Keelfolk

PRIVACY POLICY

Keelfolk / AR HANG SERVICE (HK) LIMITED

Version: 1.0

Effective Date: 07.09.2026

1. Introduction

1.1 This Privacy Policy explains how AR HANG SERVICE (HK) LIMITED, a private company limited by shares incorporated in Hong Kong, Company Number 2825142, Business Registration Number 70675716 [confirm current validity before publication], having its registered office at Room A17, 29/F, Ning Jin Centre, 7 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong, trading as "Keelfolk" ("Company", "Keelfolk", "we", "us", "our"), collects, uses, stores and protects personal data.

1.2 This Policy applies to personal data processed through our website keelfolk.io, recruitment activities, service contracts, client onboarding, and business communications.

1.3 We process personal data in accordance with:

  • the Personal Data (Privacy) Ordinance, Cap. 502 of Hong Kong;
  • the UK GDPR / Data Protection Act 2018, where applicable;
  • the EU GDPR, where applicable;
  • other applicable data protection laws.

2. Data Controller

2.1 The data controller for personal data processed through the website and in connection with our Contractor of Record / staffing services is:

AR HANG SERVICE (HK) LIMITED

Company Number: 2825142

Business Registration Number: 70675716 [confirm current validity]

Registered Address: Room A17, 29/F, Ning Jin Centre, 7 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong

Email: privacy@keelfolk.io

Phone: +852 6123 4567

3. Categories of Personal Data We Collect

3.1 Candidates and Engineers

We may collect:

  • full name, date of birth, nationality, citizenship status;
  • contact details, including email address, phone number and location;
  • CV / resume, employment history, education, certifications;
  • technical skills, test assignments, interview notes, reference checks;
  • identity and right-to-work information;
  • bank details and tax information required for engagement and payment;
  • timesheets, work performance records and client feedback;
  • sanctions, anti-bribery and AML screening information where required by law or legitimate business interest.

3.2 Clients and Client Representatives

We may collect:

  • full name, position, employer name;
  • business contact details;
  • corporate due diligence information;
  • billing, payment and banking information;
  • contract and project records;
  • compliance and sanctions screening information.

3.3 Website Visitors

We may collect:

  • IP address;
  • browser type and version;
  • device information;
  • pages viewed;
  • referral source;
  • cookies and similar technologies, as described in this Policy.

4. Purposes of Processing

We process personal data for the following purposes:

  1. candidate sourcing, screening, assessment and placement;
  2. engagement of engineers under Contractor of Record or related contracting models;
  3. provision of services to clients;
  4. contract administration, invoicing and payment processing;
  5. identity verification and background checks;
  6. sanctions, anti-bribery, anti-money laundering and trade compliance;
  7. tax, accounting and statutory recordkeeping;
  8. website operation, security and improvement;
  9. handling enquiries and support requests;
  10. establishing, exercising or defending legal claims.

5. Legal Bases for Processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

  • performance of a contract: processing necessary to enter into or perform a contract with the data subject or with a client;
  • legal obligation: processing necessary to comply with legal, tax, employment, sanctions or accounting obligations;
  • legitimate interests: processing necessary for recruitment, business development, fraud prevention, IT security and corporate administration, except where overridden by the data subject's rights;
  • consent: where consent is required, for example certain marketing communications or optional data collection.

6. Recruitment and Contractor of Record Processing

6.1 For recruitment purposes, we process candidate data to assess suitability for engineering roles, including Platform Engineering, Site Reliability Engineering, Cloud Infrastructure, Kubernetes and Terraform roles.

6.2 Where a candidate is engaged through our Contractor of Record model, we process personal data for onboarding, contracting, compensation, timesheet administration, performance management, statutory compliance and termination.

6.3 We do not collect special category data unless strictly required by applicable law or with explicit consent.

7. Disclosure of Personal Data

We may disclose personal data to:

  • clients, where necessary for placement or service delivery, with appropriate safeguards;
  • professional advisers, including legal, accounting and audit advisers;
  • cloud hosting, CRM, HR, payroll, payment and IT service providers;
  • background check and reference providers;
  • banks and payment service providers;
  • government, tax, immigration, law enforcement or regulatory authorities where required by law;
  • courts, tribunals or arbitrators where necessary.

We do not sell personal data.

8. International Transfers

8.1 Personal data may be transferred outside Hong Kong and outside the EEA/UK, including to clients, engineers, service providers and subcontractors located in other jurisdictions.

8.2 Where required by applicable law, international transfers are protected by:

  • adequacy decisions, where applicable;
  • Standard Contractual Clauses or UK International Data Transfer Addendum, where applicable;
  • other lawful transfer mechanisms;
  • appropriate technical and organisational safeguards.

9. Data Retention

9.1 Candidate data is generally retained for [24] months after the last contact, unless a longer period is required or permitted by law.

9.2 Client and contractual records are retained for [7] years, or longer where required by applicable law or legitimate legal needs.

9.3 Where a legal dispute or regulatory investigation arises, relevant data may be retained until resolution.

10. Security

We implement appropriate technical and organisational measures, including:

  • encryption in transit where feasible;
  • access controls and authentication;
  • role-based access;
  • secure backup procedures;
  • logging and monitoring;
  • staff confidentiality obligations;
  • vendor security due diligence.

No method of transmission over the internet is completely secure, but we take commercially reasonable steps to protect personal data.

11. Cookies

11.1 Our website may use cookies or similar technologies that are strictly necessary for operation, as well as analytics cookies where consent is required.

11.2 Users may control cookies through browser settings. Disabling necessary cookies may affect website functionality.

12. Data Subject Rights

Depending on applicable law, individuals may have the right to:

  • access their personal data;
  • correct inaccurate or incomplete data;
  • request deletion, subject to legal retention requirements;
  • restrict processing;
  • object to processing;
  • receive data portability;
  • withdraw consent, where processing is based on consent;
  • lodge a complaint with a supervisory authority.

In Hong Kong, complaints may be made to the Office of the Privacy Commissioner for Personal Data.

Requests can be sent to: privacy@keelfolk.io.

13. Children

Our services are not directed to individuals under 18. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be published on the website with a revised effective date.

15. Contact

For privacy matters, contact:

AR HANG SERVICE (HK) LIMITED

Room A17, 29/F, Ning Jin Centre,

7 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong

Email: privacy@keelfolk.io

Phone: +852 6123 4567