Runlink AI HR
V2.0

隐私政策Privacy Policy

适用地区：尼日利亚 ｜ 版本 V2.0 ｜ 生效日期：2026-10-21（发布即生效）Applicable Region: Nigeria ｜ Version V2.0 ｜ Effective Date: 2026-10-21 (effective upon publication)

1. 引言与适用范围

1.1 制定目的

本政策旨在向数据主体说明平台在提供产品和服务过程中，如何收集、使用、存储、共享和保护其个人信息，以及数据主体依法享有的权利及其行使方式。本政策依据《尼日利亚数据保护法》(NDPA, 2023)、《尼日利亚数据保护通则》(NDPR, 2020) 及相关适用法律法规制定。

1.2 适用范围

本政策适用于 Runlink AI HR 平台的全部产品和服务，包括但不限于：主站招聘服务（候选人投递、企业招聘、AI 简历分析、候选人匹配报告）、翻译直聘板块（译员入驻、岗位发布、简历转交）、行业洞察与薪酬报告服务，以及平台网站、页面和系统（以下统称"平台"）。本政策适用于平台的各类数据主体：候选人（求职者）、企业用户、译员、访客，以及平台员工与顾问在处理个人信息时。

1.3 政策约束力与同意

数据主体在使用平台前应当认真阅读本政策。数据主体勾选同意、注册账号、提交简历或资料、或使用平台服务的，即视为已阅读、理解并同意本政策及届时有效的版本。数据主体不同意本政策的，应当停止使用平台；数据主体可随时依据本政策第 6 条撤回同意，撤回不影响撤回前基于同意已开展的处理活动的效力。

1.4 与其他文件的关系

《用户协议》（含《企业入驻协议》与《求职者授权及免责协议》）、《翻译直聘板块服务条款与隐私约定》等文件与本政策共同构成平台规则。上述文件与本政策不一致的，就个人信息保护事项以本政策为准；本政策未尽事宜，按适用法律法规执行。

1. Introduction and Scope

1.1 Purpose

This Policy explains to data subjects how the Platform collects, uses, stores, shares and protects their personal information in the course of providing products and services, and describes the rights of data subjects and how to exercise them. This Policy is prepared under the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Regulation, 2020 (NDPR), and other applicable laws.

1.2 Scope

This Policy applies to all products and services of the Runlink AI HR, including but not limited to: the main recruitment services (candidate submissions, employer recruitment, CV AI analysis, candidate matching reports), the Translator Direct Hire section (translator onboarding, job posting, CV forwarding), industry insights and salary guide services, and the Platform's websites, pages and systems (collectively, the "Platform"). This Policy applies to all categories of data subjects: candidates (job seekers), enterprise users, translators, visitors, and Platform employees and consultants in their processing of personal information.

1.3 Binding Effect and Consent

Data subjects should read this Policy carefully before using the Platform. By ticking consent, registering an account, submitting a CV or profile, or using the Platform's services, a data subject is deemed to have read, understood and agreed to this Policy and its then-effective version. Data subjects who do not agree to this Policy should discontinue use of the Platform; data subjects may withdraw consent at any time under Section 6 of this Policy, and withdrawal does not affect the lawfulness of processing performed before withdrawal.

1.4 Relationship with Other Documents

The Terms of Service (including the Enterprise Onboarding Agreement and the Candidate Authorization and Disclaimer Agreement), the Translator Direct Hire Section Terms and Privacy Notice, and this Policy together constitute the Platform rules. In case of inconsistency between such documents and this Policy, this Policy prevails on matters of personal data protection; matters not addressed in this Policy are governed by applicable laws and regulations.

2. 数据保护官（DPO）信息

平台指定DPO负责NDPA合规、数据删除请求、申诉处理、数据保护问询。

DPO邮箱：aihr@runlink.tech

DPO受理范围

  1. 撤回数据授权、简历删除申请
  2. 账号限流/封禁申诉（企业/候选人）
  3. 个人数据访问、更正请求
  4. NDPA相关合规问询与投诉

2. Data Protection Officer (DPO)

The Platform has designated a DPO responsible for NDPA compliance, data deletion requests, appeal handling and data protection enquiries.

DPO Email: aihr@runlink.tech

DPO Scope

  1. Withdrawal of data consent and CV deletion requests
  2. Appeals against visibility restrictions or account blocks (Employers/Candidates)
  3. Requests for access to, or rectification of, personal data
  4. NDPA-related compliance enquiries and complaints

3. 数据留存时间表

数据类别留存期限
正常求职者简历候选人最后一次活跃（登录/更新/投递）之日起保留6个月，到期自动归档删除，或用户主动申请即时删除
企业合作记录、订单付费记录按尼日利亚税务合规要求保留7年
风控明文身份记录（造假封禁）最长5年，到期清除明文，保留不可逆哈希标记用于拦截
用户协议勾选日志、站内通知、申诉工单保存5年备查

3. Data Retention Schedule

Data CategoryRetention Period
Candidate CVs (normal)6 months from the Candidate's last activity (login/update/application); auto-archived and deleted on expiry, or deleted immediately upon user request
Employer cooperation records and payment orders7 years, as required by Nigerian tax compliance
Plain-text risk-control identity records (verified fraud sanctions)Maximum 5 years; plain data erased on expiry, irreversible hash markers retained for blocking
Agreement tick logs, in-app notices, appeal tickets5 years for audit purposes

4. 我们收集的个人信息

4.1 您直接提供的信息

平台按"最小必要"原则，按不同角色收集下列信息：

  1. 候选人：姓名、性别、国籍、电子邮箱、电话号码、所在城市、当前雇主与行业、应聘岗位/求职意向、工作年限、当前月薪及币种、期望薪资、求职信或自荐说明、上传的简历文件（PDF/Word/Excel）及平台解析出的文本内容、资格证书信息，以及平台顾问在沟通中记录的备注。
  2. 企业用户：企业名称、行业、联系人姓名、电子邮箱、电话号码/WhatsApp、登录口令（以不可逆哈希存储，平台不掌握明文）、企业注册信息（如尼日利亚 CAC 注册号，选填）、发布的岗位需求信息、订单与支付凭证信息。
  3. 译员（翻译直聘）：姓名、联系方式（邮箱/电话/WhatsApp/微信）、性别、国籍、所在城市、语言对、擅长领域、工作履历、教育背景、资格证书、服务方式与报价；选填的出生日期（仅用于成年资格核验及项目背景参考，默认不向企业展示）；为核验目的主动上传的证件影像。
  4. 访客：通过联系表单、问卷调查（如雇主薪酬调研）主动提交的姓名、公司名称、职位、联系方式及问卷答案。

4.2 我们自动收集的信息（含 Cookie）

当数据主体访问或使用平台时，平台自动收集：IP 地址、浏览器类型与版本、设备与操作系统信息、访问时间、浏览页面与点击记录、来路地址；以及下列三类 Cookie 及类似技术数据：

  1. 身份/会话类——登录态令牌，用于保持您的登录状态；
  2. 偏好类——语言选择（存储于浏览器本地 localStorage），用于跨页面记忆您的语言偏好；
  3. 统计分析类——通过 Google Analytics 收集的页面浏览、停留时长、来路与设备统计数据（匿名化用途）。

上述信息的用途与 Cookies 管理详见本政策"重要提示"及第 5 条。您可通过浏览器设置禁用 Cookies，但部分功能可能无法正常使用。

4.3 来自第三方的信息

在下列情形下，平台可能从第三方获取数据主体的个人信息：（a）平台顾问经候选人同意后线下收集并手动录入；（b）数据主体经他人推荐；（c）公开渠道获取的专业信息（如公开的职业资料）。平台对此类信息的处理仍受本政策约束，数据主体可要求平台更正或删除。

4.4 支付信息

平台当前通过对公转账等人工对账方式收款，不收集、不存储银行账号、银行卡号等支付账户完整信息；平台仅保存企业主动上传的付款凭证（转账截图/流水号）及订单金额、开通记录，用于对账与订单履约。

4.5 敏感个人信息

平台仅在确有必要且取得数据主体单独同意后，处理下列敏感个人信息：译员为核验主动上传的证件影像（存放于公开目录之外的隔离存储区，仅授权管理员可查阅）；候选人或译员主动提供的护照信息。平台不主动收集种族、宗教、健康、基因、生物特征等其他敏感个人信息。敏感个人信息的存储期限届满或处理目的实现后，平台将依第 3 条留存时间表删除或匿名化。

4.6 信息的自愿性与拒绝提供的后果

除法律法规另有规定外，数据主体提供个人信息系自愿行为。部分字段标注"选填"的，数据主体可不提供而不影响基本功能；但拒绝提供实现核心功能所必需的信息（如候选人提交简历时的姓名与联系方式），可能导致平台无法提供相应服务。

4. Personal Information We Collect

4.1 Information Provided Directly by Data Subjects

The Platform collects the following information by role, following the principle of data minimization:

  1. Candidates: name, gender, nationality, email address, phone number, city, current employer and industry, target position/job intention, years of experience, current monthly salary and currency, expected salary, cover letter or self-recommendation, uploaded CV files (PDF/Word/Excel) and the text extracted therefrom by the Platform, qualification certificate information, and notes recorded by Platform consultants during communication.
  2. Enterprise Users: company name, industry, contact person name, email address, phone number/WhatsApp, login password (stored as an irreversible hash; the Platform does not hold plaintext), business registration information (such as the Nigerian CAC registration number, optional), job posting details, order and payment proof information.
  3. Translators (Translator Direct Hire): name, contact details (email/phone/WhatsApp/WeChat), gender, nationality, city, language pairs, areas of specialization, work history, education background, qualification certificates, service modes and rates; optional date of birth (used only for adult eligibility verification and project background reference, and not displayed to enterprises by default); identity document images voluntarily uploaded for verification purposes.
  4. Visitors: name, company, job title, contact details and survey responses voluntarily submitted through contact forms and questionnaires (e.g., the employer salary survey).

4.2 Information Collected Automatically (Including Cookies)

When data subjects access or use the Platform, the Platform automatically collects: IP address, browser type and version, device and operating system information, access times, pages viewed and click records, and referral addresses; as well as the following three categories of cookies and similar technologies:

  1. Authentication/session cookies — login tokens that keep you signed in;
  2. Preference cookies — language selection (stored locally in your browser via localStorage), used to remember your language preference across pages;
  3. Analytics cookies — page views, session duration, referral sources and device statistics collected via Google Analytics (for aggregated, anonymized use).

For the use of such information and cookie management, see the "Important Notice" and Section 5 of this Policy. You may disable cookies through your browser settings, though some features may not function properly.

4.3 Information from Third Parties

The Platform may obtain a data subject's personal information from third parties in the following circumstances: (a) collected offline by Platform consultants with the candidate's consent and manually entered; (b) referral by another person; (c) professional information from public sources (such as public professional profiles). The Platform's processing of such information remains subject to this Policy, and data subjects may request correction or deletion.

4.4 Payment Information

The Platform currently collects payments via manual reconciliation methods such as bank transfer, and does not collect or store complete payment account information such as bank account or card numbers. The Platform only retains payment proofs (transfer screenshots/transaction references) voluntarily uploaded by enterprises, together with order amounts and activation records, for reconciliation and order fulfillment.

4.5 Sensitive Personal Information

The Platform processes sensitive personal information only where strictly necessary and with the data subject's separate consent: identity document images voluntarily uploaded by translators for verification (stored in an isolated area outside public directories, accessible only to authorized administrators); passport information voluntarily provided by candidates or translators. The Platform does not proactively collect other sensitive personal information such as race, religion, health, genetic or biometric data. Sensitive personal information is deleted or anonymized in accordance with the retention schedule in Section 3 once the retention period expires or the processing purpose is fulfilled.

4.6 Voluntariness and Consequences of Refusal

Unless otherwise required by law, the provision of personal information by data subjects is voluntary. Data subjects may decline to provide fields marked "optional" without affecting basic functionality; however, refusal to provide information necessary for core functions (such as name and contact details when a candidate submits a CV) may prevent the Platform from providing the corresponding services.

5. 处理个人信息的法律依据

我们基于以下法律依据处理您的个人信息：

  1. 您的同意——包括注册时勾选本政策、授权企业解锁简历、以及提供证件号等敏感信息时的单独勾选；
  2. 为订立和履行与您之间的服务合同所必需——包括为您提供岗位匹配、AI简历分析和招聘对接服务；
  3. 履行法律义务——包括按尼日利亚税务要求保存交易记录、配合NDPC监管；
  4. 合法利益——包括平台风控、防欺诈、账号安全，我们已对此类处理进行利益平衡评估，确保不对您的权益造成过度影响。

5. Lawful Bases for Processing

We process your personal data on the following lawful bases:

  1. Your consent — including accepting this Policy at registration, consenting to CV unlock by Employers, and separate consent for sensitive data such as ID numbers;
  2. Necessity for the performance of our contract with you — including job matching, AI CV analysis and recruitment matching services;
  3. Compliance with legal obligations — including tax record retention and cooperation with NDPC oversight;
  4. Legitimate interests — including platform risk control, fraud prevention and account security, for which we have conducted a balancing test to ensure no disproportionate impact on your rights.

6. 您的权利

在NDPA下，您就您的个人数据享有以下权利，全部可通过DPO邮箱 aihr@runlink.tech 免费行使，我们将在7个工作日内响应，最长不超过30天：

  1. 知情权——了解我们处理您哪些数据、为什么处理、交给谁；
  2. 访问权——获取我们持有的您的个人数据副本；
  3. 更正权——要求更正不准确或不完整的信息；
  4. 删除权——要求删除您的简历和账号数据；
  5. 限制处理权——在特定情形下要求暂停处理；
  6. 数据可携带权——以结构化、常用格式获取您的数据并转移至其他平台；
  7. 反对权——包括反对基于自动化处理（含AI分析）做出的对您有重大影响的决定；AI简历分析报告仅供参考，您有权要求人工复核；
  8. 撤回同意权——随时撤回，撤回不影响撤回前基于同意已开展的处理的合法性。

6. Your Rights

Under the NDPA, you enjoy the following rights in respect of your personal data. All requests are free of charge via DPO email aihr@runlink.tech, and we will respond within 7 working days and no later than 30 days:

  1. Right to be informed — know what data we process, why, and to whom it is disclosed;
  2. Right of access — obtain a copy of your personal data held by us;
  3. Right to rectification — correct inaccurate or incomplete information;
  4. Right to erasure — delete your CV and account data;
  5. Right to restriction of processing;
  6. Right to data portability — receive your data in a structured, commonly used format and transfer it to another platform;
  7. Right to object — including against decisions based solely on automated processing (including AI analysis) that significantly affect you; AI CV analysis reports are for reference only and you may request manual human review;
  8. Right to withdraw consent at any time, without affecting the lawfulness of processing already carried out before withdrawal.

7. 第三方服务提供商

我们仅在必要范围内委托以下类型的第三方服务商处理您的数据：云计算与数据存储服务商、支付处理商、AI简历分析技术服务方（仅按我们的指令完成简历解析与评估，不得留存数据或用于模型训练）、站内信/邮件/短信通知服务商。所有第三方均与我们签署数据处理协议（DPA），仅按书面指令处理数据，不得将您的数据用于任何其他目的，且须采取不低于本政策标准的安全措施。我们不会向任何其他第三方出售、出租或交换您的个人数据。

7. Third-Party Processors

We engage the following categories of third-party processors only to the extent necessary: cloud computing and storage providers, payment processors, AI CV analysis service providers (which process resumes solely on our instructions and shall not retain data or use it for model training), and in-app/email/SMS notification providers. All processors are bound by Data Processing Agreements (DPA), act only on our written instructions, shall not use your data for any other purpose, and must apply security measures no less protective than this Policy. We do not sell, rent or trade your personal data to any other third party.

8. 跨境数据传输

您的个人数据存储于我们的服务器（存储地点：欧洲法兰克福（腾讯云欧洲数据中心，地域 eu-frankfurt））。如任何处理环节在尼日利亚境外进行，我们将严格遵守NDPA第41-43条及GAID Schedule 5的要求，采取经认可的保护措施（包括标准合同条款或取得您的明示同意），并确保境外接收方提供不低于NDPA水平的保护。对于位于尼日利亚境外的个人信息处理活动，我们同时遵守该司法管辖区适用的数据保护法律法规（包括但不限于中国《个人信息保护法》、印度《数字个人数据保护法》等）。简历文本仅发送至第三方AI服务商（DeepSeek/Kimi）做解析，不会用于模型训练。

8. Cross-Border Data Transfers

Your personal data is stored on our servers located in Frankfurt, Germany (Tencent Cloud Europe data centre, region eu-frankfurt). Where any processing takes place outside Nigeria, we strictly comply with Sections 41-43 of the NDPA and GAID Schedule 5, applying recognised safeguards (including Standard Contractual Clauses or your explicit consent), and ensure that overseas recipients provide a level of protection no less than that required by the NDPA. For the processing of personal data of individuals located outside Nigeria, we also comply with applicable data protection laws of that jurisdiction (including but not limited to China's Personal Information Protection Law and India's Digital Personal Data Protection Act).

9. 数据安全

我们采取与风险水平相适应的技术和组织措施保护您的个人数据，包括：全站HTTPS传输加密、证件号等敏感字段存储加密、数据库分级访问权限控制、操作日志留存审计、定期安全评估与漏洞修复。

9. Data Security

We apply technical and organisational measures commensurate with the level of risk, including: HTTPS encryption for all data in transit, encryption of sensitive fields such as ID numbers at rest, tiered database access controls, audit logging, and regular security assessments and vulnerability remediation.

10. 数据泄露通知

如发生可能危及您个人数据安全的泄露事件，我们将在知悉后72小时内向尼日利亚数据保护委员会（NDPC）报告。如泄露可能对您的权利和自由造成高风险，我们将在确认后第一时间通过站内信和/或邮件直接通知受影响用户，说明泄露的内容、可能造成的影响以及您可以采取的保护措施。

10. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will report the breach to the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users directly by in-app message and/or email without undue delay, describing the nature of the breach, its likely impact, and the protective measures you may take.

11. 未成年人

本平台仅面向18周岁及以上的求职者。我们不会明知而收集18周岁以下未成年人的个人信息。如您发现未成年人通过本平台提交了个人信息，请立即联系DPO，我们将在核实后第一时间删除。

11. Minors

This Platform is intended for job seekers aged 18 and above only. We do not knowingly collect personal data from minors under the age of 18. If you become aware that a minor has submitted personal data through the Platform, please contact our DPO immediately and we will delete the data promptly upon verification.

12. 向监管机构投诉

如果您认为我们对您个人数据的处理违反NDPA，除向平台DPO投诉外，您有权直接向尼日利亚数据保护委员会（NDPC）投诉：info@ndpc.gov.ng / www.ndpc.gov.ng。向监管机构投诉是您的法定权利，不影响您通过调解、仲裁或法院等其他法律途径主张权利。

12. Right to Complain to the NDPC

If you believe our processing of your personal data violates the NDPA, in addition to lodging a complaint with our DPO, you have the right to complain directly to the Nigeria Data Protection Commission (NDPC): info@ndpc.gov.ng / www.ndpc.gov.ng. Complaining to the regulator is your statutory right and does not affect your ability to pursue other legal remedies through mediation, arbitration or the courts.

13. 本政策的更新

我们可能不时更新本政策。重大变更将在平台公示，并通过站内信和/或邮件通知您。更新后的政策自公示之日起满14日生效；您在生效后继续使用平台服务，视为接受更新后的政策。

13. Updates to This Policy

We may update this Policy from time to time. Material changes will be published on the Platform and notified to you via in-app message and/or email. The updated Policy takes effect 14 days after publication; your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

← 返回首页← Back to Home