Privacy policy & Personal Information Collection Statement

This Personal Information Collection Statement and privacy policy explains what HKjobs Limited (“HKjobs”, “we”, “us”) does with personal data when you use hkjobs.demo, apply for a role through us, or advertise a vacancy with us. It is written to sit alongside the six Data Protection Principles in Schedule 1 to the Personal Data (Privacy) Ordinance (Cap. 486) of the Laws of Hong Kong (the “PDPO”).

Two kinds of people appear in this document. A job seeker is an individual who searches, saves, creates alerts or applies. An employer user is an individual acting for an organisation that advertises vacancies or reviews applicants. Where a rule applies to only one of them, we say so.

If you do not provide the data marked as required at the point of collection, we may be unable to create your account, submit your application to an employer, or publish a listing.

HKjobs Limited is the data user in respect of the personal data described here. Our registered office is 21/F, Harbourpoint Tower, 68 Hoi Yuen Path, Quarry Bay, Hong Kong.

Our Data Protection Officer handles every question, request and complaint about this notice:

• Email — privacy@hkjobs.demo
• Post — The Data Protection Officer, HKjobs Limited, 21/F, Harbourpoint Tower, 68 Hoi Yuen Path, Quarry Bay, Hong Kong
• Telephone — +852 3159 0480, 09:00–19:00 HKT, Monday to Friday

From job seekers

• Identity and contact data — name in English and, if you provide it, Chinese; email address; mobile number; the district you are based in.
• Career data — CV or résumé, employment history, education, skills, language levels, notice period, expected salary, and your answers to an employer’s screening questions.
• Work-rights data — your confirmation that you hold the right to work in Hong Kong, and the visa category if you tell us. We do not ask for your HKID number, and you should never send it to us.
• Activity data — saved jobs, alerts you create, applications you submit, and which listings you viewed while signed in.

From employer users

• Name, work email, job title, telephone number and the organisation you act for.
• Verification data — business registration number and, for employment agencies, the licence number issued under Part XII of the Employment Ordinance (Cap. 57).
• Billing data — billing contact, address and invoice history. Card details are captured by our payment processor and never reach our servers.

From everyone

• Technical data — IP address, device and browser type, and pages requested, collected in server logs for security and performance.
• Cookie data — see section 8. We do not run advertising trackers.

We do not knowingly collect data revealing race, religion, political opinion, health or trade union membership, and we ask employers not to request it. If such data reaches us inside a CV you upload, we treat it as part of the CV and do not index it.

We use personal data for these purposes and no others:

• Operating your account, authenticating you and keeping your session secure.
• Matching and search — ranking listings against your filters, sending the job alerts you asked for, and recommending roles.
• Transmitting applications. When you apply, your CV and screening answers are sent to that employer and to nobody else.
• Publishing aggregate market statistics, including the salary guide. These are derived from listing data and are never re-identifiable to an individual.
• Trust and safety — verifying employers, investigating reports, detecting fraudulent listings and enforcing our terms of use.
• Billing employers, keeping accounting records, and meeting our legal and regulatory obligations in Hong Kong.
• Service messages — application receipts, security notices and changes to this notice. These are not marketing and you cannot opt out of them while you hold an account.

We do not use automated decision-making to reject a candidate. Ranking affects the order in which listings are shown to you; it never removes a human from the hiring decision.

The PDPO requires that personal data be collected for a lawful purpose directly related to a function or activity of the data user, by means that are lawful and fair, and that the data collected be adequate but not excessive (DPP1). Everything in section 4 is a function of operating a job board and an employment agency.

We will not use your personal data for a new purpose that is not the purpose for which it was collected, or a directly related purpose, unless you give prescribed consent (DPP3). Where consent is the basis — direct marketing being the obvious case — you may withdraw it at any time without charge.

We also hold data where we are required to: for example, records required by the Inland Revenue Ordinance and the Companies Ordinance, and records an employment agency is required to keep under Part XII of the Employment Ordinance (Cap. 57).

We do not sell personal data, and we never have. There is no searchable CV database on HKjobs that a recruiter can browse or buy access to. Your data may be transferred to the following classes of transferee:

• The employer you applied to — your application, CV and screening answers, for that vacancy. What they then do with it is governed by their own privacy notice; they are a separate data user.
• Service providers acting on our instructions — hosting, email delivery, error monitoring, payment processing and customer support tooling. They may process data only as we instruct and must keep it secure.
• Professional advisers — auditors, lawyers and insurers, where necessary and under a duty of confidence.
• Authorities — where we are required to disclose by law, court order or a lawful request from a Hong Kong regulator, including the Labour Department and the Privacy Commissioner for Personal Data.
• A successor — if HKjobs is acquired or reorganised, under confidentiality terms and with notice to you.

The PDPO regulates direct marketing specifically. We will not use your personal data in direct marketing, and will not provide it to any other person for use in direct marketing, unless we have told you what we intend to use and you have consented.

In practice this means: opt-in, per channel, at sign-up or later — never a pre-ticked box. Every marketing email carries an unsubscribe link that works in one click, and we act on the request without charging you.

Job alerts you created yourself are not direct marketing. They are the service you asked for, and they stop when you delete the alert. Service messages about an application in progress are likewise not marketing.

We set three kinds of cookie:

• Strictly necessary — your signed-in session, security tokens and load balancing. These cannot be turned off without breaking the site.
• Preference — your light or dark theme choice, your language, and filters you asked us to remember.
• Analytics — aggregate page and search statistics, collected with the visitor identifier truncated so we cannot tie a session back to an individual.

We do not use advertising, retargeting or cross-site tracking cookies, and we do not embed third-party social widgets that would set them.

DPP4 requires practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. Our measures include encryption in transit and at rest, access on a least-privilege basis with individual accounts and mandatory two-factor authentication for staff, logged access to candidate records, annual penetration testing, and a documented breach response process.

No system is perfect. If a breach is likely to cause you real harm, we will tell you and consider notifying the Privacy Commissioner for Personal Data, in line with the Commissioner’s guidance.

DPP2 requires that personal data is not kept longer than necessary for the purpose it was collected for. Our schedule:

• Account profile and CV — until you delete the account, then 30 days in case the deletion was a mistake.
• Applications and related messages — 24 months from the last activity on that application, so both sides can evidence what was said.
• Job alerts and saved jobs — until you delete them, or 12 months after your last sign-in.
• Server and security logs — 12 months.
• Encrypted backups — purged on a rolling 90-day cycle.
• Employer billing records — seven years, as required by Hong Kong tax and company law.

Our production systems are hosted in Hong Kong. A small number of processors — error monitoring and email delivery — operate outside the HKSAR, principally in Singapore and the European Union.

Where personal data is transferred outside Hong Kong we impose contractual terms modelled on the recommended model clauses published by the Privacy Commissioner for Personal Data, so that the data continues to receive a level of protection comparable to that under the PDPO.

Under the PDPO you have the right to:

• ask whether we hold personal data about you, and to be given a copy — a data access request;
• require us to correct data that is inaccurate — a data correction request;
• withdraw consent to direct marketing at any time, free of charge;
• ask us to erase your account and the data attached to it, subject to the retention periods in section 10.

Send requests to privacy@hkjobs.demo from the address on your account, or by post to the Data Protection Officer. We will respond within 40 days as the Ordinance requires. The PDPO permits a data user to impose a fee for complying with a data access request provided it is not excessive; HKjobs does not charge one.

You can also export your applications, saved jobs and alerts yourself, at any time, from account settings — no request needed.

HKjobs is intended for people aged 18 and over. We do not knowingly create accounts for anyone under 18, and listings that would engage the restrictions on youth employment under the Employment of Children Regulations and the Employment of Young Persons (Industry) Regulations are not accepted.

If you believe someone under 18 has created an account, tell the Data Protection Officer and we will remove it.

We update this notice when what we do changes. The last-updated date at the top always reflects the current version, and we keep the previous two versions available on request.

Where a change materially affects how we use your personal data, we will email account holders at least 14 days before it takes effect. If the change requires your consent under the PDPO, we will ask for it rather than assume it.

Start with our Data Protection Officer — most issues are a misunderstanding about what an employer can see, and are resolved the same day.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, which supervises compliance with the PDPO and can investigate a data user’s handling of personal data.

If your complaint concerns the conduct of an employment agency, the Employment Agencies Administration of the Labour Department is the relevant body.