CommPeak Legal Information

2.1  CommPeak comprises CommPeak Limited, a company incorporated in Hong Kong (Company No. 1691980) with its registered office at 1003 Centre Point, 181–185 Gloucester Road, Wan Chai, Hong Kong, together with its relevant local affiliates and offices (“CommPeak”, “we”, “us” or “our”). This Notice applies to all individuals who apply for employment, engagement or an internship with CommPeak, or who are otherwise considered as candidates, whether through the careers section of www.commpeak.com or otherwise (each, an “Applicant” or “you”).

2.2  The CommPeak entity that determines the purposes and means of processing your personal data (the data controller, or the equivalent under applicable law) is CommPeak Limited and/or the CommPeak affiliate operating in the jurisdiction to which you apply, including our offices and operations associated with Hong Kong, the Philippines, Israel, Ukraine and Bulgaria. Where more than one CommPeak entity is involved, those entities act as joint or independent controllers as the circumstances require.

3.1  Through the “Join CommPeak” application form and the recruitment process, we collect and process: (a) your first and last name; (b) your email address; (c) your telephone number and the associated country; (d) any personal notes or message you choose to provide; (e) whether you were referred by a CommPeak employee and, if so, the referral details; (f) the CV you upload (accepted as a single .pdf or .docx file) and its contents, including your employment and engagement history, qualifications, education, skills and any other information you include; and (g) your record of acceptance of this Notice and the applicable consents (including the date, time and version accepted).

3.2  During the recruitment process we may additionally collect: records of correspondence, interviews, assessments and technical or psychometric tests and our evaluation notes; references and the outcome of reference checks; and, where lawful and necessary, right-to-work, immigration, background, sanctions and screening information. We may also ask you to provide additional information or documentation to verify information you have provided and to assess your suitability for a role, to the extent permitted by applicable law.

3.3  Sensitive / special categories of personal data. We do not seek special categories of personal data (such as data concerning health, racial or ethnic origin, religion, political opinions, trade-union membership, or biometric or genetic data) as part of the recruitment process, except where necessary and permitted under applicable law (for example, to make reasonable accommodations for a disability, or to comply with equal-opportunity or military-service obligations). Please do not include such data in your CV, personal notes or application unless we specifically request it. If you choose to provide such data without being requested to do so, you acknowledge that CommPeak may not be able to remove it from your submission and may process it only to the extent permitted by applicable law and as necessary to administer the recruitment process and comply with legal obligations.

4.1  We collect personal data: (a) directly from you, when you complete and submit the application form, upload your CV, correspond with us, or attend an interview or assessment; (b) from third parties acting on your behalf or in connection with recruitment, including recruitment agencies, your nominated referees and current or former employers; (c) through employee referrals; and (d) from publicly available professional sources, such as professional networking sites (for example, LinkedIn), to the extent permitted by applicable law. Where permitted by applicable law, we may also collect information from sources used for recruitment-related screening and verification (for example, background-check or sanctions-screening providers) to the extent relevant and proportionate to the role.

5.1  We process your personal data to: (a) evaluate your suitability and manage the recruitment and selection process; (b) communicate with you and arrange interviews and assessments; (c) verify the information you provide, including references, qualifications and right-to-work; (d) make and document hiring decisions and, where successful, prepare your engagement and onboarding; (e) comply with our legal, regulatory and good-governance obligations; (f) establish, exercise or defend legal claims and protect the security of our systems; (g) where you so elect, retain your details in our Talent Pool to consider you for future opportunities; and (h) manage and improve our recruitment operations, including maintaining audit trails, training, reporting and ensuring the integrity and security of our recruitment systems.

5.2  Legal bases. Where the EU/Bulgarian or other GDPR-style frameworks apply, we rely on: the taking of steps at your request prior to entering into a contract (Article 6(1)(b) GDPR); our legitimate interests in selecting and recruiting suitable personnel and conducting our business, balanced against your rights (Article 6(1)(f)); compliance with a legal obligation (Article 6(1)(c)); and, for the Talent Pool and any optional processing, your consent (Article 6(1)(a)). Where we process special categories of data, we rely on the conditions in Article 9 GDPR and equivalent local law. Under the data protection laws of Hong Kong, the Philippines, Israel and Ukraine, we process your personal data on the corresponding lawful grounds available under those laws, including your provision of the data for your application, our legitimate recruitment interests, the performance of legal obligations, and your consent where required.

6.1  We handle your personal data in accordance with the data protection laws applicable to the recruitment process and to the CommPeak entity processing your data, which may include one or more of:

(a)  Hong Kong — the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) and its six Data Protection Principles, overseen by the Office of the Privacy Commissioner for Personal Data (PCPD). In relation to data collected in Hong Kong, this Notice serves as a Personal Information Collection Statement under Data Protection Principle 1(3).

(b)  The Philippines — the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations and the issuances of the National Privacy Commission (NPC), including the principles of transparency, legitimate purpose and proportionality.

(c)  Israel — the Protection of Privacy Law, 5741-1981, as amended (including by Amendment No. 13, which entered into force on 14 August 2025) and the regulations thereunder, overseen by the Israeli Privacy Protection Authority (PPA), including database and privacy-protection-officer obligations where applicable.

(d)  Ukraine — the Law of Ukraine No. 2297-VI “On Protection of Personal Data”, overseen by the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman). We will align our practices with the forthcoming reform of Ukrainian data protection law (Draft Law No. 8153, intended to harmonise Ukrainian law with the GDPR) once it enters into force.

(e)  Bulgaria and the European Union — Regulation (EU) 2016/679 (the GDPR) and the Bulgarian Personal Data Protection Act, overseen by the Bulgarian Commission for Personal Data Protection (CPDP) and, for Applicants elsewhere in the EU/EEA, the competent local supervisory authority.

6.2  Where more than one framework applies, we comply with each to the extent applicable, and any mandatory protection or right granted to you under the law of your own jurisdiction applies in addition to, and is not diminished by, this Notice.

7.1  Retention period. We retain your CV, application and associated recruitment records on CommPeak’s database for two (2) years, calculated from the later of the date of your application or the date of our last substantive interaction with you in connection with that application or any recruitment process, unless a shorter or longer period is required or permitted by applicable law.

7.2  Pre-deletion notice. Upon expiry of the two-year retention period, your personal data is scheduled for automatic deletion. Before such deletion takes effect, we will send a notice to the email address you provided, not less than fourteen (14) days in advance, informing you that your data is due to be deleted and offering you the opportunity to have your details retained in our Talent Pool so that CommPeak may consider you for future positions.

7.3  Your election. If, within the fourteen (14)-day notice period, you confirm that you wish to remain in our systems, we will retain your personal data in the Talent Pool on the basis of your consent for a further period of two (2) years (renewable in the same manner). If you do not respond within the notice period, or if you decline or subsequently withdraw, your personal data will be automatically and securely deleted from CommPeak’s active recruitment database, save for any limited information we are required or permitted by law to retain.

7.4  Withdrawal at any time. You may ask us to delete your data, or withdraw your consent to remain in the Talent Pool, at any time and without waiting for the notice described above, by contacting us using the details in Section 15.

8.1  Where you elect to remain in our Talent Pool, we process your personal data solely to identify and contact you regarding future vacancies that may match your profile. Participation is voluntary and based on your consent; you may withdraw at any time, after which your data will be deleted in accordance with Section 7 (subject to any lawful retention).

9.1  We may disclose your personal data to: (a) other CommPeak group entities involved in the recruitment process or in which the role sits; (b) our service providers acting as processors on our instructions, including applicant-tracking and recruitment-platform providers, IT and hosting providers, and, where lawful and necessary, background-screening and reference-checking providers, each under written terms requiring appropriate confidentiality and security; (c) our professional advisers; and (d) courts, regulators and authorities where legally required or permitted. We do not sell your personal data.

10.1  CommPeak operates internationally, including in connection with Hong Kong, the Philippines, Israel, Ukraine and Bulgaria. Your personal data may be transferred to, stored in, or accessed from, a country other than the one in which you applied. Where we transfer personal data across borders, and in particular from the EEA, the United Kingdom or other jurisdictions that restrict international transfers, we implement an appropriate transfer mechanism and safeguards required by applicable law, such as an adequacy finding, the European Commission’s Standard Contractual Clauses, or equivalent contractual protections, together with supplementary measures. You may request information about the safeguards applied using the contact details in Section 15.

11.1  We apply appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including access controls, encryption where appropriate, network and system security, logging and monitoring, and confidentiality obligations on personnel and processors who handle recruitment data. However, no method of transmission over the internet or method of electronic storage is completely secure, and CommPeak cannot guarantee absolute security.

11.2  Limitation of liability. To the maximum extent permitted by applicable law, CommPeak will not be liable for any indirect, incidental, special, consequential or punitive damages, or any loss of profits, revenues, goodwill or data, arising out of or in connection with your use of the careers page, submission of an application or CV, or CommPeak’s processing of your personal data in accordance with this Notice.

12.1  Subject to and in accordance with the data protection law applicable to you, you may have the right to: (a) access the personal data we hold about you and obtain a copy; (b) request correction of inaccurate or incomplete data; (c) request erasure or deletion; (d) object to, or request restriction of, certain processing, including processing based on legitimate interests; (e) request portability of data you provided; and (f) withdraw consent where processing is based on consent. These rights may be limited or subject to exceptions under applicable law, and CommPeak may request information to verify your identity and the validity/scope of your request. We will respond within the timeframes required by applicable law.

12.2  You may also lodge a complaint with the competent data protection authority, which may include: the Office of the Privacy Commissioner for Personal Data (Hong Kong); the National Privacy Commission (the Philippines); the Privacy Protection Authority (Israel); the Ukrainian Parliament Commissioner for Human Rights (Ukraine); and the Commission for Personal Data Protection (Bulgaria) or the supervisory authority of your EU/EEA jurisdiction. We would appreciate the opportunity to address your concerns first.

13.1  We do not make decisions about your application that produce legal or similarly significant effects on you based solely on automated processing without meaningful human involvement. Where tools assist in screening or assessment, qualified personnel review and make the relevant decisions.

14.1  We may update this Notice from time to time. The current version, with its effective date, is published at www.commpeak.com/legal; the version in force and accepted by you at the time of your application governs that application. Material changes will be notified where required by applicable law.

15.1  If you have any questions about this Notice or wish to exercise your rights, please contact CommPeak’s Data Protection Officer / privacy team at [email protected] or by writing to CommPeak Limited, 1003 Centre Point, 181–185 Gloucester Road, Wan Chai, Hong Kong, marked for the attention of the Data Protection Officer. Where CommPeak has appointed a local data protection officer or representative in your jurisdiction (including under Israeli law or the GDPR), their contact details are published at www.commpeak.com/legal.

15.2  This Notice is published in English; where it is made available in another language, and there is any inconsistency, the English version prevails to the extent permitted by applicable law.