1. Who We Are
Souriq is a software-as-a-service platform operated for licensed employment agencies in Hong Kong. Our registered business address and data enquiry contact is:
Hong Kong
Data enquiries: privacy@souriq.io
Response time: within 10 business days (statutory maximum: 40 days under PDPO s.19)
2. Scope
This policy covers all personal data processed by Souriq on behalf of:
- ›Agency users (owners, staff, consultants) who access the Souriq dashboard
- ›Domestic helper candidates whose profiles are managed within the platform
- ›Employers whose placement orders are tracked in the platform
- ›Visitors to our marketing website (souriq.io)
Agency clients act as independent data controllers for the candidate and employer data they upload. Souriq acts as a data processor on their behalf. Agencies are responsible for obtaining the necessary consent from candidates and employers before entering their personal data into Souriq.
3. Personal Data We Collect
3.1 Agency users
- ›Name, work email address, role/title
- ›Login credentials (passwords are stored as salted hashes — never in plain text)
- ›Usage logs, IP address, session metadata for security and audit purposes
3.2 Candidate profiles (entered by agency users)
- ›Full name, date of birth, nationality, HKID / passport number
- ›Contact details (phone, email, address)
- ›Employment history, reference letters, skills assessments
- ›Medical certificates, training certificates, PDOS records
- ›Visa / work permit details and expiry dates
- ›Photo or scanned documents uploaded by the agency
3.3 Website visitors
- ›IP address and browser type (via server logs)
- ›Pages visited and time spent (via anonymised analytics)
- ›Contact form submissions (name, email, company, message)
4. Purpose of Collection (DPP1)
Personal data is collected only for the following stated purposes:
- ›Providing and operating the Souriq platform for placement pipeline management
- ›Automating deadline tracking and document checklist workflows
- ›Sending status notifications to employers and candidates where instructed by the agency
- ›Facilitating overseas partner (Manila / Jakarta) access to candidate pipelines
- ›Billing and account administration
- ›Security monitoring and fraud prevention
- ›Responding to legal or regulatory requirements
We will not use personal data for any purpose incompatible with the above without obtaining fresh consent.
5. Consent (DPP1 — Collection Notice)
Before storing any candidate personal data in Souriq, agency users are responsible for providing candidates with a Personal Information Collection Statement (PICS) that discloses:
- ›The purpose for which their data is collected
- ›The classes of persons to whom the data may be transferred (employers, overseas partners, immigration authorities)
- ›Their right to request access and correction
- ›Contact details for making a data access request
Souriq provides a sample PICS template available upon request to privacy@souriq.io.
6. Data Accuracy and Retention (DPP2)
Accuracy
Agency users are responsible for keeping candidate data accurate and up to date. Souriq provides edit and correction tools within the platform dashboard.
Retention policy
- ›Active candidate profiles: retained for the duration of the agency's active subscription
- ›Placed candidates: retained for 7 years from placement date (in line with Employment Ordinance record-keeping requirements)
- ›Inactive candidates (no activity for 3 years): automatically flagged for deletion; agency is notified and given 30 days to export or retain
- ›Agency user accounts: retained for 3 years after account closure
- ›Website enquiry data: retained for 12 months
- ›Security and audit logs: retained for 2 years
7. Use of Data (DPP3)
Personal data collected for one purpose will not be used for a new, incompatible purpose without explicit consent. Specifically:
- ›Candidate data is not used for Souriq marketing or analytics without anonymisation
- ›Agency contact data is used only for service communications and billing
- ›We do not sell, rent, or trade personal data to third parties
8. Data Security (DPP4)
Souriq implements the following technical and organisational measures to protect personal data:
In transit
- ›All data transmitted between users and Souriq is encrypted using TLS 1.3
- ›HTTP Strict Transport Security (HSTS) enforced on all endpoints
At rest
- ›All database storage encrypted with AES-256
- ›Uploaded documents stored in encrypted object storage
- ›Encryption keys managed separately from data (key rotation every 90 days)
Access controls
- ›Role-based access control: staff only access data relevant to their role
- ›Tenant data segregation: each agency's data is logically isolated; no cross-agency data access is possible
- ›All staff access requires MFA (multi-factor authentication)
- ›Privileged administrative access is logged and audited
Infrastructure
- ›Servers and data storage located in Hong Kong
- ›No personal data transferred outside Hong Kong / EEA without appropriate safeguards
- ›Regular automated backups with point-in-time recovery
- ›Vulnerability scanning and penetration testing conducted annually
9. Data Breach Notification
In the event of a data breach that is likely to result in harm to affected individuals:
- ›Souriq will notify affected agency clients within 48 hours of becoming aware of the breach
- ›Agencies will be provided with details of the nature of the breach, data affected, and remediation steps taken
- ›Souriq will notify the Office of the Privacy Commissioner for Personal Data (PCPD) where required
- ›A post-incident report will be provided to affected clients within 30 days
To report a potential security issue: security@souriq.io
10. Openness (DPP5)
This Privacy Policy is publicly accessible from our website at all times. Agencies may request a copy of Souriq's data processing practices, including sub-processors used, by emailing privacy@souriq.io.
11. Data Access and Correction Rights (DPP6)
Any individual whose personal data is held in Souriq (candidates, employers, agency staff) has the right to:
- ›Request a copy of their personal data held in the platform
- ›Request correction of inaccurate data
- ›Request deletion of their data (subject to legal retention requirements)
- ›Object to specific uses of their data
12. Cookies and Analytics
Our marketing website uses:
- ›Essential cookies: required for session management and security (cannot be disabled)
- ›Analytics: anonymised page-view tracking to understand site usage — no personally identifiable information is retained
- ›No third-party advertising or tracking pixels
13. Third-Party Sub-Processors
Souriq uses a limited number of third-party services to operate the platform. All sub-processors are bound by data processing agreements:
- ›Cloud infrastructure provider (servers in HK) — for compute and storage
- ›Email delivery service — for system notifications only
- ›Error monitoring service — anonymised stack traces only, no personal data
A full list of sub-processors is available upon written request.
14. Changes to This Policy
We will notify agency administrators by email at least 14 days before any material change to this policy takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.
15. Contact and Complaints
For any privacy-related queries, contact us at privacy@souriq.io.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD):
12/F, 248 Queen's Road East, Wan Chai, Hong Kong
Tel: +852 2827 2827 · Web: www.pcpd.org.hk