Smartup Holding Limited
Powered by Avery
Back to jobs

Privacy

Privacy notice for applicants

Version 4 · published October 28, 2026

This notice explains how your personal data is handled when you apply for a job at Smartup Holding Limited (MChJ «GREEN WHITE SOLUTIONS») through this site: who is responsible for it, what data is used and why, how AI helps with screening, how long the data is kept and what your rights are.

1. Who is responsible for your data

MChJ «GREEN WHITE SOLUTIONS» decides how your application data is used. Under the Law of the Republic of Uzbekistan No. ZRU-547 of 2 July 2019 “On Personal Data” (the “Law”), it is the owner of the applicant database.

  • Company: MChJ «GREEN WHITE SOLUTIONS»
  • Address: Beshyogʻoch dahasi, 22, Shayxontohur tumani, Toshkent, Uzbekiston
  • Responsible for personal data processing: Abdukakhkhor Tashmukhamedov
  • Email for privacy requests: info@greenwhite.uz

The careers site and the recruiting software are provided by Avery B.V., a company registered in the Netherlands. Avery processes your data as an operator on the company's behalf, only on its instructions, and does not use it for its own purposes.

2. What data is used

The data you give when you apply:

  • Your name and email address.
  • Your CV, if you attach one, and everything in it.
  • Other fields the application form asks for, such as your phone number, a link to your LinkedIn profile, city, cover letter, expected salary or possible start date, and your answers to the vacancy's questions.

Data created during the selection:

  • The AI summaries and evaluations described in section 4, and the information AI extracts from your CV (for example work history, skills and contact details).
  • If the company phones you with Avery's AI assistant (section 4): the text of the conversation and Avery's summary of it.
  • Notes, ratings, tags and decisions by the company's recruiters.
  • A record of the boxes you ticked when applying: the version of this notice, the date and time, your IP address, your browser details (user agent) and how you reached the vacancy (for example the link you followed).

The company does not ask for special categories of data (such as health, religion, political views or criminal record), photos, passport or other ID numbers (including PINFL), date of birth, nationality or family status. Please leave these out of your CV and answers. Photos, faces and voices are never analysed.

If the company sends you an online test with the camera on, the camera takes a selfie before the test and snapshots during it. They are used only to see how the test was taken; no photo of an ID document is taken. The selfie and the snapshots are kept in Avery's storage in the European Union (Amazon Web Services, Frankfurt, Germany) and deleted automatically within 30 days of the test link being created.

3. Why the data is used and on what legal basis

  • To consider your application for this vacancy and to take the steps before a possible employment contract that you ask for by applying. Basis: your consent given on the application form, and steps before a contract at your request (Article 18 of the Law).
  • To keep you in the talent pool and consider you for other vacancies, only if you tick the talent pool box. Basis: that separate consent.
  • To answer your requests and to protect the company's rights if there is a dispute about the selection. Basis: the company's legal obligations and legitimate interests.

The company entrusts the processing to Avery B.V. and to the sub-processors named in section 7, with your consent, which you give by ticking the box on the application form (Article 31 of the Law).

Giving your data is voluntary, but without the required fields the company cannot consider your application.

4. How AI helps with screening, and why a person decides

The company uses Avery's AI tools to help its recruiters review applications:

  • When you apply, AI checks that the file is a CV, reads your CV and answers, and prepares a short pre-screen: whether your application appears likely, possibly or unlikely to match the vacancy's requirements, with the reasons. If the vacancy has screening questions that require a particular answer, answers that do not match are marked.
  • If the company takes your application further (section 5), AI makes a more detailed evaluation of your profile for the role, with a match score.
  • The company may phone you about this application on the number you gave. Avery's AI voice assistant makes the call: it says that it is an AI, asks whether it is a good time to talk, clarifies details of your application and explains the next step. You can decline, end the call or ask not to be called again. What you say is turned into text; your voice is not recorded or analysed. The text of the conversation and Avery's summary of it are kept for up to 180 days, or less if your application's data is deleted earlier; a person reads them and decides what happens next.

These results are advice for the recruiters, not decisions. No application is rejected or moved to another stage automatically: a person makes every decision about you, and the system records who made it. Under Uzbek law, decisions that affect your rights may not be based on AI conclusions alone (Article 7¹ of the Law of the Republic of Uzbekistan No. 560-II of 11 December 2003 “On Informatization”).

You can ask how the assessment was made, object to an AI result and ask for a person to review your application again. The company replies in writing within 10 days (Article 24 of the Law).

5. If the company takes your application further

If the company decides to take your application further, it becomes a candidate record in the company's own Avery workspace. There, the company's recruiters, its search tools and Avery's AI sourcing assistants working for the company may also consider you for its other vacancies, until your data is deleted (section 8).

Your data stays within the company's workspace: it is never shared with other companies that use Avery and never used to train AI models.

6. Talent pool

If you tick the talent pool box, your profile is added automatically to the company's candidate database in Avery after you apply, together with the date and time of your consent and the date the pool period ends: 365 days after your consent. Until then, the company's recruiters, its search tools and AI sourcing assistants may consider you for other vacancies.

You can withdraw this consent at any time (section 9); your profile then leaves the pool. Saying no, now or later, does not affect your application for this vacancy.

7. Where your data is stored and who helps process it

Applicant data, including CV files and search indexes, is stored in the European Union, in Frankfurt, Germany, on Amazon Web Services (region eu-central-1) and MongoDB Atlas.

Uzbek law allows personal data to be stored and processed outside Uzbekistan in countries that ensure adequate protection of personal data, as listed by the Cabinet of Ministers (Article 27¹ of the Law; Resolution of the Cabinet of Ministers No. 415 of 29 July 2026). Germany, where the data is stored, and the Netherlands, where Avery B.V. is registered, are both on that list; the United States is on it only for companies that take part in the EU-U.S. Data Privacy Framework. By ticking the box on the application form you also agree to this cross-border transfer (Article 15 of the Law).

Avery uses these service providers (sub-processors) for the company:

  • Microsoft (Azure OpenAI Service): AI models that check and read CVs, prepare the pre-screen and make the more detailed evaluation after the company takes an application further.
  • Voyage AI: matching candidate profiles to roles.
  • ElevenLabs: the voice of Avery's AI assistant on a phone call and turning what you say into text (section 4); the call is not recorded. What the assistant says and the summary of the conversation are written by the Microsoft models above.
  • Twilio: the phone line for these calls.
  • Inngest: runs these automated steps; it receives only technical identifiers, not the content of your application or your contact details.
  • Loops: sending emails about your application.
  • Cloudflare: spam protection on the application form (Turnstile).
  • Railway: hosting Avery's application servers and background processing.
  • Amazon Web Services: storing CV files (Amazon S3).
  • MongoDB (MongoDB Atlas) and Amazon Web Services: hosting Avery's database and search index, at the locations stated above.
  • PostHog (EU hosting): product analytics; it receives no personal data from your application.

Microsoft, Voyage AI (part of MongoDB), ElevenLabs, Twilio, Loops, Cloudflare, Railway, Amazon Web Services, MongoDB and PostHog are US companies that take part in the EU-U.S. Data Privacy Framework, and Avery uses them on that basis. Inngest, also a US company, does not take part in it and receives no personal data from your application beyond the technical identifiers described above.

8. How long your data is kept

Your data is deleted automatically from the careers database, file storage and search index and, if your application was taken further, from the company's Avery workspace:

  • 180 days after the company rejects your application.
  • 180 days after the vacancy closes, if your application is still open then.
  • 180 days after you are hired. The company keeps what it needs for your employment in its HR records, under separate rules.
  • 72 hours after you withdraw your application or your consent to this application.

If you joined the talent pool and the pool period (365 days after your consent) ends later than these dates, your data is kept until the pool period ends, unless you withdraw your pool consent earlier.

While the vacancy is open and your application is being considered, your data is kept until one of these events happens. If there is a legal dispute about your application, the data may be kept until the dispute is resolved. Data is not kept longer than these purposes require or than your consent allows (Articles 10, 17 and 19 of the Law).

Some technical copies are outside the automatic deletion. The email sending logs (Loops) expire under that provider's own retention period, and the run history of the workflow engine (Inngest) holds only technical identifiers, not the content of your application. Text about you in the company's conversations with Avery's AI assistant, or in notes the assistant saved, is not deleted automatically; the company can remove it at your request.

9. Your rights

Under the Law you can:

  • Find out what data about you is processed, for what purposes, how and by whom, and get a copy.
  • Have inaccurate or incomplete data corrected. The company corrects it within 3 days of your request.
  • Ask for the processing to be paused if your data is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed.
  • Ask for your data to be deleted, or withdraw your application.
  • Withdraw your consent at any time. Withdrawing your talent pool consent does not affect your application.
  • Object to an AI result and ask for a person to review your application. The company replies in writing within 10 days.
  • If you are not hired, ask for the reasons in writing. The company gives them within 3 days of your request (Article 119 of the Labour Code).

To use these rights, write to info@greenwhite.uz. Please write from the email address you applied with, so that the company can confirm the request is yours. Requests for information or a copy of your data are answered within 10 days.

10. Complaints

If you believe your data is handled unlawfully, you can complain to the authorised state body for personal data or go to court. You can also write to the company first at info@greenwhite.uz.

11. Changes to this notice

This notice has a version number and a publication date, which are shown with it. If the company changes how it handles applicant data, it publishes a new version. The version in force when you applied is recorded with your application.