Privacy Policy

PRIVACY POLICY

h.work round1

Version 1.0 | Last updated: [Date]

We are committed to protecting your security and privacy and take our obligations to protect your information seriously. This Privacy Policy explains what personal data we collect about you, how and why we use it, who we disclose it to, and how we protect your privacy.

About us

We are Human Work Ltd., a company incorporated in the British Virgin Islands with company number 2208035 and registered office at Vistra Corporate Services Centre, Wickhams Cay II, Road Town, Tortola, VG1110, British Virgin Islands (“we”, “us” or “our”).

This Privacy Policy applies to the collection, use and management of personal data by or on behalf of Human Work Ltd. and its affiliates and subsidiaries (collectively, the “Group”).

Our recruitment platform, h.work round1 (the “Platform”), uses artificial intelligence to conduct chat- and video-based interviews with job Candidates on behalf of our Clients, generating transcripts, evaluation outputs, and (as part of the standard service) Behavioural Analysis of non-verbal cues.

We are committed to complying with applicable privacy laws (“Privacy Laws”), which may include:

•Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and the six Data Protection Principles;

•EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”);

•UK General Data Protection Regulation and the UK Data Protection Act 2018 (“UK GDPR”);

•California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”);

•Virginia Consumer Data Protection Act, Colorado Privacy Act and other applicable US state privacy laws; and

•any other privacy laws in jurisdictions in which we operate or offer our services.

By providing us with personal data or using our products and services, you agree that we may collect, use and disclose your personal data in accordance with this Privacy Policy. If you disagree with the terms of this Privacy Policy, please do not submit personal data to us or use our products and services.

About you

How this Privacy Policy applies to you depends on the capacity in which you access our Platform and other goods and services:

General User — you are an employee, supplier or business partner of ours, or a person visiting our website or contacting us about our products or services.

Client — you are an existing, prospective or past Client of ours, or a representative of one. Because our Clients are typically businesses, any personal data we collect is generally about the Client’s representatives.

Candidate — you are applying for a job with one of our Clients via the Platform. The Platform processes your personal data, including by automated means, to assist our Client in assessing your suitability for a role.

**Important — separate notice for Candidates. **If you are a Candidate, the detailed information about how your personal data is processed in connection with your interview is set out in our separate Candidate Privacy Notice available at [Candidate Notice URL]. In that context, our Client (the prospective Employer) is the controller of your personal data and we act as its processor. Where you contact us directly (for example, for support) or visit our website, we act as controller of any personal data you provide.

What personal data do we collect?

Under Privacy Laws, personal data is broadly any information relating to an identified or identifiable natural person. The personal data we collect and use includes:

•your name (including any handle or alias you use);

•your contact details, including phone number, email address and mailing address (which may belong to the business you represent);

•your professional information, such as your job title and employer;

•information you provide to us directly or indirectly by any means; and

•other personal data we expressly refer to in this Privacy Policy.

If you are a Candidate, additional categories of personal data we process (on behalf of the Client as controller) are described in detail in the Candidate Privacy Notice. These include interview content, CV and application materials, transcripts, Behavioural Analysis and evaluation outputs.

When you contact us or use our products and services, we may also collect technical information that may or may not constitute personal data under applicable Privacy Laws. This may include your IP address, location and browser information, and how you interact with our website and Platform. Where required, we will collect this information only with your consent. Our Cookie Policy at [Cookie Policy URL] sets out further detail.

How we collect personal data

Generally, we collect personal data directly from you. However, we may also collect information about you from other sources, as described below.

We collect personal data from you directly:

•when you access or use our goods and services (including our website or the Platform);

•when you or we create an account;

•when you contact us by any means (including by phone, email, social media, instant messaging or via our website);

•when we respond to any contact you make; and

•when you subscribe to news updates, or we contact you (with your consent) for marketing purposes.

If you are a Client, we may also collect your representative’s personal data directly when you book or attend a product demonstration, or when you attend an event hosted by us or a third party.

We may also collect personal data from:

•publicly available sources (for example, LinkedIn or business contact databases);

•our affiliated and related companies; and

•third-party suppliers, partners and contractors who assist us in operating our business.

If you are a Candidate, we may also receive your personal data from our Client (the prospective Employer) and (where applicable) from recruitment agencies or referees, as described in the Candidate Privacy Notice.

If you provide us with personal data about another person, you must ensure that you have obtained that person’s permission to do so and have informed them of this Privacy Policy.

Why do we collect personal data?

We collect personal data for the following purposes (“Permitted Purposes”), based on the lawful bases set out below:

•to enable you to access and use our products and services, including (for Candidates) to complete an interview;

•to respond to your enquiries, complaints, or requests for help or information;

•to manage our relationship with you, including to send you information regarding our Standard Terms, Privacy Policy, Cookie Policy or other legal agreements;

•to administer any account you hold with us, send you communications and notices in connection with your account, and provide product demonstrations;

•to enter into or perform a contract with you;

•to analyse your interactions with our website and Platform to understand and improve the effectiveness of our marketing initiatives and for researching, developing, expanding and improving our products and services;

•to keep and update records and databases for the smooth operation of our business;

•for our internal employment-related purposes, including recruitment and retention; and

•for promotional purposes, which may include (with your consent) posting customer testimonials and comments on our website.

If you do not provide us with personal data, we may be unable to carry out some or all of the Permitted Purposes. For example, if you are a Candidate or are applying for a job with us and do not provide us with personal data, you may not be able to complete the interview process.

Where the GDPR or UK GDPR applies, our lawful bases for processing your personal data are: (a) performance of a contract or pre-contractual steps; (b) compliance with a legal obligation; (c) our legitimate interests in operating and growing our business, where these are not overridden by your rights and freedoms; and (d) your consent, where required (for example, for certain marketing communications). Under the PDPO, we collect and use personal data for purposes directly related to our functions and activities.

How do we use or disclose personal data?

By accessing or using our products and services, or by submitting personal data to us, you agree that we may use or disclose your personal data for:

•the Permitted Purposes;

•any purpose related to a Permitted Purpose that could be reasonably anticipated at the time your personal data was collected (“Secondary Purpose”);

•any purpose to which you otherwise agree; and

•any other purpose required or authorised under Privacy Laws.

Secondary Purposes include:

•sending you direct marketing about our products or services, deals and promotions, subject to your right to opt out at any time;

•conducting customer surveys and monitoring how you interact with us;

•business development and expansion purposes, including mergers, acquisitions and capital raising;

•administrative, management and operational purposes, including statistical analysis, creation of de-identified data, reporting, training of staff and contractors, risk management, and management of legal liabilities and claims (including responding to legal orders, liaising with insurers and obtaining advice from our legal representatives).

How we share personal data

For the purposes set out above, we may share your personal data with:

•in respect of Candidates — with the Client to whom you have applied;

•in respect of Clients — with event organisers and co-presenters (you will be given an opportunity to opt out);

•our group companies, business partners, suppliers and sub-contractors (including our sub-processors) who help us provide our goods and services, including providers of payment gateways, cloud hosting, data analysis, customer support tools, and IT services;

•our foundation model provider (currently Anthropic PBC) and our video interview and behavioural analysis provider (currently Tavus, Inc.), each of which processes personal data on our behalf as a sub-processor;

•regulators, authorities and enforcement agencies where required by law, including for fraud prevention purposes;

•our legal representatives, to enforce or comply with our legal agreements and obligations or to protect the rights, property or safety of any person; and

•prospective buyers of, or investors in, our business, subject to confidentiality undertakings.

We do not sell your personal data.

Is my personal data transferred internationally?

We engage personnel and service providers in a number of jurisdictions. To provide our products and services, we may transfer personal data between our offices and group companies, and to our sub-processors based in the United States, the European Union and other regions.

Where personal data is transferred outside Hong Kong, we take steps consistent with the PDPO and the model contractual clauses recommended by the Office of the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”). Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that has not received an adequacy decision, we (or the relevant Client, as controller) implement appropriate safeguards, including the European Commission’s Standard Contractual Clauses and (where applicable) the UK International Data Transfer Agreement or Addendum.

By providing us with personal data, you agree to us using, storing and disclosing your personal data overseas as set out above. This Privacy Policy applies even when we transfer information outside your country of residence.

De-identified information

In some circumstances, we de-identify your personal data so that it can no longer be associated with you (“De-identified Information”). We may use De-identified Information indefinitely and without notifying you for any purpose, including to improve the Platform, develop new products and services, conduct research (which may be published), and benchmark performance. We may share De-identified Information with third parties, including our suppliers, research partners and service providers, without restriction.

Can you remain anonymous or use a pseudonym?

Where lawful and practicable, we will allow you to use a pseudonym or to choose not to identify yourself. However, if you do not provide us with certain types of personal data, we may not be able to provide you with a product or service, or (if you are a Candidate) you may not be able to complete the recruitment process via the Platform.

Keeping personal data confidential and secure

We take all reasonable steps to secure personal data (whether in hard copy or electronic form) and to protect it against misuse, loss, unauthorised access, modification or inappropriate disclosure. Personal data is kept in secure server environments protected by industry-recognised practices (such as access controls, encryption in transit and at rest where appropriate, and incident response procedures). Only authorised personnel can access our systems.

No system of electronic transmission or storage is fully secure. We cannot guarantee the absolute security of personal data.

Third-party websites and services

Our website and Platform may contain links to third-party websites, platforms or applications (“3P Sites”). Unless a 3P Site is one of our products, we are not responsible for the privacy practices of the owners of 3P Sites. Please read the privacy policy of any 3P Site that asks you to provide your personal data.

Changes to our Privacy Policy

We may change this Privacy Policy from time to time. Any change takes effect when posted on our website with a revised “Last updated” date. Where the change is material, we will provide additional notice (for example, by email or a prominent notice on our website) before the change takes effect. It is your responsibility to review this Privacy Policy regularly. If you disagree with our changes, you must stop using our products and services.

Managing your personal data

You are responsible for ensuring that your personal data is accurate, current and complete. If you believe any personal data we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, please contact us and we will take reasonable steps to correct it.

You may request access to your personal data under applicable Privacy Laws. We may require you to confirm your identity before we grant access. Your access rights are subject to limitations set out in the relevant law.

Where permitted by applicable law, we may charge a reasonable fee for complying with a data access request. We may, in limited circumstances, decline a request to access or correct personal data; if we do, we will tell you why.

If you are a Candidate, please refer to the Candidate Privacy Notice and contact the relevant Client (the prospective Employer) to exercise your rights, as the Client is the controller of your personal data.

How long will we keep your personal data?

We retain personal data only for as long as we need it for the Permitted Purposes, including to comply with our legal, accounting, tax, regulatory and reporting requirements, or to establish, exercise or defend legal claims.

When you are a Candidate and we are acting as a processor on behalf of a Client, we retain your personal data for the period determined by the Client as controller. Further detail is set out in the Candidate Privacy Notice.

If you ask us to delete your personal data, we will either de-identify or delete it unless we are required to keep it for legal reasons or have compelling legitimate interests in retaining it.

Your rights under EU/UK data protection laws

Data protection law is complex, and the rights set out below may not always be available to you. Where the GDPR or UK GDPR applies, in addition to your rights set out elsewhere in this Privacy Policy, you may have the right to:

•ask us to restrict our handling of your personal data;

•ask us to transfer your personal data to a third party;

•object to how we are using your personal data;

•withdraw your consent to our handling of your personal data; and

•lodge a complaint with the relevant supervisory authority.

If you are a Candidate, please contact the Client (the prospective Employer) to exercise your rights, as the Client is the controller of your personal data. You may still contact us for assistance.

Additional information for users in the United States

If you communicate with us electronically (by using the Platform, visiting our website, or sending us emails or messages), you acknowledge and agree that we may send you communications, including electronic communications.

By providing your phone number, you agree to be contacted by or on behalf of us using that number, including by call or text message. Message and data rates may apply. To stop receiving text messages, follow the opt-out instructions in the message.

We are committed to complying with the US federal Controlling the Assault of Non-Solicited Pornography and Marketing Act (“CAN-SPAM Act”) and the Telephone Consumer Protection Act (“TCPA”). If you receive an email or text message from us that you believe does not comply, please contact us immediately.

You must be 18 or older to use the Platform. Our services are not intended for users under 18. We comply with the US Children’s Online Privacy Protection Act of 1998 (“COPPA”). If we are notified that we have received information from a child under 13, we will obtain parental consent or delete the information promptly.

If you reside in California, you may have additional rights under the CCPA, including the right to know, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal data within the meaning of the CCPA.

Contact us

Please contact our privacy team at contact@h.work

Human Work Ltd. Attn: Privacy Officer

We will take steps to respond to, investigate and resolve complaints within thirty (30) days. If we require additional time, we will notify you and explain the reason for the delay.

Representation for data subjects in the EU

[Where required by Article 27 of the GDPR, we will appoint an EU representative as our point of contact for EU data subjects. Details will be made available at this section of the Privacy Policy upon appointment.]

Complaints

You may have the right to complain to the relevant data protection authority about how we collect and use your personal data. In Hong Kong, you may contact the PCPD:

Office of the Privacy Commissioner for Personal Data, Hong Kong Website: www.pcpd.org.hk Address: Unit 1303, 13/F, Dah Sing Financial Centre, 248 Queen’s Road East, Wanchai, Hong Kong

If you reside in the EEA or UK, you may contact your local data protection authority. If you are unsure who to contact, please ask us for help.