Privacy Policy

Our website karn.la (the “Website”) and the recruitment services provided on it (the “karn.la Service”) are operated by MITTAPHAB INFINITY CONCIERGE SOLE CO., LTD., House no 132, Unit 11, Saphangmor Village, Saysetha District, Vientiane Capital, Lao PDR (“we”, “us”, “our”).

The Website and karn.la Service help people find, advertise, apply for, or express interest in job vacancies, and provide employment-related information. This Policy and our Terms of Use set out the basis on which we process personal data you provide to us or that we collect from you.

By using this Service, you acknowledge that:

• Your profile, professional history, and CV will be shown to registered Employers so they can evaluate your suitability for open positions.
• By providing your contact details (phone, email, etc.), you authorize Employers to contact you directly, solely for recruitment- and employment-related purposes.

When you register or use the Website, we may collect:

• Personal details such as name, address, phone number, email, gender, and date of birth.
• Resume/CV details you make available to Employers.
• Records of correspondence if you contact us.
• Responses to surveys or polls.
• Details of job applications made through the Website.
• Visit data, including traffic data, location data, and web logs.
• Proof of identity requested before we disclose personal information held about you.

karn.la's Customers (Employers) post vacancies. karn.la does not vet or monitor Job Specifications or the terms Employers apply to your personal data.

We use your information to:

• Provide registered Customers with the information you submit in response to a Job Specification (treated as your permission to forward it).
• Present Website content effectively for you and your device.
• Provide information, products, or services you request or that may interest you.
• Notify you of service changes and send updates via email (you may opt out in notification settings).

Under the Law on Electronic Data Protection No. 25/NA, personal data falls into three categories:

• General Data — e.g. name, contact details, employment history — processed as described in this Policy.
• Sensitive Data — e.g. financial information, CV details, medical history — processed only with your explicit consent at the point of submission.
• Prohibited Data — race or ethnic origin, political opinions, religion, sexual orientation, or criminal records. Lao law prohibits the electronic collection, use, or disclosure of Prohibited Data; this cannot be authorized by consent.

We do not request, and you must not submit, Prohibited Data (including ID/passport copies beyond what identity verification strictly requires). If we find Prohibited Data in a CV, profile, or attachment, we will remove or redact it and may suspend the listing until corrected.

We are not a general repository for identity documents. Any ID/passport copy submitted for verification is encrypted at rest, access-restricted, and retained only as long as necessary.

We may disclose your personal information to:

• Any member of our corporate group (subsidiaries and ultimate holding company).
• A prospective buyer or seller of any business or assets.
• A third party where required by law, or to protect the rights, property, or safety of MITTAPHAB INFINITY CONCIERGE SOLE CO., LTD.

We may share aggregated, anonymized user data with third parties for demographic and activity analysis.

Some data may be stored or processed on servers outside Lao PDR (e.g., cloud infrastructure in Singapore). Where we transfer data outside Lao PDR, we do so only:

• With your consent as the Information Owner, obtained at or before collection or transfer; and
• In a manner that does not contravene the national interests or security of Lao PDR, as required by the Law on Electronic Data Protection No. 25/NA.

You are responsible for keeping any password confidential. Transmission over the Internet is never completely secure; any transmission is at your own risk.

Agency Relationship: If you submit information directly to a Customer (Employer), we process it as the Customer's agent. To modify or manage that data, contact the Customer directly — they are responsible for it.

If a data breach or security incident affects your personal data, we will: (i) take reasonable steps to contain and assess it; (ii) notify affected users without undue delay where it is likely to affect their rights; and (iii) where required, report the incident to the Department of Cybersecurity under the Ministry of Technology and Communications (MTC) / LaoCERT, per the Law on Electronic Data Protection No. 25/NA and the Law on Cybersecurity No. 87/NA. Serious violations may be subject to sanctions under the Penal Code No. 26/NA.

We may collect statistical data such as IP address, operating system, and browser type for system administration; this data does not identify you individually.

We use cookies to improve the Website and deliver a personalized experience. You may disable cookies in your browser settings.

Under the Law on Electronic Data Protection No. 25/NA, you have the right to:

• Access — request a copy of the personal data we hold about you (a reasonable admin fee may apply).
• Rectification — request correction of inaccurate or outdated data.
• Deletion — request deletion of data no longer necessary for its original purpose.
• Objection — object to processing for direct marketing or other legitimate-interest purposes.

To exercise these rights, contact us in writing using the details below.

This Policy is governed by the laws of the Lao People's Democratic Republic, including the Law on Electronic Data Protection No. 25/NA (2017), the Law on Electronic Transactions No. 31/NA (2022), the Civil Code No. 55/NA (2018), the Penal Code No. 26/NA (2017), and the Law on Cybersecurity No. 87/NA (2025). The Ministry of Technology and Communications (MTC), through its Department of Cybersecurity and LaoCERT, is the primary supervisory authority.