Privacy Notice for Job Applicants

In this notice “MTN”, “we”, “our” and “us” refers to MTN Rwandacell PLC and its subsidiaries. We are committed to protecting and respecting your privacy. This Job Applicant Privacy Notice describes our commitments to the fair and transparent processing of your Personal Data, including your privacy rights in relation to the Personal Data we Process. 

MTN is committed to being transparent with you regarding the collection and Processing of your Personal Data (including Sensitive Personal Data). This is not intended to be an exhaustive list of Personal Data / Sensitive Personal Data that MTN may Process and all potential purposes for Processing. Instead, it indicates the typical Personal Data Processed in the recruitment context and the general purposes of such Processing. 

MTN will endeavor to inform you if we intend to Process your Personal Data (including Sensitive Personal Data) for any additional purposes prior to collecting or Processing that Personal Data.   

Who does this notice apply to?

This notice applies to any person, other than an independent contractor, who applies for employment with MTN whether for a permanent, temporary or fixed-term contract (hereinafter referred to as “MTN Job Applicants” / “you” / “your”). This notice applies to MTN Job Applicants whether they apply for a position directly with MTN or indirectly through, for example, a recruitment agent.

What are the important terms we need to understand when reading this notice?

Applicable Data Privacy Law(s)	Law No 058/2021 of 13/10/2021 Relating to the Protection Of Personal Data And Privacy. .
Local Regulatory Requirements	Legal, statutory, regulatory, license conditions rules, guidelines, Ministerial/National Security orders or directives, and Directives relating to Public safety (where applicable) and Data Sovereignty*-related requirements with which MTN is required to comply by applicable authorities in the jurisdictions in which MTN operates. *“Data Sovereignty” relates to the laws and governance structures that Personal Data is subject to, due to the geographical location of where it is Processed.
Personal Data	Mean any information  relating to an identified or identifiable  natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a  name. an identification number location data an online identifier or to one or more factors specific to the physical psychological genetic, mental, economic, cultural or social identity of that natural person.
Personal Data Breach	Means an event or occurrence (including but not limited to a breach of security) leading to the accidental or unlawful destruction, loss or damage, alteration, disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
Processing	Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, receipt, recording, organisation, structuring, collation, storage; adaptation or alteration, updating, retrieval, consultation, use, dissemination, disclosure by means of transmission; or otherwise making available, alignment or combination, merging, restriction, erasure, destruction, and/or degradation.
Sensitive Personal Data	Information revealing a person’s race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life or

What Personal Data does MTN collect and use?

We Process Personal Data which is required in terms of our internal recruitment processes. This information is obtained  from submitted Curriculum Vitaes  whichtypically includes, but is not limited to, your name, current title and position, professional employment history, language skills, experience, qualifications, contact details, , results from personality or cognitive ability tests, opinions of others about you (example through referees) and professional certificates. 

We also Process electronic identification data to the extent that you apply through our web-based application portal (e.g., login information, online identifiers/cookies) or when you use an electronic signature to complete any necessary forms.

What Sensitive Personal Data does MTN Process?

In some cases, the Personal Data of MTN Job Applicants who are successfully we collect the following information will also include Sensitive Personal Data, such as:

• Name
• Date of Birth
•  Phone Number
• Email
• Next of Kin information
•  Physical Address
• Medical History.

Where does MTN collect my Personal Data from?

In most circumstances, we collect Personal Data directly from you, for example, when you complete your information on our website career portal, send us your curriculum vitae and where you provide information about yourself during interviews. 

In some cases, MTN will also collect Personal Data indirectly from third parties, such as:

• other entities within the MTN group if you transferred to us from that MTN entity; 

For what purposes does MTN use my Personal Data?

MTN is committed to only Process Personal Data for specified, explicit and legitimate purposes related to its business activities. 

We Process Personal Data of MTN Job Applicants to assess your suitability for a role within MTN in accordance with our recruitment and selection policies and procedures and, if the application is successful, for the execution of the employment relationship. If you are unsuccessful in the role you applied for, we continue to store your Personal Data for a limited period to maintain a record of the recruitment process should the fairness of the process be contested by an unsuccessful MTN Job Applicant.

We may also request to retain your Personal Data for consideration of any other suitable positions that may become vacant in the future. If you consent to this, we may proactively contact you in respect of any suitable vacancies that arise. 

MTN will not further Process Personal Data for any purpose that is incompatible with the original purpose that the Personal Data was collected for unless:

• such further Processing is authorised in terms of Applicable Data Privacy Laws;
• we have obtained your consent to the further Processing.
• the further Processing is necessary to comply with an obligation imposed by Local Regulatory Requirements or for conducting proceedings in a court or tribunal; or
• It is for scientific or historical research purposes or statistical purposes.

Is MTN allowed to Process my Personal Data and Sensitive Personal Data?

We are allowed to Process Personal Data, so long as we have a legal basis to do so. When we Process your Personal Data, we will rely on one of the following legal basis as appropriate having regard to the purpose of Processing:

Legal Basis	Examples
Processing of Personal Data is necessary in order to carry out actions necessary for the conclusion of a contract (i.e. employment contract) to which you are or may be a party.	To verify the Personal Data provided by you during the job application process before entering into an employment contract. To agree on the terms and conditions of your employment prior to entering into an employment contract with you.
Processing of Personal Data is necessary in order to comply with legal obligations, such as Local Regulatory Requirements, to which MTN is subject to.	To comply with Regulatory Requirements (i.e. labour laws) applicable to recruitment of MTN Job Applicants. To comply with laws which seek to achieve a diverse workforce, which promote recruitment of local nationals or which promote employment opportunities for certain categories of persons.
Processing is necessary for pursuing the legitimate business interests of MTN or of a Third Party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of Personal Data.	Preventing fraud or criminal activity and to safeguard our IT systems, assets, and places of work. To benefit from cost effective services (e.g., We may opt to use certain IT platforms offered by suppliers) or share basic Personal Data with another MTN group entity if you transfer to that entity, for use by that entity in conducting legally required background checks without collecting the information from you again). To support in our decision making we may obtain information which is publicly available on professional social networks such as LinkedIn, to maintain a record of the recruitment process should the fairness of the process be contested by an unsuccessful MTN Job Applicant
You have given consent to the Processing of your Personal Data for one or more specific purposes. You may withdraw such consent at any time.	We will only Process your Personal Data in this way if you agree to us doing so (for example performing reference checks or verifying your qualifications).  We will ensure the purpose for Processing your Personal Data is clearly communicated at the time that we request your consent so that you can make an informed decision. We will also provide you with any other relevant information you require to make an informed decision.

When we Process your Sensitive Personal Data, we will rely on one of the following legal basis as appropriate having regard to the purpose of Processing:

• You have given explicit consent to the Processing of your Sensitive Personal Data for one or more specified purposes (for example when performing background checks). You may withdraw such consent at any time;
• Processing is necessary for the purposes of carrying out the obligations and exercising your or MTN’s specific rights in the field of employment, social security and social protection law;
• Processing relates to Sensitive Personal Data which was intentionally made public by you;
• Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Is it mandatory to provide MTN the Personal Data asked for?

It is voluntary to apply for a job with MTN. However, if you choose to apply for a job with MTN, the provision of the Personal Data requested is a requirement of our recruitment process to ensure we are able to assess each candidate fairly. Failing to provide the Personal Data requested may result in us being unable to fully assess your suitability for the position applied for and being unable to offer you the position within MTN. You are responsible for determining the nature and extent to which you share your Personal Data with MTN and acknowledge that you may share Personal Data that MTN has not specifically requested during the recruitment process (for example where you have disclosed your hobbies in your CV). 

Does MTN Process my Personal Data automatically?

MTN Rwanda does not perform any automated decision making (including profiling) which results in legal consequences for you and/or which affects you in a similarly significant manner. Should this change in the future, we will notify you and update this privacy notice accordingly.

How long does MTN keep my Personal Data for?

We make reasonable efforts to retain Personal Data only for so long as:

• the Personal Data is necessary to comply with our obligations to you in terms of our job application process, policies and procedures; and/or
• is necessary to comply with legal, regulatory, or internal policy requirements that may apply;
• is necessary to evidence the fairness of the recruitment process should it be contested by an unsuccessful MTN Job Applicant within a reasonable period of time.

The retention of MTN Job Applicants’ records will be in accordance with our retention policies and retention schedule. These policies or relevant extracts may be requested by job applicants  by contacting the DPO whose details are contained below. 

Does MTN transfer my Personal Data to third parties?

Yes, we may share Personal Data with third parties, as necessary for our legitimate business needs, to carry out your requests, and/or as required or permitted by the

Law No 058/2021 of 13/10/2021 Relating to the Protection Of Personal Data And Privacy Requirements and Applicable Data Privacy Law(s). This may include, but not limited to:

• Our service providers: We transfer your Personal Data to our third-party service providers, such as our (IT) systems providers, our hosting providers, our payroll providers, consultants (such as legal advisers) and other services providers. These providers Process your Personal Data on behalf of MTN aim terms of a binding agreement with appropriate security safeguards. MTN will only transfer Personal Data to them when they meet our strict standards on the Processing of data and security. We only share Personal Data that allows our service providers to provide their services and they are not allowed to Process your Personal Data for any other purpose.
• Courts, tribunals, law enforcement, or regulatory bodies: MTN will disclose Personal Data in order to respond to requests of courts, tribunals, government, or law enforcement agencies or where it is necessary or prudent to comply with Local Regulatory Requirements, court or tribunal orders or rules, or government regulations. We will also disclose Personal Data necessary to defend the fairness of the recruitment process.

Does MTN transfer my Personal Data internationally?

Yes, MTNmay transfer Personal Data outside of Rwanda but only if such transfers are permitted in terms of the Privacy Law(s). 

MTN may transfer your Personal Data to other entities within the MTN group of companies. All MTN entities are bound by binding corporate rules which ensures that the MTN entity receiving your Personal Data protects your Personal Data in accordance with those binding corporate rules. 

MTN may also transfer certain Personal Data outside of Rwanda to third parties working with us or on our behalf for the purposes described in this Job Applicant Privacy Notice. When transferring Personal Data internationally to third parties we will ensure your Personal Data will continue to be protected for example, by entering to agreement incorporating clauses which protect your Personal Data or by ensuring there are adequate data privacy laws, which requires the relevant third party to adhere to the data handling and data protection requirements, acceptable to MTN.

How does MTN secure my Personal Data?

MTN secures the integrity and confidentiality of the Personal Data in its possession or under its control by implementing appropriate, reasonable technical, physical, and organisational measures to prevent:

• accidental loss of, damage to, or unauthorised destruction of your Personal Data;
• unlawful or unauthorised access to / dissemination of your Personal Data; and
• unlawful or unauthorised Processing of your Personal Data.

As part of its processes, MTN takes reasonable measures to regularly identify and assess all reasonably foreseeable internal and external risks to Personal Data in its possession or under its control and implements reasonable and appropriate technical, physical and organisational security measures to protect against the identified risks.

How does MTN handle Personal Data Breaches?

While MTN implements reasonable measures to prevent or reduce the likelihood and impact of Personal Data Breaches, this risk can’t be completely eliminated. If MTN becomes aware of or reasonably suspects a Personal Data Breach has occurred or that the integrity or confidentiality of Personal Data has been compromised, MTN adheres to its

Personal Data Breach Incident Management and Notification Guidelines governing the handling and reporting of Personal Data Breaches. This guideline is available to MTN Job Applicants on the [INSERT NAME OF SITE] 

What are my rights?

If MTN Processes Personal Data about you, you have the following rights:

• Right to access personal information :You have the right to make a request for a copy of the personal information that MTN holds about you (including advertising audience categories and inferred information) as permitted by law. 
• Right to correct personal information: You have the right to correct information held about you to ensure it is accurate, relevant, complete, and not excessive.  
• Right to object to use of personal information: You have the right to object to MTN processing your personal information, in certain circumstances as permitted by law. However, in instances where the basis for processing is Legal Obligation, you may not be able exercise your right to object. 
• Right to opt-out of marketing messages: MTN will not issue targeted marketing to you unless you consent for us to do so. If you no longer want to receive marketing messages from MTN, you can choose to opt out at any time using the means made available to you. If you have previously opted in to receive personalized content based on how and where you use our network, you can also opt out at any time.   
• Right to personal data portability: You have the right to request MTN, in writing or electronically to resend the personal data concerning you it was provided to MTN, in a structured and readable format. You also have the right to request the data controller in writing or electronically to have your personal data transmitted to another data controller, where technically feasible, without hindrance. 
• Right to restriction of processing of personal data:You have the right to restrict the MTN from processing your personal data for a given period under the conditions provided by the Law. Note that incase the purpose of collecting and processing your information was to meet our contractual obligation to you, objection to processing may hinder us from providing our services and products to you. 
• Right to erasure of personal data: You have the right to request MTN in writing or electronically for erasure of your personal data under the conditions provided by the Law.
• Withdraw consent: you also have the right to withdraw your consent at any time and we will cease Processing your Personal Data unless there is an alternative legal basis to continue Processing your Personal Data. We will advise you if we intend to continue Processing your Personal Data in these circumstances

You can make a request or exercise these rights by contacting MTN at dataprivacyoffice.rw@mtn.com and we will make all reasonable and practical efforts to comply with your request, so long as it is consistent with Local Regulatory Requirements, Applicable Data Privacy Law(s), and MTN’s internal policies.

Finally, you always have the right to lodge a complaint with the supervisory authority in charge of protecting Personal Data, the National Cyber Security Authority, whose contact details are: 

• Physical Address:21 KG 7 Ave, Kacyiru, Kigali-Rwanda A&P Building, Ground Floor

• Email Address: dpp@dpo.gov.rw

• Telephone number: +250 782 847 756

• Website]https://dpo.gov.rw/

 

Contact us If you have any questions or concerns regarding this Job Applicant Privacy Notice and would like further information about how we protect your Personal Data and/or when you want to contact MTN’s Data Privacy Officer (DPO), please email us at dataprivacyoffice.rw@mtn.com

Changes to privacy policy MTN Rwanda may modify this Job Applicant Privacy Notice from time to time to reflect our current privacy practices. When we make changes to this notice, we will revise the “effective” date and version number at the top of this notice. We will make reasonable efforts to communicate any changes to this Job Applicant Privacy Notice through an appropriate channel, depending on how we normally communicate with you.