Privacy Policy

We, MALJOY LTD, are a company established and operating in accordance with the laws of the United Kingdom. Registration No.16216055. Registered address: Suite 12 2nd Floor Queens House, 180 Tottenham Court Road, London, United Kingdom, W1T 7PD, represent the controller of your personal data, i.e. we independently determine the purposes and means of processing your personal data ("MALJOY", "we", and derivatives).

MINORS DATA: Due to the digital remote nature of our services, we may inadvertently collect personal data from minors under the age of 16. If you are a minor, please make sure that your parent (legal representative) has read and understood the provisions of this Policy. This Policy is accepted and confirmed by the minor’s legal representative on behalf of the minor. If you are a minor and are unable to inform your legal representative of the provisions of this Policy, or if you (your legal representative) do not agree with the terms of this Policy, immediately cease further use of the Website.

If a legal representative allows a minor to use the Website, we assume that said legal representative has read and understood this Policy, as well as accepted the Policy on behalf of the minor.

The Policy, located at maljoy.io/docs/privacy is published on this page in the most up-to-date version. We may unilaterally make changes to the Policy in order to comply with the latest changes in applicable law and accurately reflect our data processing mechanisms. All changes will take effect immediately after publication of new version of this Policy. We will make every effort to ensure that the User is notified of the Policy update, but we ask you to check the Website regularly for updates to the current version of the Policy.

Contact information is information that the User can share with MALJOY to obtain reference information and contact the support team, marketing offers, and notifications, as well as to comply with legislation. Said information shall include, among other things, an email address.

Personal data is information or data of any kind that allows you to identify an individual, including Contact Information and, where applicable, Candidate Personal Data.

Cookies are text files placed on your computer, to help us analyse how users use our Website, and similar technologies (e.g. web beacons, pixels, tags and device identifiers) to recognise you and/or your device(s) on, off and across different devices and our Website, as well as to improve the Website, marketing, analytics or website functionality. The use of cookies is standard on the internet. You may adjust your browser settings to prevent the reception of cookies, or to provide notification whenever a cookie is sent to you. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to access the full functionality of the Website.

Anonymized analytical data is analytical anonymized information about the User’s actions on the Website, the collection and processing of which is aimed at improving the quality of our services and which cannot disclose User’s personality.

Applicable legislation refers to legal provisions on the protection of personal data and confidentiality of which you are a subject according to your location or other legal criteria.

Cross-border transfer refers to the transfer of data to a foreign state’s territory to an individual or legal entity for the purposes of data processing, including for storage purposes.

Candidate Personal Data means information or data you share with us for the potential employment purposes including, inter alia, your name (in English and native languages), address, education, contact details, current job title and employer, any attachments (such as CV, cover letter) as well as any other information you share for the aforementioned purpose.

- From you (from communication, including from completed forms)
‍
- From Cookies and other similar technologies installed by our Website in your browser

By agreeing to the Policy, you confirm that you agree to the transfer of your data to our affiliate companies and partners who are not our affiliated companies, in accordance with the provisions of this Policy.

We guarantee that the level of personal data protection provided for in contracts concluded with third parties is the same or higher than that provided for in this Policy.

We only transfer personal data to third parties for the following purposes:

1) Marketing and business communications

Depending on the nature of your relationship with MALJOY, we process your personal data to promote our services to you or our partners.

2) Quality improvement of the Website and provided services, market research

We enable third-party services to collect your data so that we can provide services to our Users, evaluate, analyze, and improve the Website, and to regularly update and improve our Website and services.

We can use this information to correct any errors on the Website, to assess our Users’ demographic information, to find out whether any support is needed for new types of devices for the Website, as well as to determine whether changes to our marketing processes are necessary.

We may provide and use anonymized analytical data so that we can learn more about our visitors and about the effectiveness of the actions we take to attract interest in our Website and related services, as well as the quality of our business projects.

Accordingly, the following categories of personal data may be transferred to the following third parties:

3) Transfer by law

We can also disclose information that you provide so as to respond to subpoenas, requests, notices, court orders, requests from public authorities in any proceedings, as well as to exercise our rights.

We can also disclose your information to defend ourselves against legal claims if we think that information should be disclosed for the purposes of protection of our rights, your safety or safety of other persons, investigation of fraud, or in response to any request from public authorities.

We can transfer your information to investigate, prevent, or take actions with respect to illegal actions, alleged fraud, and situations associated with potential threats to the physical security of any person, or as otherwise required by law.

Any personal data you provide to Maljoy will be used to process your application for the specific position you have applied for. In accordance with applicable law, your personal data may be retained and used to process your application for other open positions within Maljoy which may be suitable, unless you object to such processing in which case they will be deleted.

The processing of your personal data is based on Article 6(1)(b) of the GDPR. We need your personal data in order to conduct the recruitment process, and we will not be able to consider you for a job offer when you do not provide us with your personal data.

Any processing of personal data from other sources is based on Article 6(f) of the GDPR.

When we retain your personal data for other open positions, we do this based on Article 6(1)(f) of the GDPR and in order to give you the possibility to work with us in the future, even though we are currently unable to offer you a position.

We do not use automated decision-making, and we do not use your data to automatically assess aspects of your personality (automated profiling, etc.).

We store data in Germany (Frankfurt), which provides an adequate level of data protection.

By agreeing to the Policy, you consent to your personal data being transferred to the territory of Germany.

We make it a priority to ensure safety of your personal data. We follow generally accepted standards to protect your information both at the time of transfer and after it is received. However, no method of communication through the internet is absolutely safe, nor may the method of electronic storage be treated as absolutely safe.

Though no safety system is completely safe, we take safety measures together with our partners to protect against unauthorized access or disclosure of information collected by us. When it comes to MALJOY, it includes preventing disclosure of your data unless required and ensuring transfer of all information collected by MALJOY via protected connections, as well as protection and coding by using the appropriate software so as to ensure unauthorized access protection. Our employees and third parties that get access to your data undertake to maintain the confidentiality of your information.

For residents of the European Economic Area (EEA): if you are a resident of the EEA, you have rights under applicable data protection laws. These include, but are not limited to:

- The right of access. You have the right to request and receive a copy of your data at our disposal.

- The right to correction or removal. You have the right to request correction or deletion of your data at our disposal.

- The right to limitation of treatment. You have the right to restrict the processing of your data at our disposal.

- The right to data portability. You have the right to transfer your data (to another controller) at our disposal.

In certain circumstances, you may also have the right to object to the processing of your data. To send such a request, please use the contact information provided in the Contact Us section. We will review any such request and take action in accordance with applicable data protection laws.

If we rely on your consent to process your personal data, you have the right to withdraw your consent at any time. However, please note that this will not affect the legality of your data processing until such consent is revoked.

For residents of the Russian Federation: if you are a personal data subject from the Russian Federation, then you have the right to ensure the protection of your rights and freedoms when processing personal data, the protection of your rights to privacy, and the protection of your personal and family secrets. In particular, you have the right to:

- require us, as an operator, to clarify your personal data, block, or destroy it if your personal data is incomplete, outdated, inaccurate, illegally obtained, or is not necessary for the stated purpose of processing, as well as to take legal measures to protect your rights

- receive information related to the processing of your personal data, including: confirmation of the processing of your personal data by the operator; the legal grounds and purposes of processing your personal data; the purposes and methods used by the operator for processing your personal data; the name and location of the operator, and information about persons (except for the operator's employees) who have access to your personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of Federal Law; processed personal data related to the relevant personal data subject, the source of their receipt; the terms of processing of your personal data, including the terms of their storage; information about the performed or proposed cross-border data transfer; title or full name and address of the person processing your personal data on behalf of the operator, if processing is entrusted or will be entrusted to such a person; other information

- protect their rights and legal interests, including compensation for damages and (or) compensation for moral damage in court

For residents of Brazil: if Brazilian legislation applies to the processing of your personal data, you have the right to ask MALJOY for the following:

- confirmation of data processing

- access to processed data

- correction of incomplete, inaccurate, or outdated data

- anonymization, blocking, or deletion of unnecessary, redundant data or data processed in violation of the provisions of the Brazilian Data Protection Act (LGPD).

- the opportunity to transfer data to another service or product provider through a direct request in accordance with the requirements of the National Data Protection Authority (ANPD) taking into account the requirements of commercial and industrial secrets

- deletion of personal data processed with your consent

- information about public and private organizations with which MALJOY has shared data

- information about the possibility of withholding consent and the consequences thereof

You can also withdraw your consent to personal data processing, object to processing carried out on the basis of one of the opt-out situations if there is a violation of the provisions of the LGPD. We do not make decisions based solely on automated processing of personal data, however, in any case, you have the right to review decisions made solely on the basis of automated processing of personal data that affect your interests, including decisions aimed at determining your personal, professional, consumer, and credit profile or other aspects of your personality.

For residents of Indonesia: If you are a resident of Indonesia, Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, or “UUPK” — referred to here as “UUPK” or “UU PDP”), which entered into full effect in October 2024, grants you the following rights in relation to your personal data that we process:

- Right of access (Article 34 UU PDP). You have the right to request confirmation of whether we process personal data about you, and if so, to obtain access to that data, including information about the purposes of processing, the categories of data processed, and the recipients to whom your data has been or may be disclosed.

- Right to rectification (Article 35 UU PDP). You have the right to request the correction of inaccurate or incomplete personal data about you without undue delay.

- Right to termination of processing and deletion (Article 36 UU PDP). You have the right to request that we stop processing and delete your personal data where: (i) the personal data is no longer necessary for the purposes for which it was collected; (ii) you have withdrawn consent and no other lawful basis applies; (iii) you have successfully objected to the processing; or (iv) the processing is unlawful.

- Right to withdraw consent (Article 38 UU PDP). Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

- Right to object to automated processing (Article 40 UU PDP). You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you. Where such processing occurs, you have the right to request human review of the decision.

- Right to delay or restrict processing (Article 37 UU PDP). You have the right to request a temporary suspension of the processing of your personal data while a dispute regarding the accuracy of your data, or the lawfulness of our processing, is being resolved.

- Right to data portability (Article 39 UU PDP). Where technically feasible, you have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller.

- Right to seek compensation (Article 67 UU PDP). You have the right to seek compensation or other redress through civil proceedings if you suffer material or non-material harm arising from our failure to comply with UU PDP.

For residents of India: If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) grants you the following rights as a Data Principal in relation to your personal data that we process as a Data Fiduciary:

Right to access information about processing (Section 11 DPDPA). You have the right to request the following information from us: (i) a summary of the personal data we hold about you and the ways in which it has been processed; (ii) the identities of all Data Fiduciaries and Data Processors with whom we have shared your personal data, and a description of the personal data shared; and (iii) any other information as may be prescribed by the Central Government. We will provide this information within a reasonable period of receiving your request.

Right to correction, completion, updating, and erasure (Section 12 DPDPA). You have the right to request that we: (i) correct inaccurate or misleading personal data; (ii) complete incomplete personal data; (iii) update personal data that is out of date; and (iv) erase personal data that is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other lawful basis applies. We will action valid requests within a reasonable period.

Right to withdraw consent (Section 6(4) DPDPA). Where we process your personal data on the basis of your consent, you may withdraw that consent at any time. Withdrawal of consent is as easy as giving consent. After withdrawal, we will cease processing your personal data unless another lawful basis under the DPDPA applies. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to grievance redressal (Section 13 DPDPA). You have the right to have your grievances regarding our processing of your personal data addressed promptly. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India (see below).

Right to nominate (Section 14 DPDPA). You have the right to nominate any other individual to exercise your data rights in the event of your death or incapacity. To register or update your nomination, please contact us at privacy@maljoy.io.

Children’s personal data (Section 9 DPDPA). We do not knowingly process the personal data of children (persons under 18 years of age) without obtaining verifiable consent from their parent or lawful guardian. We also do not engage in the tracking or behavioural monitoring of children, or target advertising at children, through the Service. If you are the parent or guardian of a child and believe we may have processed your child’s personal data without appropriate consent, please contact us immediately at privacy@maljoy.io.

How to exercise your rights. To exercise any of the rights listed above, please contact us at privacy@maljoy.io. We will respond to your request within a reasonable period and, in any event, within thirty (30) days. We may need to verify your identity before processing your request.

For residents of the Republic of Turkey: The Personal Data Protection Law No. 6698 ("PDPL") contains the rights of data subjects accessing services from the Republic of Turkey. You have the right to contact the data controller in order to:

- find out if your personal data is being processed

- request information about whether your personal data has been processed

- find out the purpose of processing your personal data and whether this personal data is being used in accordance with said purpose

- find out the third parties to whom your personal data is being transferred within the country or abroad

- request correction of incomplete or inaccurate data, if any

- request the deletion of your personal data in accordance with the conditions specified in Article 7 of the PDPL

- request reports on transactions carried out in certain cases from third parties to whom your personal data has been transferred

- independently object to the occurrence of a result in respect of this individual by analyzing data processed exclusively using automated systems

- claim compensation for damages resulting from the illegal processing of your personal data

For residents of California: The California Consumer Privacy Act ("CCPA") grants California residents the following rights:

The right of access/information. You have the right to request that we provide you with the following information:

- the categories and specific elements of personal data that we have collected about you over the past 12 months

- the categories of sources from which we collect personal data

- the business or commercial purposes for the collection, use, exchange, or sale of personal data

- the categories of personal data that we have disclosed about you for commercial purposes and the categories of recipients to whom they have been disclosed

- the categories of personal data that we have sold or transferred, and the categories of third parties to whom each type of personal data has been sold or transferred

The right to removal. You have the right to request that we delete your personal data under certain circumstances, with some exceptions.

The right to correction. You have the right to require us to correct the personal data we hold about you if you believe it to be inaccurate. We may request the relevant documentation in connection with your request. After receiving and validating a request to correct inaccurate personal data, we will make all commercially reasonable efforts to correct said personal data.

The right of refusal.  We do not sell your personal data. However, in any case, you have the right to opt out of the sale and exchange of your personal data.  

If you wish to opt out of said sale and exchange, other than by using cookies or other online tracking technologies, you can contact us using the methods listed below in the Contact Us section.

The right to non-discrimination. You have the right to not be discriminated against for exercising the rights set out in the CCPA.

If you wish to exercise the above rights or contact us for any other reason, please contact us at privacy@maljoy.io.

Please note that in order to fulfill the request, we may require additional information to identify the person who is contacting us. If the provision of said information may violate the rights and legitimate interests of third parties, we may refuse to provide this information.

To exercise the rights mentioned above, your request must contain the following information:

- your email address

- information confirming that you are associated with us, or information otherwise confirming that we are processing your personal data

- your signature, or your representative's signature

For residents of the European Economic Area (EEA): if you reside in the European Economic Area and believe that we are illegally processing your personal data, you have the right to file a complaint with the local data protection supervisory authority. You can find the contact information here: https://commission.europa.eu/about-european-commission/contact_en.

For residents of the Russian Federation: if you believe that your rights are being violated, you can contact the Federal Service for Supervision of Communications, Information Technology, and Mass Media—Roskomnadzor. You can find the contact information via the following link: https://rkn.gov.ru/contacts.

For residents of Brazil: if you believe that our interaction with your personal data violates applicable law, you can submit a request to the Brazilian Data Protection Authority (ANPD).

For residents of California: if you are a CCPA subject, you have the right to file a complaint with the California Data Protection Agency via their email address: PRA@cppa.ca.gov.

For residents of Indonesia: If you are located in Indonesia and believe that our processing of your personal data violates UU PDP or other applicable Indonesian law, you have the right to lodge a complaint with the competent supervisory authority. Until the dedicated Personal Data Protection Authority (Lembaga Pelindungan Data Pribadi) referred to in Article 58 of UU PDP has been formally constituted and made operational by the Indonesian Government, complaints regarding personal data processing may be directed to the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, “Komdigi”), formerly the Ministry of Communication and Information Technology (Kominfo): https://komdigi.go.id. Complaints portal: https://aduankonten.id.

For residents of India: If you are located in India and believe that our processing of your personal data violates the DPDPA or other applicable Indian data protection law, you have the right to lodge a complaint with the Data Protection Board of India (https://dpboard.gov.in). Under Section 13(2) of the DPDPA, before lodging a complaint with the DPBI, a Data Principal must first allow the Data Fiduciary to resolve the grievance.

Accordingly, we encourage you to contact us first at privacy@maljoy.io so that we can attempt to resolve your concern directly. If you are not satisfied with our response, you may then escalate the complaint to the DPBI.

For residents of the Republic of Turkey: if you believe that your rights are being violated, you can contact the Personal Data Protection Authority. You can find our contact information here: https://www.kvkk.gov.tr/Icerik/6655/Contact-Us.

Thank you for choosing our services!

Best regards,

The MALJOY team