1. INTRODUCTION

• Purpose of this Privacy Policy

Talenx Limited (referred to in this Privacy Policy as “TalenX”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy will inform you as to how we look after your personal data when you visit us at http://www.talenx.io/ (the “Website”) or interact with our tests under our Website, regardless of where you visit it from, and tell you about your privacy rights and how the law protects you.

This Privacy Policy aims to give you information on how we collect and process your personal data through your use of this Website, including any data you may provide through this Website when you sign up to our newsletter, purchase any products or services and/or take part in a competition.

This Website is not intended for children and we do not knowingly collect data relating to children.

It is important that you read this Privacy Policy together with any other Privacy Policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and Privacy Policies and is not intended to override them.

• Data Controller and Data Processor

Where a company or similar organisation using our products or services (the “Client”) has instructed us to assess an individual (the “Candidate”), the Client is the data controller and TalenX is a data processor.

Where we process the personal data of a representative of a Client for the purposes of accessing or ordering our products or services, TalenX is the data controller. In this event, this means that TalenX (i) “controls” your personal data, including making sure that it is kept secure; and (ii) makes certain decisions on how to use and protect your personal data, but only to the extent that we have informed you about the use or as otherwise permitted by law.

• Contact Information and Complaints

If you have any questions about this Privacy Policy or any questions regarding our use of your personal data, please contact our data privacy manager at info@talenx.io.

Our full contact details are:

TalenX Limited
2/F Starlight House

32 Leighton Road

Causeway Bay, Hong Kong

Attn: Data Privacy Manager

If you are currently staying within the European Economic Area, you have the right to make a complaint at any time to your country’s supervisory authority for data protection issues. For a current list of national data protection authorities, please visit the European Data Protection Board’s website at https://edpb.europa.eu/about-edpb/board/members_en.

We would, however, appreciate the chance to deal with your concerns before you approach your country’s supervisory authority, so please contact us in the first instance.

• Changes to this Privacy Policy and Personal Data

This Privacy Policy is regularly reviewed and was last updated on August 9^th,2019. We may amend or update our Privacy Policy from time to time. For this purpose, we will provide you notice of amendments to this Privacy Policy and update the “last updated” date above.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

• Third-Party Links

This Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

• Basis For Processing Data

We have a legitimate interest to process data on behalf of the Client (the data controller) that has instructed us to process your data for the purposes of psychometric assessment, or to provide our services to you as a Client. The processing we perform is necessary for us to be able to provide our psychometric assessment service. We will only ever use your data provided or your test results as a Candidate for the provision of psychometric assessment services, improving our database, internal research and providing support. We will not use your data for any other purpose(s), such as marketing or advertising.

You will note that the design of our test for individual Candidates do not require any input of any personal data such as name, sex, age, etc, which are in fact strictly optional data that you can choose to, or not to, provide.

THE DATA WE COLLECT ABOUT YOU

In connection with your assessment (in the case of a Candidate) and in connection with your professional use of our products or services (in the case of a Client), we will collect, store, and use the following categories of personal information about you:

• Psychometric assessment results of Candidates when you interact with our tests. Talenx calculates such results for Clients based on your responses to our questions.
• Any optional data or information about that you that you opt to provide to us personally.
• your IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Website;

We may also collect special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). These types of information will be used for strictly internally by Talenx to improve the databases of Talenx and internal research purposes.

2. HOW WE COLLECT YOUR DATA

• Types of Data Collected

The types of personal data we collect, use and store about you will depend on the services you have requested from us and/or the nature of your interaction with us. When using our Website, we collect and process the following types of personal data:-

• your first name, last name, username or similar identifier, date of birth and gender (“Identity Data”);
• your billing address, delivery address, email address and telephone numbers (“Contact Data”);
• your bank account and payment card details (“Financial Data”);
• details about payments to and from you and other details of products and services you have purchased from us (“Transaction Data”);
• your IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Website (“Technical Data”);
• information about how you use our Website and services (“Usage Data”).

• Direct Interactions

 We collect personal information about Candidates from the following sources:

• Yourself, as a Candidate or as a Client.
• The Client to which you made an application for employment, development, or career progression (the data controller).
• Direct interactions. You may give us information about your identity, contact, etc by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
  • apply for our products or services;
  • purchase our products or services;
  • create an account on our website;
  • complete our psychometric assessments;
  • subscribe to our service or publications;
  • contact us regarding feedback, queries or customer support;
• Automated technologies or interactions. As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
• Third parties or publicly available sources. We may receive personal or technical data about you from various third parties as listed in section.

• Automated Technologies and Interactions

As you interact with our Website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We may collect this personal data by using cookies and other similar technologies.

A cookie is a small file of letters and numbers stored by computer after being sent to your computer when you visit a website. Whenever you visit the same website again, the information stored in the cookie can be retrieved to notify the website of your previous activity. We use cookies to facilitate website navigation, maintain quality of online service, provide additional security, allow the customization of your access to the Website and remember you when you return to the Website.

A cookie cannot give us access to your computer or to information beyond what you provide us and we don’t store personally identifiable information such as your name or address in cookies we create, but we do use encrypted information gathered from them to help improve your experience on our Website. If you do not wish to enable cookies, you’ll still be able to browse the Website and use it for research purposes.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

When you visit our Website, you may notice some cookies that are not related to TalenX. If you go on to another website that contains embedded content, you may be sent cookies from these websites. We do not control the setting of these cookies, so we suggest you check the third-party websites for more information about their cookies and how to manage them.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

3. HOW WE USE YOUR PERSONAL DATA

• Data Usage

 We plan to use your personal data for the following purposes, and pursuant to the corresponding legal bases:

• Assessing your performance on the psychometric assessment(s) you have been invited to complete;
• Providing you with necessary credentials to access the testing platform, provide technical support, and notify you upon receipt of completed assessment(s);
• Keeping records related to your assessment results and make them available to the company who invited you to complete the assessment(s);
• Keeping records related to your account such as assessment results, candidates and the results of their assessment(s);
• Using the optional data/information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting;
• Building up a more comprehensive internal database of performance on the psychometric assessment(s) and maintaining and improving our internal research algorithm, methodology, results conclusions, etc; and
• Complying with legal or regulatory requirements. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

• Purposes For Which We Will Use Your Personal Data

We are committed to only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you (“Performance of Contract”).

• Where it is necessary for us to uphold the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us (“Legitimate Interests”).

• Where we need to comply with a legal obligation (“Legal Obligation”).

It is in our legitimate interests to provide psychometric assessments on behalf of a Client, to their chosen Candidates and to provide psychometric assessment services to professional organisations who engaged us for our opinion and services.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please feel free to contact us any time.

4. DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with the following parties for the purposes set out in the table above:-

• “External Third Parties” which means that (a) service providers based in Hong Kong who provide IT and system administration services; (b) professional advisors including lawyers, bankers, auditors and insurers based in Hong Kong who provide consultancy, banking, legal, insurance and accounting services; and (c) the Inland Revenue Department, regulators and other authorities based in Hong Kong who require reporting of processing activities in certain circumstances.; and

• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

5. INTERNATIONAL TRANSFERS

We will share your personal data within our company in Hong Kong, but we may transfer your data to other jurisdictions.

Please understand that we will generally ensure a similar degree of protection to your personal data as it is afforded in the EEA by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.

• We may use specific contracts or contract clauses approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.

• Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US. For further details, see European Commission: EU-US Privacy Shield.

Please do not hesitate to contact us anytime if you want further information on the specific mechanism used by us when transferring your personal data.

6. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. DATA RETENTION

We will retain your personal information for as long as is reasonably necessary for the purposes listed in Section 4 above. In some circumstances we may retain your personal information for longer periods of time, for example where we are required to do so to meet legal, regulatory, tax or accounting requirements.

In specific circumstances we may also retain your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a possibility of legal action relating to your personal information or dealings.

8. YOUR LEGAL RIGHTS WITHIN THE EEA

• Your Rights

Subject to applicable laws and regulations, you may have a number of rights in relation to your personal information. For example, for Clients and Candidates in the EEA and under GDPR, you may request access to your data, rectification of any mistakes in our records, erasure of records where no longer required, restriction on the processing of your data, objection to the processing of your data, data portability and various information in relation to any automated decision making and profiling or the basis for international transfers. You also have the right to complain to your supervisory authority (further details of which are set out in Section 12 below).

Where permitted by applicable laws and regulations, you may have the following rights:

• Access: you can ask us to provide details of what personal information (if any) we process about you, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, how you can make a complaint, where we got your data from, you can also ask us to provide a copy of it;
• Rectification: you can ask us to rectify inaccurate personal information;
• Erasure: you can ask us to erase your personal information in certain circumstances (for example if it is no longer needed for the purposes for which it was collected or you have withdrawn your consent if the data processing was based on consent);
• Restriction: you can ask us to restrict (i.e. keep but not use) your personal information in certain circumstances (for example where its accuracy is contested);
• Portability: in certain circumstances you can ask us to provide your personal information to you in a structured, commonly used, machine-readable format, or you can ask to have it ‘ported’ directly to another data controller;
• Objection: you can object to any processing of your personal information which has our ‘legitimate interests’ as its lawful basis if you believe your fundamental rights and freedoms outweigh our legitimate interests; and
• Automated Decision Making: you can ask for certain automated decisions to be reconsidered by us using human intervention.

If you wish to exercise any of the rights set out above, please contact us at info@talenx.io

• No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights) as stated above. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

• Information Required

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data in accordance with Clause 9.1 (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

• Time Limit to Respond

We try to respond to all legitimate requests made in accordance with Clause 9.1 within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

9. YOUR LEGAL RIGHTS IN HONG KONG

 If you are currently staying in Hong Kong, you are entitled, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (the “Ordinance”), to check whether we hold data about you and to have access to those data. If any of these data are incorrect or inaccurate, you have the right to correct or update them. Requests for access to or to correct personal data should be addressed to our Data Privacy Manager at [email protected]. In accordance with the Ordinance, we are entitled to charge a reasonable fee for processing any data access or correction requests.