Data security & privacy

MDB Career supports recruitment for PT Media Djaya Bersama, PT Mifa Bersaudara, and PT Bara Energi Lestari. This page covers information submitted by visitors and candidates, along with technical information generated when the portal is used.

The information depends on which features you use:

• Account details such as name, email, verification status, and password hash; passwords are not stored as readable text.
• Candidate profile and application details, including identity and contact details, education, experience, family information, answers, CV, portfolio, certificates, and any assessment or health documents submitted during selection.
• At sign-up, only your name, email, password, and consent are required. Other sensitive profile fields may be left blank then; some become necessary only when you apply or reach a particular selection stage, as indicated by the form.
• Consent choices and signature for access by an assigned prospective supervisor, where applicable.
• Contact messages and chat questions you send. Never send personal information to Raya through chat; enter details requested for recruitment only in the portal’s official forms.
• Session and security information. Visit analytics records a random session key, page path, referral source, visitor role, and country code when available. It does not store account names, email addresses, or raw IP addresses in the visit table: profile usernames and detectable contact details in paths are masked, URL query parameters are omitted, and IP-literal referral hosts are discarded. The random key still links page views within a browser session. IP addresses may be processed separately for security, request limits, country lookup, and server logs.

We use information to create and protect accounts, handle applications and selection stages, communicate about recruitment, respond to support requests, maintain the service, and understand aggregate site usage. Candidate information provided for an account or application is used for recruitment and related communication; it is not sold or distributed for unrelated purposes. Your registration consent records agreement to that use.

Access in the portal follows each role and assignment:

• You can access and edit your own candidate profile. A public professional profile is shown only if you turn on public sharing; identity, family, contact, application answers, and uploaded documents are not placed on that public page.
• Within the company, only authorized recruitment staff can review data needed to manage recruitment. An assigned prospective supervisor receives access only within the permitted workflow and consent scope; identity and family records remain restricted. Your candidate data is not made public unless you enable the separate professional-profile sharing option.
• Service providers for hosting, proxy/security, email delivery, and optional AI features may process information needed to provide those services. Contact us if you need details about a provider or processing location.

The company uses AI for general portal guidance, translation, professional CV excerpts, qualification summaries, and candidate matching. For candidate profiling and matching, only professional information needed for the feature is sent; known candidate names are removed from these requests. Before sending a request, the system excludes structured sensitive fields and filters detectable sensitive content from free text, including birth details, identity numbers, phone numbers, email addresses, home addresses, family details, health and financial information, and credentials. Extracted CV PDF text is also screened for detectable email addresses, phone numbers, home addresses, and dates before it is cached or used in AI prompts; the original PDF remains in private document storage. Candidate website links remain available for manual review. Never send personal information to Raya in chat, because automatic filtering cannot recognize every possible format; use official portal forms for details requested during recruitment. Our data-processing agreement prohibits the provider from using inputs and outputs to train or improve its models or products without permission; limited processing to operate and protect the service may still occur. Authorized staff verify AI results, and people make selection decisions.

We protect your data with password hashing, role-based access, request validation, CSRF protection, request limits, and private storage for uploaded recruitment documents. No internet service can promise absolute security. Use the official HTTPS address before entering a password or uploading documents; if your browser reports an insecure connection, contact us first.

You can update available profile fields in the candidate portal and turn public professional-profile sharing on or off. You may withdraw supervisor-data consent through the profile form; this may affect an active interview workflow. To request access, correction, withdrawal, or deletion of other personal data, use Contact us. We review requests according to applicable law and any records we must retain.

Storage periods depend on recruitment needs and applicable obligations. The portal does not currently offer an automatic account-deletion button; requests are reviewed by the team. If this policy changes, the updated version and date will appear on this page.

Report suspected unauthorized access, an incorrect record, or a privacy concern through Contact us. Include enough detail to identify the issue, but do not send passwords, verification links, or identity documents in the first message. The team will assess and respond according to the applicable requirements.