Privacy policy

At a glance

This website collects very little. We hold what you send us in an inquiry, the CVs candidates submit to join our contractor network, the profile summaries we publish from those submissions, the fuller contractor profiles we keep for contractors we work with, and — only if you allow it — traffic statistics. We do not sell data, run advertising, or build profiles of visitors.

• Contact form: your name, email, optional company, and your message. Kept for up to 24 months.
• CV submissions: the CV you upload and your contact details, reviewed within up to 5 business days. A submission does not publish anything: we ask for your consent separately before a profile summary appears, and a CV is shared with a client only after vetting and an initial interview.
• Analytics: only after you accept, and limited to pages, referrer, device and approximate location. Kept for 14 months.
• No account, no login, no payment details, and no cookies of our own anywhere on this site.

Who we are

Sofia HR Consultancy OPC is a Philippine business that helps companies source, onboard and support Philippine-based independent contractors. We are the personal information controller for the data described here, and we handle it under the Philippine Data Privacy Act of 2012 (RA 10173).

We apply the same standards to every visitor regardless of where you are, so the rights below are available to you whether or not your own jurisdiction requires them.

What we collect

We only collect what you give us, plus the minimum needed to run the site.

• Contact form — name, email address, company name (optional) and your message. Required fields are marked with an asterisk. The form also works without JavaScript, in which case it is submitted directly to our form processor.
• CV submissions — if you send us a CV so we can consider you for the client briefs we work on, we collect the CV file itself, your name, the contact details you give on the form, and your answers to the questions on it. That is described in full under CV submissions below.
• Candidates page — the search terms and filters you type are sent to our own in-house candidate management tool so it can return results. It runs on our own systems, we do not use your search terms to profile you, and no account is created.
• Analytics (only after you accept) — pages viewed, referring site, approximate location derived from your IP address, screen and browser type, and whether you are a new or returning visitor. Google Analytics 4 does not store your IP address.
• Server logs — our hosting provider records standard access logs (IP address, requested URL, timestamp, user agent) for security and troubleshooting.
• Email — if you write to us, we keep the correspondence.

We ask you not to send us sensitive personal information — health, religion, political views, biometrics or government ID numbers — and not to put it in the contact form.

A CV is the one case worth spelling out, because a CV often carries exactly that kind of detail: a photo, a date of birth, a marital status, a nationality, and sometimes an ID number, because that is the convention where the CV was written. We do not ask for any of it, we do not require it, and we do not use it to assess a candidate. Where it appears on a CV you send us, we process it as part of that file, on the same basis and for the same retention period as the rest of the submission, and we delete it with the file. If you would rather we held your CV without those details, tell us and we will remove them.

CV submissions

Submitting a CV is how an independent contractor joins our network of contractor profiles. The application form runs on a separate Sofia HR site and writes straight into our own in-house candidate management system, which we operate ourselves.

Submitting a CV is not a promise of work. We are building a database of contractor profiles, and we contact candidates when a client is interested in a profile — accepting a submission does not reserve work, and we do not guarantee anyone a position by accepting one.

Submitting a CV also does not publish anything. Your profile summary appears on our website only after we have contacted you and you have given your consent separately. Until then, the submission is visible only to Sofia HR.

• What we collect — the CV file you upload, your name, the contact details you give us (an email address, and a phone number if you provide one), and your answers to the questions on the form. Everything else we hold comes from the CV itself.
• Why — to assess your skills against the client briefs we are working on, to contact you if we want to represent you, and to keep a record of the review.
• Legal basis — your consent, given when you submit the form, and the steps needed before any engagement can be agreed. Publishing a profile summary rests on a separate consent of its own, which we ask for before anything appears.
• The second consent — if we want to represent you, we contact you and ask you to agree to the Data Privacy Agreement for our candidate management system. That agreement covers publication and the rest of the profile relationship. Nothing about you appears publicly unless you agree to it.
• What is published — once you have consented, a profile summary on our Candidates page, visible to clients and to anyone reading the site: your first name, your role, your skills, your years of experience, and a summary we write. Your last name, your contact details, your rates and the CV file itself are never published.
• How a CV reaches a client — we share your CV with a client only after you have passed vetting and an initial interview. We confirm during that initial interview whether we will share your profile, and that decision is Sofia HR's to make; it is not yours to approve or refuse, and you are not asked to.
• Clients contact us, not you — a client who is interested in a published profile approaches Sofia HR, and we contact you on the client's behalf.
• Bot protection — the form is protected by Cloudflare Turnstile, described under Who else processes it.
• How long — we keep a submission and the record of the review while they are current. Candidates who are promoted into our candidate management system are covered by the retention schedule in How long we keep it, including the inactivity rule described there.
• Removing it — you can withdraw your consent and ask us to delete your CV, unpublish your profile and remove the record of the review at any time by emailing [email protected]. We action it within 30 days.

Submitting a CV does not create an engagement and does not commit you to anything. If a profile interests a client, the next step is a conversation we arrange on the client's behalf — not an offer, and not a guarantee of work.

Contractor profiles

Our Candidates page publishes the profile summaries described above: a first name, role, skills, years of experience, and a summary we write. Those summaries come from CV submissions that have given the separate consent described under CV submissions, and from contractors we work with. They are personal data, and they belong to the people they describe — not to us.

• A profile summary is published only with the consent of the person it describes, and that consent is asked for and recorded separately from the CV submission itself. It can be withdrawn at any time.
• A profile is published only while the person is an active candidate and we have not recorded a declined data privacy agreement.
• A contractor or a candidate can ask us to correct, unpublish or delete their profile summary by emailing us; we action it within 30 days.
• We publish only what a prospective client needs to judge fit — a first name, a role, skills, experience and a summary. Never last names, contact details, rates or documents.
• If you are a contractor or a candidate and are unsure whether your profile is live, ask us and we will check.

Why we use it, and our legal bases

Under the Data Privacy Act we rely on the following bases:

• Your consent — for analytics, for holding and reviewing a CV you submit, and separately, for publishing a profile summary from a submission or a contractor profile and for contacting you on a client's behalf.
• Steps you asked for before entering a contract — answering your inquiry, assessing your CV against a brief, arranging a call, preparing a quote.
• Our legitimate interests — keeping the site secure, understanding which pages are useful, and keeping business records. We balance this against your rights, and you can object at any time.
• Legal obligations — retaining business and tax records where the law requires it.

Concretely: we use your details to reply to you and to keep a record of the conversation; we use a submitted CV to judge your skills against the briefs we are working on, and — once you have given the separate consent described above — to publish a profile summary where clients can see it; we get in touch with you on a client's behalf when one is interested; and we use analytics to see which pages help people. We do not use any of it for advertising, remarketing, automated decision-making, or sale to third parties.

Who else processes it

We use a small number of service providers who process data on our instructions:

• Formspree — receives contact form submissions and forwards them to our inbox.
• Cloudflare — provides Turnstile, the bot-protection check that runs on the CV submission form. Turnstile evaluates signals from the browser and the connection, so Cloudflare sees your IP address and browser details when you submit; it is used only to decide whether the submission is likely to come from a person. We do not use it to track you across other sites, and it plays no part in advertising.
• Google Analytics 4 — measures site traffic, and is loaded only after you accept.
• Our hosting provider — stores the website and its server logs.

The CV intake and the candidate management system behind it are our own tooling, run on our own systems, so they are not listed here as third parties. That includes reading a submitted CV and building the profile from it: the CV text is processed on our own infrastructure, and it is not sent to any third-party AI service. Some of the providers above are outside the Philippines, so your data may be transferred internationally. Where that happens we rely on the provider's contractual protections and transfer only the minimum necessary. Our article content system runs at build time only and never receives visitor data.

How long we keep it

We keep data only as long as we need it:

• Inquiries and correspondence — up to 24 months from our last contact, then deleted.
• CV submissions and candidate profiles — while they are current. A candidate profile with no activity for 12 months is deleted, after a notice email 30 days beforehand. Candidates we have placed, and candidates tied to a filled client requirement, are excluded from that automatic deletion.
• Analytics data — 14 months, after which Google Analytics deletes it automatically.
• Server logs — a short period, only as long as needed for security and troubleshooting.
• Contractor profiles — while the profile is current and consent has not been withdrawn.
• Records we must keep for tax or legal reasons — for the period the law requires, and no longer.

Your rights

Under the Data Privacy Act you have the right to:

• Be informed about how your data is processed.
• Object to processing, including processing based on legitimate interests.
• Access the personal data we hold about you.
• Correct anything inaccurate, and have us block or erase data that is incomplete, outdated or unlawfully held.
• Data portability — receive your data in a commonly used electronic format.
• Be indemnified for damages caused by inaccurate, incomplete or unlawfully obtained data.
• Lodge a complaint with the National Privacy Commission of the Philippines.

Email [email protected] to exercise any of these and we will respond within 30 days. We may ask you to confirm your identity first, and we will explain if we cannot action a request. If you have sent us a CV, asking us to delete it and the record of the review withdraws your consent, and you do not need to give a reason. Withdrawing analytics consent is instant and needs no request — use “Cookie settings” in the footer.

Security and breaches

The site is served over HTTPS, form submissions go directly to our processor without passing through our own servers, and access to inquiry data is limited to the people who need to reply to it. We keep our systems updated and review what we hold.

If a breach affects your personal data and puts you at real risk, we will notify you and the National Privacy Commission as required by law, without undue delay.

Children

Our services are for businesses. This website is not directed at children and we do not knowingly collect personal data from anyone under 18. The CV intake is open to candidates aged 18 or over. If you believe a child has sent us data, contact us and we will delete it.

Changes to this policy

When we change how we handle personal data we update this page and publish a new version number and date. If a change affects what analytics may do, we also bump the consent version, which means every visitor is asked again rather than being covered by an earlier agreement.

Contact us

For any privacy question or request — access, correction, deletion, objection, a candidate asking us to delete a submitted CV, or a contractor asking us to remove their profile — email [email protected]. We respond within 30 days. For general enquiries, use the contact form.

How we use cookies and local storage is set out separately in the cookie policy.