your privacy as a referee.

Personal data that we collect, hold, use and disclose about referees is typically used for the following purposes:

• to confirm identity and authority to provide references;
• candidate suitability assessment; and
• recruitment functions.

related purpose disclosures (relevant for candidates, business relations and referees)

We outsource a number of services to contracted service suppliers (CSPs) from time to time. Such CSPs may be located overseas. As part of the outsourcing arrangement with a CSP, they may need access to some of your personal data.



Typically our CSPs would include:

• software solutions providers;
• I.T. contractors and database designers and Internet service suppliers;
• legal and other professional advisors;
• insurance brokers, loss assessors and underwriters;
• background checking and screening agents; and
• talent marketplace platforms.

We take reasonable steps to ensure that terms of service with our CSPs recognise that we are bound by obligations under the PDPO to protect the privacy of your personal data and that they will not do anything that would cause us to breach those obligations.

Once we establish and maintain an employment, staffing or placement relationship with you, we use the data you provided to us, to comply with laws and regulations, including but not limited to employment law, tax and social security and national and international sanctions regulation compliance. For the purposes mentioned above, Randstad may transfer your personal data to other Randstad entities that provide services on behalf of Randstad.

We may also disclose your personal data to third parties:

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets; or
• if all or a substantial part of our assets are acquired by a third party, in which case the personal data that we hold about you may be one of the transferred assets.

When we share your personal data as described above, your personal data may be transferred to, stored, used and processed in a jurisdiction other than Hong Kong. You understand and consent to the transfer of your Personal Data out of Hong Kong as described herein. Where we transfer your personal data to a country outside of Hong Kong, we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the PDPO.

We will only send direct marketing materials to you if you have consented or if you have indicated no objection to receive such direct marketing materials. We cannot use your personal data for direct marketing unless we have received your consent or indication of no objection. In all direct marketing materials, we will give you the option to unsubscribe from receiving further marketing communications.

If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Data Protection Officer at the contact details provided below.

Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

We will respond to your request as soon as reasonably possible. If we are unable to respond to your request within forty (40) days after receiving your request, we will inform you in writing days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the Personal Data (Privacy) Ordinance).