Privacy Policy

Luminary Leads ("we," "our," or "us") is committed to protecting your privacy in accordance with the European Union General Data Protection Regulation (GDPR), Nepal Personal Data Protection Act, and other applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services for international recruitment across Poland, Romania, Croatia, Japan, Korea, Dubai, and Malaysia. Our services involve processing personal data of job seekers and employers across multiple jurisdictions. We are registered in Nepal and operate as a data controller for the personal information we process.

We collect information you provide directly to us, such as: • Personal Information: Name, email address, phone number, date of birth, nationality, citizenship status • Professional Information: Resume/CV, work history, skills, education, certifications, language proficiencies • Legal Documentation: Passport details (encrypted), visa status, work permit eligibility • Account Information: Username, password (hashed), preferences, language settings • Communication Data: Messages, inquiries, feedback, interview notes • Payment Information: For premium services (processed through PCI-compliant providers) • Usage Data: IP address, browser type, pages visited, time spent on site • Location Data: Country, city (for job matching purposes) • Biometric Data: Only with explicit consent for identity verification Legal Basis for Processing (GDPR): • Consent: For marketing communications and biometric data • Contract: To provide our recruitment services • Legitimate Interest: For fraud prevention and service improvement • Legal Obligation: For compliance with employment laws

We use the collected information to: • Provide and improve our recruitment services • Match candidates with suitable job opportunities • Communicate with you about opportunities and updates • Process transactions and send related information • Respond to your inquiries and provide support • Send promotional communications (with your consent) • Comply with legal obligations

We may share your information with: • Potential Employers: With your explicit consent • Service Providers: Who assist in our operations • Business Partners: For enhanced service delivery • Legal Authorities: When required by law • Business Transfers: In case of merger or acquisition We never sell your personal information to third parties.

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These include: • Encryption of sensitive data • Secure servers and databases • Regular security audits • Limited access to personal information • Employee training on data protection

Under GDPR and Nepal Personal Data Protection Act, you have the following rights: • Right to Access: Obtain a copy of your personal data and information about how we process it • Right to Rectification: Correct inaccurate or incomplete personal information • Right to Erasure ('Right to be Forgotten'): Request deletion of your data in certain circumstances • Right to Restrict Processing: Limit how we use your information • Right to Data Portability: Receive your data in a structured, machine-readable format • Right to Object: Object to processing based on legitimate interests or direct marketing • Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing • Right Not to be Subject to Automated Decision-Making: Including profiling To exercise these rights, contact our Data Protection Officer at [email protected] Response Time: We will respond to your request within 30 days (GDPR requirement) Complaints: You may lodge a complaint with: • Nepal: Office of the Privacy Commissioner • EU: Your local Data Protection Authority • Other regions: Relevant privacy authorities

As we operate across multiple countries, your data may be transferred internationally: • From Nepal to EU countries (Poland, Romania, Croatia): We use Standard Contractual Clauses (SCCs) • From EU to Nepal: Adequate safeguards per GDPR Article 46 • To Japan: Recognized as having adequate data protection by the EU • To Korea: Corporate Binding Rules and explicit consent • To Dubai/UAE: Enhanced security measures and explicit consent • To Malaysia: Contractual safeguards and consent We ensure all transfers comply with: • GDPR Chapter V requirements • Nepal Personal Data Protection Act cross-border provisions • Local data protection laws in each country Your data is encrypted during transfer and stored in secure, compliant data centers.

We retain your personal data only as long as necessary: • Active Job Seekers: Duration of job search + 2 years • Placed Candidates: 7 years (employment law requirements) • Unsuccessful Applications: 6 months (with consent for future opportunities) • Marketing Data: Until consent withdrawn • Legal/Tax Records: As required by law (typically 5-7 years) Deletion Process: • Automatic deletion after retention period • Secure erasure from all systems and backups • Notification of deletion upon request • Certificate of deletion available

We use cookies and similar tracking technologies in compliance with GDPR and ePrivacy Directive: Types of Cookies: • Essential Cookies: Required for site functionality (no consent needed) • Performance Cookies: Analytics and site improvement (consent required) • Functional Cookies: Remember your preferences (consent required) • Marketing Cookies: Personalized ads and tracking (explicit consent required) Cookie Management: • Cookie banner for granular consent • Withdraw consent anytime via cookie settings • Browser controls to block/delete cookies • Do Not Track signal respected Third-Party Services: • Google Analytics (anonymized IP) • LinkedIn Insight Tag (job matching) • Facebook Pixel (with consent only)

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Material Changes: • 30 days advance notice via email • Prominent website notification • Explicit consent for significant changes • Version history maintained Continued use of our services after changes constitutes acceptance, except where explicit consent is required by law.

Special provisions apply based on your location: Poland: • GDPR applies in full • Polish Personal Data Protection Act supplements • UODO (Polish DPA) oversight Romania: • GDPR and Romanian Law 190/2018 • ANSPDCP oversight Croatia: • GDPR and Croatian Implementation Act • AZOP oversight Japan: • Act on Protection of Personal Information (APPI) • PPC oversight • EU-Japan adequacy decision applies Korea: • Personal Information Protection Act (PIPA) • KISA oversight • Enhanced consent requirements Dubai/UAE: • UAE Federal Law No. 45/2021 • DIFC Data Protection Law • Enhanced security measures Malaysia: • Personal Data Protection Act 2010 • Commissioner oversight Nepal: • Personal Data Protection Act 2024 • Right to Information Act • Privacy Commissioner oversight

For questions about this Privacy Policy or our data practices, contact us at: LUMINARY LEADS PVT.LTD. Data Protection Officer Lalitpur Metropolitan City-20, Kumaripati, LALITPUR Bagmati Province, Nepal Permission/Registration No: 1640/080/081 Email: [email protected] Privacy Hotline: +977 9808888489 GDPR Representative (EU): [email protected] Office Hours: Sunday-Friday, 9:00-18:00 NPT Response Time: Within 72 hours For urgent data breaches: [email protected]