MidCareer Privacy Policy

MidCareer is committed to protecting the privacy, professional identity and personal information of every registered user.

We believe individuals should control how their career information is presented and shared.

This Privacy Policy explains what personal data we collect, why we use it, who may receive it, how long we retain it and how users may exercise their privacy rights.

Depending on the features used, we may collect:

A. Account information

• Name and preferred professional name.
• Email address and telephone number.
• Country and general location.
• Login credentials and authentication information.
• Account preferences and language settings.

B. Career information

• Education history.
• Professional qualifications and certifications.
• Employment history and previous positions.
• Skills, competencies and achievements.
• Résumés, portfolios and professional documents.
• Employment preferences and availability.
• Professional references.

C. Career Identity and verification information

• Career Identity Number (CIN).
• Verification status and supporting evidence.
• Academic and certification verification responses.
• Professional-reference verification outcomes.
• Identity verification records where required.

D. Recruitment information

• Job applications.
• Interview invitations and scheduling information.
• Employer communications.
• Application progress and outcomes.
• Candidate preferences and employer interactions.

E. Technical information

• Device identifiers and app version.
• Operating system and browser information.
• Authentication and security logs.
• IP addresses.
• Application usage and performance information.
• Crash reports and diagnostic information.

F. Optional information

• Profile photographs.
• Training participation.
• Certification results.
• Seminar registration records.
• AI career-assistance interactions.

Information is collected only where relevant to an identified and lawful purpose.

We may collect personal information:

1. Directly from users during registration and profile updates.
2. When users apply for employment opportunities.
3. Through authorized career verification requests.
4. From connected services expressly authorized by users.
5. From participating employers and training providers.
6. Through necessary technical and security operations.
7. From universities or professional institutions where a lawful basis exists.

We do not automatically import private social-media information without an appropriate legal basis.

We process information to:

• Create and maintain user accounts.
• Provide career-development services.
• Enable recruitment applications and employer communications.
• Help candidates find relevant opportunities.
• Support professional identity and credential verification.
• Generate user-requested résumés or career materials.
• Support seminars, certifications and professional development.
• Detect fraud and improve platform security.
• Provide technical support.
• Meet applicable legal and regulatory obligations.
• Improve the reliability and functionality of our services.

Where applicable data protection law requires a legal basis, processing may rely on:

• Performance of a contract with the user.
• Legitimate interests, where permitted and appropriately balanced.
• Compliance with legal obligations.
• Consent for specified activities requiring consent.
• Other lawful grounds recognized by applicable legislation.

Users may withdraw consent where processing is based on consent, without affecting lawful processing already undertaken.

Withdrawal of consent may limit access to features requiring that processing.

MidCareer uses a privacy-first approach.

A candidate's profile is not publicly searchable by default.

Depending on available settings and permissions, users may choose to disclose specified career information to authorized employers or recruitment partners.

An employer may receive information when a user applies for a position or otherwise authorizes disclosure.

Sensitive identity-verification records, such as passport images, are not automatically included in ordinary professional profiles.

Employer access is limited according to role-based permissions and applicable contractual restrictions.

A CIN serves as a reference to career identity records within the platform.

Possession of a CIN does not automatically permit access to the person's private documents.

Where a verification service is offered, the information disclosed should be limited to the authorized verification result or fields necessary for the particular request.

Verification evidence is not made publicly available without a lawful basis.

Users may request correction of inaccurate identity or qualification information.

MidCareer may use automated systems to assist with résumé drafting, career recommendations, opportunity matching and professional development.

The information used depends on the particular service requested.

We do not authorize AI systems to invent qualifications or professional achievements.

AI recommendations are not guaranteed to be accurate and should be reviewed by users.

Where automated processing produces legal or similarly significant effects, we will provide applicable transparency, contestation and human-review rights.

Personal information will not be used to train external general-purpose AI models without an appropriate legal basis, notice and required permissions.

We may disclose relevant personal information to:

• Employers to whom candidates apply.
• Authorized recruitment partners.
• Universities or professional bodies conducting authorized verification.
• Contracted cloud hosting and IT service providers.
• Authentication, communications and security providers.
• Payment providers for optional paid services.
• Regulators or authorities where legally required.
• ERP Tohama Group entities involved in operating the services.

Each disclosure must have a legitimate purpose and applicable legal basis.

Service providers must be subject to appropriate confidentiality and data protection obligations.

We do not sell candidate personal information to third-party data brokers.

MidCareer may support opportunities and services across multiple countries.

Where personal information is transferred internationally, the relevant operator will implement appropriate legal, contractual, organizational and technical safeguards required by applicable laws.

Additional disclosures or consent will be provided where required.

A user's employment application to an overseas employer may involve an authorized transfer of relevant application information.

We implement appropriate security controls intended to protect personal information, including access restrictions, secure transmission, account authentication, monitoring and organizational safeguards.

Access to sensitive verification documents should be restricted to authorized personnel and systems.

No digital service can guarantee absolute security.

Users should protect their login credentials and promptly report suspected account misuse.

Personal information is retained only as long as necessary for the stated purposes, legitimate operational needs and applicable legal obligations.

Active account information is generally retained while an account remains active.

Application records, verification evidence, communications and security records may have different retention periods.

The operator must maintain a documented retention schedule identifying the relevant periods or determining criteria for each category.

Where information is no longer required, it will be deleted, anonymized or otherwise securely disposed of in accordance with applicable requirements.

Depending on applicable law, users may have the right to:

• Access personal information.
• Correct inaccurate data.
• Request deletion.
• Restrict or object to processing.
• Withdraw consent.
• Request data portability.
• Obtain information about certain international transfers.
• Request human review of qualifying automated decisions.
• File complaints with an appropriate data protection authority.

Requests may be submitted through the app or the published privacy contact.

Users can initiate account deletion through the app's account settings.

An external account deletion page is also provided.

Upon a valid deletion request, we will delete or de-identify associated personal data unless retention is required or otherwise lawfully justified.

Any retained records will be protected and used only for their limited lawful purpose.

For more information, see the MidCareer Account and Data Deletion Policy.

Users may receive essential communications concerning account security, applications and platform services.

Optional promotional communications will be managed in accordance with applicable consent and opt-out requirements.

Users may unsubscribe from optional marketing without losing access to essential account services.

Our websites and applications may use strictly necessary technologies for authentication, security and performance.

Optional analytics, advertising or tracking technologies will be disclosed and managed according to applicable consent and platform requirements.

Users may control available preferences through the relevant settings.

The categories and third-party technologies actually deployed must be described in the applicable Cookie and Tracking Notice.

MidCareer is intended primarily for adults entering or participating in the professional employment market.

The service is not intended for children under 18 unless a separately authorized service is implemented with required safeguards.

We do not knowingly collect children's personal information outside a lawful and authorized service.

This Policy may be updated when services, data practices or legal requirements change.

Material changes will be notified where required, and additional consent will be requested when legally necessary.

Data Controller: [Registered Legal Entity]
Registered Address: [Address]
Privacy Contact: Contact Privacy Support
Website: This website

Users may raise privacy concerns directly with the operator or with their competent data protection authority.