Privacy Policy

1. Scope & Applicability

This policy applies to all users (candidates, employers, visitors) worldwide, with regional provisions for:

  • GDPR (EU/EEA/UK)
  • CCPA/CPRA (California)
  • PIPEDA (Canada)
  • LGPD (Brazil)
  • PDPA (Singapore/Thailand)
  • Other jurisdictions where we operate

2. Data Controller Information

Global HQ: Singapore
Data Protection Officer:
DPO Contact Email | Phone

Regional Representatives:

  • EU: Article 27 GDPR Rep
  • UK: UK Representative

3. Data Collection Matrix

Data TypePurposeLegal Basis (GDPR)Retention Period
Candidate profile dataJob matchingPerformance of contract3 yrs inactivity
Employer contact infoService deliveryLegitimate interest5 yrs post-contract
Payment dataTransaction processingLegal obligation7 yrs (tax compliance)
Cookie/usage dataAnalytics & improvementsConsent (non-essential)26 months

4. Cross-Border Data Transfers

We implement:

  • EU SCCs (Standard Contractual Clauses)
  • UK IDTA (International Data Transfer Agreement)
  • APEC CBPR certifications for Asia-Pacific
  • Localized storage options where required (e.g., China)

5. User Rights by Region

RightGDPRCCPAOther RegionsHow to Exercise
Access✓✓VariesPrivacy Portal
Deletion✓✓✓ (where applicable)Email request
Opt-out of salesN/A✓Brazil/LGPDPreference Center
Data portability✓✓LimitedDownload tool

6. Special Provisions

  • EU/UK: Explicit consent for profiling
  • California: Shine the Light Law disclosures
  • Saudi Arabia: Data localization requirements
  • China: PIPL-compliant consent mechanisms

7. Security Measures

  • ISO 27001 certification
  • Annual penetration testing
  • Role-based access controls
  • Breach notification protocols meeting:
  • 72hrs (GDPR)
  • 45 days (CCPA)
  • Local timelines

8. Policy Updates

  • 30-day notice for material changes
  • Version archive available upon request
  • Jurisdiction-specific changelogs

Implementation Checklist

  1. Geo-Adaptive Disclosures
  • IP-based policy snippets
  • Language-localized versions
  1. Consent Management
  • Cookie banner with IAB TCF 2.0 (EU)
  • “Do Not Sell” toggle (California)
  1. Contact Matrix
    “`markdown Region Privacy Questions Data Requests Americas privacy-us@co.1twh.com dsar-us@co.1twh.com EMEA privacy-eu@co.1twh.com dsar-eu@co.1twh.com APAC privacy-apac@co.1twh.com dsar-apac@co.1twh.com “`
  2. Compliance Proof
  • Maintain Records of Processing Activities (ROPA)
  • DPIA for high-risk processing

Scroll to Top