How we handle your personal data

This policy explains what personal data WiseCloud collects, why we process it, who we share it with and your rights. WiseCloud operates from the Philippines and Hong Kong, and we handle personal data in line with the Philippine Data Privacy Act of 2012 (RA 10173), the Hong Kong Personal Data (Privacy) Ordinance, and the EU GDPR where it applies. Last updated: 1 March 2026.

Who we are

WiseCloud is the data controller responsible for the personal data described in this policy. We help companies build and run dedicated development teams in the Philippines, which means we process personal data about candidates, the people who work in our clients' teams, our business contacts and visitors to this website.

WiseCloud operates through two legal entities — Wisecloud Inc. in the Philippines (SEC Registration No. 2020060000494-05) and Wisecloud Limited in Hong Kong (Business Registration No. 73535634) — which act as the controllers of your personal data. You can reach us using the contact details below.

Philippines: Wisecloud Inc., High Street South Corporate Plaza, 26th St, BGC, Taguig, Metro Manila
Hong Kong: Wisecloud Limited, Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong
Email: info@wisecloud.se · Data Protection Officer: dpo@wisecloud.se

What personal data we collect

The data we hold depends on your relationship with us.

Candidates: name, contact details, CV/résumé, work and education history, skills, certifications, salary expectations, interview notes, assessment results and any information you choose to share with us.
Client and partner contacts: name, job title, work email, phone number and correspondence related to our services.
Website visitors: technical data such as IP address, browser type and pages visited, and any details you submit through forms on this site.
We do not intentionally collect special-category data (e.g. health, religion, political opinions). Please do not include such information in your CV or messages.

How we collect it

We collect personal data directly from you and, for recruitment, from sources you would reasonably expect.

Directly from you — applications, forms, email and conversations.
From publicly available professional sources, such as LinkedIn and job boards.
From referrals, where someone recommends you for a role.
Automatically through the website (see the Cookies section below).

Why we process your data and our legal basis

We only process personal data where we have a lawful basis under applicable data protection law.

Recruitment and matching candidates to roles — based on our legitimate interest in running a recruitment business and, where applicable, taking steps at your request before entering an employment relationship, or your consent.
Delivering our services to clients and managing their teams — based on performance of a contract.
Communicating with you and responding to enquiries — based on legitimate interest.
Meeting legal, accounting and tax obligations — based on legal obligation.
Operating and securing this website — based on legitimate interest.
Where we rely on consent (for example, keeping your details for future opportunities), you can withdraw it at any time.

Who we share it with

We never sell your personal data. We share it only where necessary, with:

Prospective employers / clients — when we present you as a candidate, with the relevant information for that role.
Service providers acting on our behalf (sub-processors), under written agreements that limit how they may use your data. Our current key sub-processors include Anthropic (the Claude API and Claude for Work / Team plan, used to assist with CV parsing and candidate matching — see 'AI and automated processing' below), Google Workspace (email, documents and storage), and Loopia AB (website and database hosting in Sweden). An up-to-date sub-processor list is available on request.
Professional advisers and authorities, where required by law.
All providers are bound to process data only on our instructions and to keep it secure.

International transfers

Because WiseCloud operates from the Philippines and Hong Kong and uses service providers in various countries, your personal data may be transferred to and processed outside your home country.

When we transfer data across borders we put appropriate safeguards in place — such as contractual protections — so it continues to receive an adequate level of protection. For personal data protected by the EU GDPR, we rely on the European Commission's Standard Contractual Clauses.

How long we keep it

We keep personal data only for as long as needed for the purpose it was collected for, or as required by law.

As a guide, we keep candidate data for up to 24 months after our last meaningful contact, after which it is deleted or anonymised — unless you have asked us to keep it longer for future opportunities, or we have a legal reason to retain it.

Your rights

Subject to applicable data protection law (including the Philippine Data Privacy Act and, where it applies, the GDPR), you have the right to:

Access the personal data we hold about you.
Have inaccurate or incomplete data corrected.
Request erasure of your data ('right to be forgotten').
Restrict or object to our processing.
Receive your data in a portable format.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) or the data protection authority in your jurisdiction.

AI and automated processing

We use AI tools — Anthropic's Claude API and Anthropic's Claude for Work (Team) plan — to help our recruiters read and structure CVs, extract key information such as skills, experience and education, match candidates to open roles, and draft summaries. Our team uses Claude only through these business-tier services; we do not use personal/consumer Claude accounts for any candidate or client data. This makes recruitment faster and more consistent, and we want to be transparent about how it works.

A human recruiter always reviews AI-assisted output and makes the final decisions about whether to contact, interview, present or hire a candidate. AI assists this work; it does not make hiring decisions on its own. Because there is always a human in the loop, our recruitment does not constitute solely automated decision-making within the meaning of data protection law (for example, GDPR Article 22 and the equivalent provisions of the Philippine Data Privacy Act).

To enable this processing, the relevant candidate data is transmitted to Anthropic's services. We process this data under Anthropic's commercial terms (for the API) and Anthropic's Claude for Work / Team terms (for our business team accounts) — both of which contractually prohibit Anthropic from using our data to train their AI models, and both of which incorporate Anthropic's Data Processing Addendum (anthropic.com/legal/data-processing-addendum) by reference. Anthropic's processing may occur on servers outside the Philippines, Hong Kong and the EU/EEA, and the safeguards described under 'International transfers' apply.

What our AI tools do: parse CV text into structured profiles, extract skills and experience, match candidates against job descriptions, and generate draft summaries for a recruiter.
What our AI tools do not do: make final hiring decisions; reject candidates without a human review; train Anthropic's models on your data (this is contractually prohibited under our commercial use of Anthropic's services).
Your rights regarding AI: you can request a human review of any AI-assisted assessment, object to AI processing of your personal data, and exercise the other rights listed under 'Your rights' above.

Philippine Data Privacy Act (RA 10173)

Our Philippine operations are governed by the Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission (NPC). As a Personal Information Controller, we are committed to processing personal data fairly, lawfully and securely.

We have appointed a Data Protection Officer (DPO) — Kenny Johansson — who oversees our compliance and is your point of contact for privacy matters at dpo@wisecloud.se. [NPC registration of our data processing system is being reviewed for our headcount and volume of data subjects.]

Contact our Data Protection Officer, Kenny Johansson: dpo@wisecloud.se
You may file a complaint with the National Privacy Commission (privacy.gov.ph).
If a personal data breach is likely to cause harm, we will notify the NPC and affected individuals within 72 hours, as required by law.

Hong Kong Personal Data (Privacy) Ordinance

Our Hong Kong entity processes personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) and its six Data Protection Principles, overseen by the Office of the Privacy Commissioner for Personal Data (PCPD). This governs how we collect, use, keep accurate, retain, secure and provide access to personal data, and you may contact the PCPD if you have an unresolved concern.

Cookies and this website

This site uses only what is needed to function. We store a small preference in your browser to remember your light/dark theme choice, and we do not use advertising or cross-site tracking cookies.

Some pages embed third-party content, such as maps, which may set their own cookies when loaded. If you submit a form, the information is sent to our systems so we can respond to you.

How we protect your data

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access — including access controls, encryption in transit and limiting access to those who need it. No system is completely secure, but we work to keep your data safe and to respond quickly if something goes wrong.

Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the 'last updated' date at the top.

Questions about your data?

To exercise any of your rights, or if you have questions about how we handle your personal data, get in touch and we'll be happy to help.