Recruitment privacy notice

Introduction

1. This Privacy Notice (Notice) describes how Johnson Stokes & Master (JSM) and its representative offices and consultancy service provider in Mainland China (the JSM Mainland China Entities) collect, use, disclose or otherwise process personal information during any recruitment, selection and subsequent onboarding processes. For information on Tanglau and the specific Tanglau Mainland China Entities, please refer to the Legal Notices section on Tanglau’s website (www.jsm.com). 
2. If you are applying from Mainland China, please read this Notice together with the Mainland China Addendum provided at the end of this document. The Addendum forms an integral part and supplements the information in this Notice. 
3. We are required by applicable data protection laws to provide you with comprehensive details on how we handle your personal information. This invariably leads to lengthy and complex notices filled with technical and legal terminology. To simplify this for you, in summary:
   1. Collection: we are committed to collect only personal information that we consider relevant to the recruitment and subsequent onboarding process (if applicable);  
   2. Use: we use your personal information to administer the recruitment and onboarding process;  
   3. Sharing: we only share personal information as necessary internally and with trusted external third parties.  
   4. Data Security: we maintain technical and organizational measures to protect personal information against unauthorized or accidental access, processing, erasure or loss;
   5. Data Subject Rights: you have the rights to requires access to and correction of the personal information in our records where required by law; and
   6. Contact Us: if you have any questions about this Notice or wish to exercise your rights regarding your personal data, please contact our privacy team at privacy@tanglau.com.

Scope of this Notice

4. The Notice applies to all categories of job applicants including those applying for partner roles, fixed term and permanent positions, dispatched employee positions, agency worker and independent contractor positions, training contracts, internships, secondments, as well as individuals participating in work experience or vacation placements with us. All applicants are referred to as “you” in this Notice. This Notice does not form part of any contract of employment, agreement or other contract to provide services.
5. For the purpose of this Notice, the Tanglau practices (the Tanglau Practices, we, our and us) include both Tanglau and the Tanglau Mainland China Entities. The Firm refers to one or more of the Tanglau Practices. Tanglau and the Tanglau Practice to which you apply (if different from Tanglau) are the data controllers of the personal information you provide during the recruitment and onboarding process.  
6. References in this Notice to employment, work (and similar expressions) include any arrangement we may have under which an individual provides us with work or services, or applies for such work or services, including but not limited to partners of any Tanglau Practices.
7. It is important that you read this Notice, together with any other notices that we provide on specific occasions when we are collecting or processing your personal information, so that you are fully aware of how and why we are using your personal information. This Notice supplements the other notices and is not intended to override them. 

Collection of your personal information

8. We may collect personal information directly from you when you apply for a position with us via any recruitment platforms, by email, by post, or when you participate in the interview and selection process.
9. We may obtain personal information about you indirectly. This could occur, for instance, when you are recommended for a position at the Firm or when we acquire supplementary information from third parties with your consent, like your named referees, your recruitment agents, your past employers or our human resources outsourcing and management agencies (if any). Additionally, we may gather information about you from public and other sources during pre-employment checks. If we do carry out any pre-employment checks, we will inform you during the recruitment process of the exact checks that are going to be carried out. 
10. In order to maximise your opportunities to work with us, you are encouraged to keep the information provided to us up to date at all times. You are responsible for ensuring that the personal information is correct and true.

Personal information we process about you

11. The personal information we collect and process is determined by the specific role you apply for, the location of your role, the stage and the outcome of your application. During the recruitment and/or onboarding process, we may collect and process the following categories of personal information:  

1. 1. basic personal information, including your name, address, email address and telephone number. If you receive and accept an offer from us, additional details including your date of birth, marital status, gender, nationality, country of citizenship, and details about dependents and next of kin (if applicable); 
   2. personal identity information, including ID number and photos on ID card and passport, if you are invited for an interview with us, or when you receive an offer from us; 
   3. personal education and work information, including your educational background, work experience, professional qualifications, language skills, work locations;
   4. recruitment information, including your CV, covering letter and references;
   5. legal and compliance related information, including criminal records, disciplinary, grievance, or similar actions, procedures or proceedings, bankruptcy proceedings, civil litigation and outside interests (e.g. directorship), sanction records, collected as part of our background checks if you are made an offer by us; 
   6. if you receive and accept our job offer, your personal property information, including bank account details (for onboarding related matters); and
   7. any other information you provide voluntarily during the recruitment process, such as your photograph and compensation details. Trainee solicitor and internship applicants may also supply details regarding sexual orientation, ethnic origin, gender identity, and disability on a voluntarily basis in our diversity and inclusion monitoring form.

Purposes for which we process your personal information

12. We may process your personal information listed above for the following purposes:

1. 1. assessing and evaluating your suitability for employment in any current or prospective position within the Firm;
   2. verifying your identity and the accuracy of your personal details and other information you have provided;
   3. to assess whether there are any reasonable adjustments that we may need to make in the recruitment process;
   4. comply with immigration, employment or any other laws or regulations that apply to us;
   5. take steps prior to entry into an employment agreement or service contract with you if your application is successful;
   6. pursue our legitimate interests where permitted under applicable data protection laws, which are not overridden by your rights and freedoms;
   7. protect Tanglau’s systems, business information and employees, including where necessary for the exercise or defence of legal claims or other professional reporting requirements;
   8. we may contact you to ask for your consent as to whether you want to be contacted about future career opportunities with us; and
   9. with your separate consent, conducting pre-employment vetting, including background checks, bankruptcy and civil litigation checks, criminal record checks, employment reference checks and media screening etc. if permitted by law.

Lawful bases for processing your personal information

13. Most commonly we will rely on one or more of the following lawful bases for processing your personal information (where permitted by applicable laws):
    1. where it is necessary for the performance of a contract with you;  
    2. where it is necessary for compliance with a legal obligation to which we are subject; and/or 
    3. where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our legitimate interests include, making informed recruitment decisions and selecting suitable candidates for available roles, facilitating the interview process and communicating offers of employment or partnership.  
14. We may also use your personal information for the following reasons, which are likely to be rare:  
    1. where we need to protect your interests (or someone else’s interests); and
    2. where it is needed in the public interest or for official purposes. 

How we use special categories of personal information

15. “Special categories of personal information” means personal information which require a higher level of protection. This is personal information which reveals or contains racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.  
16. We may process special categories of personal information including sexual orientation, ethnic origin, gender identity, and disability, to ensure meaningful equal opportunity monitoring and reporting. We will process special categories of personal information because we have a lawful basis for doing so (as set out above).  

If you fail to provide personal information

17. There is no negative consequence if you do not wish to provide us with your personal information in the context of submitting an application. However, without providing your personal information when requested which is necessary for us to consider your application (such as evidence of qualifications or work history), it may not be possible to progress your application and your application may be closed. Incomplete or incorrectly completed applications may not be considered. 

Data Sharing

18. We are committed to maintaining the confidentiality of your personal information. However, for the purposes outlined above, we may share, transfer, or disclose your information to the following third parties, who may be located within or outside the jurisdiction where we collect your information:
    1. personnel of Tanglau Practices on a need-to-know basis;  
    2. human resources outsourcing and management agencies and the external recruitment agencies that assist us with the recruitment process (if any);
    3. service providers which carry out the pre-employment checks with us, in the event that you accept an offer of employment from us;
    4. data processors including providers of online recruitment and candidate management systems, and IT and payroll service providers that store and process data on our behalf;
    5. any person to whom we are under an obligation to make disclosure under any requirements of any laws, regulations or governmental bodies; and
    6. any person with your express or implied consent.
19. Personal information may be transferred across borders where necessary for recruitment and hiring purposes. The AllHires platform, which we use to manage applications, is hosted on secure servers in the United Kingdom.  When you submit personal information via AllHires to us, you may be transferring your data across borders. For more information about how AllHires handles your personal information, please refer to AllHires privacy policy. 
20. When we transfer your personal information to third party suppliers and other overseas recipients, we will adopt safeguards under applicable data protection laws before transferring your personal information, for instance, to conduct personal information protection impact assessment, to complete the necessary record filings and obtain government approval if required, as well as to adopt other technical and managerial measures to ensure data security during transmission. Besides, appropriate data protection agreements or contractual clauses are in place to ensure that our third party service providers have appropriate and necessary technical and organisation measures to protect your personal information and are handling your personal information in compliance with all applicable data protection laws.
21. For further information about the third parties receiving your personal information, including the countries/regions they are located, the processing purposes, methods, and the categories of personal information processed, please contact our data privacy team as listed below.

Retention of your personal information

22. If your application is successful we will retain your personal information in accordance with our privacy notice for personnel and our data retention policy. We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal and regulatory requirements.
23. We will retain personal information of unsuccessful applicants for future recruitment purpose for a period of two years unless you expressly inform us not to use your personal information. We retain your personal information for that period so that we may monitor re-applications and to show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. During this period, subject to your agreement, we may also use your personal information to consider whether to invite you to apply for future vacancies or to alert you to future vacancies which we believe will be of interest to you. After this period, we will securely destroy your personal information in accordance with our data retention policy.

Data Security

24. We have put in place appropriate security measures to protect the security of your information and to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Details of those measures are available on request. In addition, our personnel, agents, contractors and other third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
25. We have also implemented comprehensive policies to ensure the security of your personal information. These policies establish guidelines that must be adhered to by all individuals within the Firm with access to your personal information, providing a framework for its adequate protection. Additionally, we have established procedures to address any suspected data security breaches. In the event of such an occurrence, we will notify you and any applicable regulator as required by law.

Your rights and method to exercise your rights

26. You have certain rights under the applicable data protection laws that you can exercise under certain circumstances in relation to the personal information that we hold. These rights include:
    1. the right to have personal information erased;
    2. the right to object to, or request restrictions on, processing;
    3. the right to obtain information regarding the processing of your personal data and access to the personal data;
    4. where consent was provided for certain processing activities, the right to withdraw your consent to the collection, processing, use and/or disclosure of your personal data at any time;
    5. the right to receive some personal data in a structured, commonly used and machine-readable format and/or request that we transmit or transfer that data to a third party where this is technically feasible;
    6. the right to request that we rectify your personal data if it is inaccurate or incomplete; and
    7. the right to object to any decision based solely on automated processing, including profiling, which produces legal consequences concerning you, or other seriously impactful consequences and to require such decision to be reviewed manually.
27. If you would like to exercise any of these rights, please contact us using the contact information provided below. We will handle your requests in compliance with applicable laws and within a reasonable timeframe. It is recommended that you provide supporting documents that verify your identity and provide a clear and specific description of your request. Please note that in accordance with applicable laws, we may charge a fee for accessing your information, if permitted.

Contacting Us

28. If you have any questions about this Notice, including requests to exercise your legal rights, please contact our data privacy team by email at privacy@tanglau.com or use the contact details provided here.
29. You have the right to lodge a complaint with a relevant data protection authority if you believe that our processing of your personal data violates applicable data protection laws. If you have a complaint about our handling of your personal data, we would appreciate the opportunity to deal with your concerns before you approach any regulator.

Effect of this Notice and Changes to Notice

30. This Notice shall apply in conjunction with any other policies, notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal information by us.

Last updated: July 2025

---

Mainland China Addendum to Recruitment Privacy Notice

1. This privacy policy applies to candidates applying for a position at a Tanglau Mainland China Entity (we, or our).
2. This Mainland China Addendum supplements and constitutes an integral part of the Recruitment Privacy Notice above.

Transferring and Sharing of your information

3. We may transfer your personal information out of Mainland China to Tanglau in Hong Kong for the purposes of considering individuals for employment and to manage on-boarding procedures if your application is successful. The information may be initially transferred to a Hong Kong service company established by Tanglau named Sekots & Co., Limited, and located at 16-18th Floors, Prince’s Building, 10 Chater Road, Central, Hong Kong (the Overseas Recipient), which provides the infrastructure located in Hong Kong for us to store and manage your personal information. Then, the information may be accessed by or shared with Tanglau for further processing to enable Tanglau and the Tanglau Mainland China Entities to achieve the abovementioned purposes.
4. The personal information that may be transferred outside Mainland China includes:

1. 1. basic personal information, including your name, address, email address and telephone number. If you received or accept an offer form us, additional details including your date of birth, marital status, gender, nationality, country of citizenship, details about dependents* and next of kin (if applicable);
   2. personal identity information, including id number and photos on ID card and passport*, if you are invited for an interview with us, or when you receive an offer from us.
   3. personal education and work information, including your educational background, work experience, professional qualifications, language skills, work locations;
   4. recruitment information, including your CV, covering letter and references;
   5. physiological and health information, which may be obtained if you are asked to undergo a health check as a condition of employment with us*; 
   6. legal and compliance related information, including disciplinary records* and outside interests (e.g. directorship) collected as part of our background checks if you are made an offer by us;
   7. if you receive and accept our job offer, your personal property information, including your bank account details* (for onboarding related matters);
   8. other information you provide voluntarily during the recruitment process, such as your photographs and compensation details.

5. The above information with an “*” may be regarded as sensitive personal information under the personal information protection law of Mainland China. If you do provide sensitive personal information with us, you agree that such information may be processed by us as described in this Notice.
6. If you provide us with personal information relating to other persons (such as your family members, your supervisors etc.) located in Mainland China, you are responsible for ensuring the relevant individuals are made aware of the terms of this addendum and Tanglau Recruitment Privacy Notice and that you are legally authorized or entitled to provide us with their personal information. You are also responsible for ensuring that their personal information is accurate and up-to-date, and you transfer the information to us in compliance with applicable data protection laws.
7. You will not be subject to decision that will have a significant impact on you based solely on automated decision-marking.

Your rights in connection with personal information

8. As a personal information subject in Mainland China, you have the rights according to the Personal Information Protection Law (PIPL) which may include the rights set out in the Recruitment Privacy Notice above. We will try our best to support the exercise of your rights according to the law, but please be aware that exercising of your rights may affect the progress of your applications, or we will be subjected to certain constraints. For example, if you would like to delete your personal information provided to us, but the retention period prescribed by the applicable laws and regulations has not expired, or it is technically difficult to delete the personal information, we will cease the processing of the personal information, except for the storage and any necessary measure taken for security protection.
9. If we process your information based on your consent, you will have the right to withdraw that consent. Please be aware that withdrawing consent does not invalidate the processing activities that were carried out based on your consent before the withdrawal.
10. By providing your personal information with us through our online recruitment and candidate management system or providing personal information to us on request, you acknowledge that you have carefully read, fully understood and accepted this Addendum. By accepting this Addendum, you have granted your consent, including the separate consent required under PIPL to authorise us to collect and process your personal information in accordance with this Notice.

Contact Information

11. If you wish to exercise your data subject rights, including the right to withdraw your consent, you may submit your request via email to our privacy team by using the privacy@tanglau.com or use the contact details provided here to reach the Tanglau Mainland China Entities and the Overseas Recipient.
12. In order to facilitate this process and to enable us to assist you, when you make a request to us, please specify the nature of request, and provide us with your name, e-mail and telephone number, and proof of identity. We will use this information solely to validate your request by matching it with our records.

Last updated: July 2025