details about how you’ve used Rakuna (including if you clicked on links to third party applications), IP address, access dates and times, hardware and software information, device information, device event information, unique identifiers, crash data, cookie data, and the pages you’ve viewed or engaged with before or after using Rakuna.

8.3. Cookies and Similar Technologies

We use cookies and other similar technologies when you use our platform, use our mobile app, or engage with our online ads or email communications. We may collect certain information by automated means using technologies such as cookies, web beacons, pixels, browser analysis tools, server logs, and mobile identifiers. In many cases the information we collect using cookies and other tools is only used in a non-identifiable manner without reference to personal information. For example, we may use information we collect to better understand website traffic patterns and to optimize our website experience. In some cases we associate the information we collect using cookies and other technology with your personal information.

IX. Information We Collect from Third Parties

Rakuna may collect information, including personal and work information, that others provide about you when they use Rakuna and the Payment Services, or obtain information from other sources and combine that with information we collect through Rakuna and the Payment Services. We do not control, supervise or respond to how the third parties providing your information process your Personal Information, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.

9.1. Third Party Services

If you link, connect, or login to your Rakuna Account with a third party service (e.g. signing in with Single Sign-On or calendar integration with Google Calendar/Outlook), the third party service may send us account information from that service. This information varies and is controlled by that service or as authorized by you via your privacy settings at that service.

9.2. Other Sources

To the extent permitted by applicable law, we may receive additional information about you, such as demographic data or information to help detect fraud and safety issues, from third party service providers and/or partners, and combine it with information we have about you. For example, we may receive background check results (with your consent where required) or fraud warnings from service providers like identity verification services for our fraud prevention and risk assessment efforts. We may receive information about you and your activities on and off the Rakuna through partnerships, or about your experiences and interactions from our partner and networks.

HOW WE USE THE DATA WE COLLECT

We may use information we have collected to (1) process data and provide additional services to our customers, (2) pass on to third parties for further use, (3) develop, improve and maintain Rakuna, and (4) create and maintain a trusted and safer environment.

I. To process data and provide services to customers

With data collected from recruiters, we:

  • Allow recruiters to access and update their profile information

  • Allow recruiters to access and update their company information

  • Allow recruiters to access and download the prospect’s information (only applicable to the Admin role)

  • Allow recruiters to access and view the prospect’s information (only application to the Reviewer role)

  • Access, modify and update recruiters profile and/or company information on their behalf and per request

  • Copy and maintain such data on Rakuna’s servers (or the servers of its suppliers)

  • Use in an anonymous manner in support of Rakuna’s marketing and sales activities

  • Sanitize and erase data from the database anytime per the recruiter’s request

With data collected from prospects, we:

  • Stored prospect’s resume and parsed information of (1) Name, (2) Email address, (3) Phone number, (4) Educational institution name, (5) GPA, (6) Major, (7) Graduation year, in an online, searchable candidate database that may be accessed by Rakuna and its Users.

  • Store prospects’ rating and feedback their experience (when attending a recruiting event) on the Rakuna portal to allow Rakuna to determine the user experience and improve the Portal.

  • Download prospect’s information on the recruiter’s behalf and per request

  • Access, modify and update prospect’s personal information per the recruiter’s request

  • Copy and maintain such data on Rakuna’s servers (or the servers of its suppliers)

  • Use in an anonymous manner in support of Rakuna’s marketing and sales activities

  • Sanitize and erase data from the database anytime per the recruiter’s request

II. To pass onto third parties for additional business use

Rakuna will pass on your data to third parties with your consent (via the Terms of Services and Privacy Policy agreement). The following third parties will receive your personal data for the following purposes as part of the processing activities:

  • Intercom

  • AWS

  • Application Tracking System (Greenhouse, Lever, iCIMS, Workday, SAP SuccessFactors)

III. To develop, improve and maintain Rakuna products and services

We may use the data collected and your personal information to provide, improve, and develop Rakuna such as to:

  • enable you to access and use Rakuna;

  • enable you to communicate with other team members;

  • operate, protect, improve, and optimize Rakuna and the user experience, such as by performing analytics and conducting research;

  • provide customer service;

  • send you service or support messages, updates, security alerts, and account notifications;

  • if you provide us with your contacts’ information, we may process this information: (i) for fraud detection and prevention, and (ii) for any purpose you authorize at the time of collection;

  • enable your use of our products.

We process this personal information for these purposes given our legitimate interest in improving our products and services, your experience with it, and where it is necessary for the adequate performance of our business with you.

IV. Create and maintain a trusted and safer environment

We may use the data collected and your personal information to create and maintain a trusted and safer environment such as to:

  • detect and prevent fraud, spam, abuse, security incidents, and other harmful activity;

  • conduct security investigations and risk assessments;

  • verify or authenticate information or identifications provided by you;

  • conduct checks against databases and other information sources, including background or police checks, to the extent permitted by applicable laws and with your consent where required;

  • comply with our legal obligations and applicable laws;

  • resolve any disputes with any of our members/users and enforce our agreements with third parties;

  • enforce our Terms of Service and other policies;

In connection with the activities above, conduct profiling based on your interactions with Rakuna, your profile information and other content you submit to Rakuna, and information obtained from third parties. In limited cases, automated processes may restrict or suspend access to Rakuna if such processes detect activity that we think poses a safety or other risk to Rakuna, our community, or third parties. If you challenge this process, please contact us as provided in the Contact Us section below.

HOW WE KEEP YOUR DATA SECURED

I. Access control

To access and use the Rakuna application, all the users need to be authenticated by email and password with requirements:

  • Passwords must be at least 8 characters long and contain a character from each of the following categories: (1) Uppercase (A-Z), (2) Lowercase (a-z), (3) Numeric (0-9) and (4) Special characters (!$?...).

  • User passwords will expire every 90 days and users will receive an email reminder to change password prior to expiry.

  • Users won't be able to reuse the last 10 passwords.

  • System lockout after five unsuccessful login attempts.

Once pass through authentication, user can access to Rakuna resources based on permission levels:

  • Admin: This permission level grants full access to both the mobile app and web app. An Admin can create and edit Events, Forms, and Messaging/Email templates, and view all prospects and organization data via the Dashboard. In addition, an Admin can also invite or remove members from the organization, edit team members’ permission levels, and purchase Event Credits.

  • Reviewer: This permission level grants full access to the mobile app and limited access to the web app. Reviewer users are usually the talent acquisition leaders who need access to the dashboard to review event recruiting metrics, or hiring managers who can have access to prospects' information to select who they would like to interview, tag, and leave comments on specific prospects. A Reviewer can view a prospect’s information, published Events, Forms, and Messaging templates, but cannot edit.

  • Mobile: This permission level grants full access to the mobile app only. A Mobile user only has access to “Settings” on the web app.

II. Data control

Rakuna separates scoped data on the application control level where sensitive personal information is classified then encrypted before saving to database, only privileged can access and request service to decrypt information in readable format.

III. Encryption

A. Encryption of Data in Transit

Rakuna enforces the SSL encryption on the top level of network communication to protect information transmitted on the internet. Under the SSL connection, the client and server employ the public and private keys to exchange randomly generated data called the session keys which is used to encrypt and decrypt the data.

To ensure encryption strength, Rakuna utilizes SSL public and private keys which are certified by well known and trusted authorities (Amazon, Google, Godaddy). Those certificates are updated and improved on yearly basis

B. Encryption of Data at Rest

Rakuna has developed Secure Data Service which is responsible for encrypting/decrypting personal data before saving it to the database. To protect the data, Secure Data Service employs Key Management Service (KMS) to generate and manage encryption keys which are used to encrypt and decrypt sensitive data. KMS uses a master key that is compounded by different shared keys to generate encryption keys and transmit to Secure Data Service in a private network over SSL/HTTPS.

On database instances, data stored at rest in the underlying storage is encrypted, as are its automated backups, read replicas and snapshots. The database system uses industry standard AES=256 encryption algorithm to encrypt customer data.

IV. Logging

All personal data related activities are logged and monitored in a centralized log system and all the local logs on other resources are removed. If there are any abnormal activities, DPO and Security committee will take responsible with suitable action

V. Security Assessment

Rakuna conducts a penetration testing annually. Our pen test entails entire product code review, security assessments (OWASP), and intrusion attempts from third-party Pen Test contractors.

In addition, Rakuna performs security vulnerability scanning on a weekly basis using automated security tools and internal resources.

OUR DATA PROTECTION OFFICER

We’ve a dedicated Data Protection Officer (DPO) to oversee and advise on our data management. You can reach out to us by emailing Minh Tong at minh@rakuna.co.

YOUR DATA RIGHTS

Rakuna would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

  1. The right to be informed
    Organisations must tell individuals what data of theirs is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties.

  2. The right of access
    Individuals have the right to request a copy of the information that an organisation holds on them.

  3. The right to rectification
    Individuals have the right to correct data that is inaccurate or incomplete.

  4. The right to erasure
    In certain circumstances, individuals can ask organisations to erase any personal data that’s stored on them.

  5. The right to restrict processing
    Individuals can request that organisation transfer any data that it holds on them to another company.

  6. The right to data portability
    Individuals can request that an organisation limits the way it uses personal data.

  7. The right to object
    Individuals have the right to challenge certain types of processing, such as direct marketing.

  8. Rights related to automated decision making and profiling

    Individuals can ask organisations to provide a copy of its automated processing activities if they believe the data is being processed unlawfully. You should also remind individuals that they are free to exercise their rights and explain how they can do this.

CHANGES TO THIS GDPR PRIVACY POLICY

Rakuna reserves the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on the Rakuna Platform and update the “Last Updated” date at the top of this Privacy Policy. We will also provide you with notice of the modification by email at least thirty (30) days before the date they become effective. If you disagree with the revised Privacy Policy, you may cancel your Account. If you do not cancel your Account before the date the revised Privacy Policy becomes effective, your continued access to or use of Rakuna will be subject to the revised Privacy Policy.

CONTACT US

If you have any questions about Rakuna’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us at support@rakuna.co.

Did this answer your question?