Candidate privacy notice

Who is responsible

Fostier Consulting, established in Central, Hong Kong (Business Registration No. 38375423), is the data user (data controller) for your application. Contact: lucie@fostierconsulting.com or +852 6537 4439.

What we collect

• Identity and contact details: name, email address, phone number.
• Professional links, if you choose to give them: LinkedIn profile, portfolio or GitHub page.
• Your CV and whatever it contains.
• Your answers to the screening questions (whether you are 18 or over, university, work authorisation in Hong Kong, whether commission-only pay suits you) and the position you applied for. We ask whether you are 18 or over because younger applicants need a parent's or guardian's agreement.
• Technical data processed by our hosting provider to deliver the pages and keep them secure, such as IP addresses in server logs.

Sensitive data

Please do not include your Hong Kong Identity Card or passport number, or sensitive details such as health, religion or political views, in your CV or answers. We do not need them to assess an application. If we make you an offer, we will ask then for what is needed to verify your right to work.

Why we use it

Only to run our recruitment: assessing your application against the position, contacting you about it, arranging interviews and, if we make you an offer, preparing it and checking your right to work in Hong Kong. We do not use your data for marketing.

Required and optional information

Every field in the form is required unless marked optional. If you do not provide the required information, we cannot consider your application.

Legal bases (GDPR)

Where the GDPR applies, we process your data to take steps at your request before entering into a contract (Article 6(1)(b)) and for our legitimate interest in recruiting suitable people (Article 6(1)(f)).

Automatic screening

The position is paid on commission only. If you answer that commission-only pay does not suit you, your application is automatically marked as not retained, because the position cannot offer a base salary. A member of our team still sees every application and can reverse this, and you can ask us to reconsider by writing to us. Other screening answers that may not fit the position are only flagged for a person to review.

Who sees your data

Your data is never sold or shared for commercial purposes. It is seen only by the Fostier Consulting staff involved in recruitment, who each sign in with their own account and record their status changes and internal notes on your application. These notes are part of your data, and you can ask to see them. Your data is processed by:

• Vercel Inc. (United States): hosting of these pages, server logs and bot protection.
• Resend, Inc. (United States): sending the emails that confirm your application and notify our team.
• Where we use it, Google LLC (United States): cloud storage of applications in Google Workspace.
• Public authorities, only where the law requires it.

Transfers outside Hong Kong

Your data may be stored in or accessed from Hong Kong, France and, through our providers, the United States. Where the GDPR applies, transfers outside the European Economic Area rely on appropriate safeguards such as standard contractual clauses, or on the derogation for steps taken at your request before entering into a contract.

How long we keep it

If your application is unsuccessful, we delete it and your CV 12 months after you apply, which lets us contact you about another suitable opening in that time. You can ask us to delete it sooner at any time. If we make you an offer or you join us, your application is not deleted after 12 months: it is kept with your offer or, if you join us, your personnel file, and the retention rules for those records apply.

Your rights

Under the PDPO you may ask for access to, and correction of, the personal data we hold about you. Where the GDPR applies, you also have rights of erasure, restriction, portability and objection. You can withdraw your application at any time and we will delete your data. You may complain to the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk) or, in the EU, to your supervisory authority, such as the CNIL in France.

• To make a request, email lucie@fostierconsulting.com (or nicolas@fostierconsulting.com) and say what you are asking for.
• We may ask you to confirm your identity before acting on it.
• We reply within 40 days under the PDPO and within one month where the GDPR applies.

Security and cookies

Applications are stored with access restricted to the people who handle recruitment and are sent over encrypted connections. The application pages use no analytics and set no advertising or tracking cookies. To block automated submissions, a bot-protection check from Vercel runs in your browser on these pages: it reads technical signals from your browser and device (not the answers you type) and may store a technical identifier, only to tell people from scripts.

Changes and language

We may update this notice; the date at the top shows the latest revision. It is published in English and French; if the versions differ, the English version prevails.