This Policy explains how hh.md processes personal data, in line with Moldovan Law No. 195/2024 on personal data protection (in force since 23 August 2026, replacing Law No. 133/2011) and the principles of EU Regulation 2016/679 (GDPR).

1. Who processes your data

Controller: P.P.Z. HEADHUNTER SRL, IDNO 1010600007049, MD-2012, Chișinău, 22 Pușkin St., office 337 (Republic of Moldova), owner of hh.md. Privacy contact (responsible person): privacy@hh.md. Site rules are on the Terms of Use page.

2. What we collect

• Account: e-mail, password (encrypted), language, social-network ID if you sign in with one.
• Résumé (job seekers): name, date of birth, sex, photo, phone numbers, e-mail, website, desired position, salary expectations, experience and education.
• Vacancies (employers): company name, contact details, vacancy text.
• Subscriptions: e-mail and notification settings.
• Messages: correspondence between job seekers and employers.
• Payments: transaction history for paid services.
• Technical data: IP address and logs — for security and anti-spam.

3. Purposes and legal bases

• Creating and maintaining your account, providing the service — performance of a contract.
• Publishing résumés and vacancies — consent / performance of a contract.
• Job/résumé alerts (subscriptions) — consent (withdrawable anytime).
• Accounting and payments — legal obligation.
• Security, moderation, anti-spam — legitimate interest.

4. Résumés are public

By publishing a résumé you make it publicly available: visible to employers and visitors and indexable by search engines. You stay in control — you can hide your name and date of birth in the résumé settings, and you can hide or delete your résumé at any time, after which it is removed from the site and the search system.

5. Who we share data with

• Other users — to the extent of the published résumé/vacancy.
• External sign-in provider (Google, Meta/Facebook) — only if you use it.
• Anti-spam (AI) services — OpenAI (USA), Google Gemini (USA), DeepSeek (China): listing text is checked for spam, with e-mails, phone numbers and recognised names stripped before sending; only anonymised text is transmitted, which the providers do not use for training under their API terms.
• E-mail delivery provider — to send subscription notifications.

We do not sell personal data.

6. International transfers

Some providers (Google/Meta sign-in, AI anti-spam checks) are located outside Moldova/EEA (USA, China). Transfers rely on the provider's contractual safeguards (standard data-processing terms) and on minimisation: only the minimum necessary and, where possible, anonymised data is transmitted. The site server and smart search run in the EU (Hetzner) — résumés and accounts are not transferred outside the EU/Moldova.

7. Retention

• Account, résumés, listings, subscriptions — while active or until you delete them ("Delete account"). Accounts with no sign-in and no listings for more than 3 years may be deleted after an e-mail notice.
• Consent log — lifetime of the account + 3 years (proof of consent); the IP address and browser in it are erased after 12 months.
• Technical logs and anti-spam: automatic IP blocks — 12 months; moderation decisions with listing text — 24 months; mailing queue — 30 days; unconfirmed subscriptions — 30 days; web-server logs — at most 30 days.
• Payments and contracts — for the period required by accounting law; anonymised when the account is deleted.

8. Your rights

You have the right to access, rectify, erase, restrict and object to processing, to data portability, and to withdraw consent. How to exercise them:

• Access/copy: in your account — “Download my data”, or request via privacy@hh.md.
• Rectification: edit your résumé/profile in your account.
• Erasure: “Delete account” in your account (deletes the account, résumé, photo and related data; payment records are anonymised and retained as required by law).
• Unsubscribe: the link in the e-mail or by removing the subscription.

We respond within 30 days. If you believe your rights were infringed, you may contact the National Center for Personal Data Protection of Moldova (datepersonale.md).

9. Cookies

We use only necessary and functional cookies (session, language, bookmarked listings). We use no third-party analytics/advertising trackers, so no cookie-consent banner is required.

10. Security

Secured connection (HTTPS), encrypted passwords, restricted access. We apply reasonable technical and organisational measures.

11. Changes

We may update this Policy; the current version is always available on this page.

Effective date: 2026-10-31.