Privacy Policy

Last updated: 25 May 2026 · Effective: 25 May 2026 · Entity: Talent Fiji Pte Limited

Bula. This Privacy Policy explains how Talent Fiji Pte Limited ("Talent Fiji", "we", "us", "our") collects, uses, shares, and protects your personal information when you use talentfiji.com or any related applications (the "Service").

We have written this in plain language. If anything is unclear, email [email protected].

1. Who this Policy applies to

This Policy applies to anyone whose personal information we process through the Service — Candidates, Employers, recruiters acting on behalf of Employers, and visitors to our public pages.

We are the data controller for the personal information described in this Policy. For information processed on behalf of an Employer (for example, where an Employer uses our applicant tracking features to manage applicants who have applied to that Employer's Listings), the Employer and Talent Fiji are independent controllers of their respective processing activities, and the Employer is responsible for its own compliance.

2. Legal framework we honour

• (a) Fiji — Section 24 of the Constitution of Fiji (2013), which recognises a right to privacy including the right to confidentiality of personal information; common-law confidentiality obligations; and any Fijian privacy or data protection legislation in force at the time of processing.
• (b) New Zealand — for processing of NZ-based individuals' information, the Privacy Act 2020 and the Information Privacy Principles.
• (c) Australia — for processing of AU-based individuals' information, the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• (d) Cross-border data transfers — where data is transferred outside the originating jurisdiction (notably to our US-based and EU-based infrastructure providers), we rely on contractual safeguards and equivalent-protection principles set out in the relevant statute.

3. What information we collect

3.1 Information you provide directly

• Account: full name, phone number, email address, encrypted password, country of residence.
• Candidate profile: professional headline, summary, skills, work experience, education, languages, certifications, desired role categories, desired locations, desired salary range, availability, optional profile photograph, optional CV upload.
• Employer profile: company name, business address, contact details, industry, company size, website, optional company description, logo, cover image.
• Listings (Employer): role title, description, requirements, location, employment type, salary range (optional), application instructions.
• Applications (Candidate): application details, optional cover letter, attached CV, optional answers to Employer-set questions.
• Communications: messages between Candidates and Employers; support and feedback emails.
• Billing (Employer): billing contact name and email, business address for invoicing, organisation tax or VAT details where required.

3.2 Information collected automatically

• Device and usage data: browser type, operating system, IP address, timezone, language preference, pages visited, features used, referring page.
• Cookies and similar technologies: see our Cookies Policy.
• Application telemetry: error and crash reports, configured to scrub CV content, message bodies, and other sensitive personal information.

3.3 Information from third parties

• Sign-in providers: if you use Google, Microsoft, or another approved OAuth provider, we receive the email address, name, and profile picture associated with that account.
• Verified Employer programme: publicly-available business registration information and any references provided by the Employer to verify identity and operating status. Verification is editorial — granted by a Talent Fiji administrator.

3.4 What we explicitly do NOT collect

• (a) Payment card data. Talent Fiji is invoice-only and does not handle credit or debit card information.
• (b) Biometric data.
• (c) Information from children under 16. Accounts require a minimum age of 16 (Candidates) or 18 (Employers). Age is self-attested at signup; we delete accounts we discover to be under-age.
• (d) Special-category data — unless you choose to disclose it. We do not require race, religion, health, sexual orientation, political opinion, or trade union membership data. If you voluntarily include such information in your profile, we do not use it to make decisions about you, and we do not surface it to Employers as a filter or ranking signal.

4. How we use your information

• (a) Operate the Service — create and manage accounts, display profiles, deliver applications, transmit messages, generate invoices, run search and filtering features, send transactional notifications.
• (b) Communicate with you — send account-related emails, application notifications, payment receipts, and operational announcements.
• (c) Improve the Service — analyse aggregate, de-identified usage patterns to fix bugs and develop features.
• (d) Protect the Service — detect and prevent fraud, abuse, harassment, and breaches of our Terms or Acceptable Use Policy. Includes content moderation of Listings and messages, with human review of flagged items.
• (e) Comply with legal obligations — respond to lawful requests, retain transaction records for tax purposes (Fiji Revenue and Customs Service requirements, currently 7 years), meet anti-discrimination, employment, and consumer protection obligations.

We do NOT use your personal information to:

• Rank or filter Candidates in our public search results — public Listing search is deterministic, based on Listing tier, recency, and Employer-set filters.
• Auto-apply on a Candidate's behalf, auto-reject an applicant, or auto-publish a Listing. AI is used by Employers as a decision aid only; every hiring decision is made by a human.
• Sell, lease, or rent your personal information.
• Display third-party advertising of any kind on the Service.
• Build advertising or behavioural profiles for use by third parties.

5. Legal bases for processing

• (a) Performance of a contract — to provide the Service you have signed up for.
• (b) Consent — for optional features such as daily-jobs broadcasts, marketing emails, and non-essential cookies.
• (c) Legitimate interests — to maintain platform security, detect and prevent fraud, comply with the Acceptable Use Policy, and improve the Service.
• (d) Legal obligation — to comply with tax, regulatory, employment, and other statutory requirements.

You can withdraw consent for any optional processing at any time through your account settings or by emailing [email protected].

6. Who we share your information with

6.1 Other Users of the Service

• Employers see Candidate profiles in accordance with the Candidate's visibility settings, and the personal information of Candidates who apply to that Employer's Listings.
• Candidates see Employer profiles and public Listings; messages from Employers to whom they have applied.

6.2 Service providers (processors)

• Railway Corp. (US) — application hosting.
• Cloudflare, Inc. (global edge) — DDoS protection, CDN, Turnstile captcha, bot detection.
• Supabase, Inc. (US, EU, AU regions) — database, authentication, file storage.
• Resend, Inc. (US) — transactional email delivery and authentication email (SMTP integration with Supabase Auth).
• PostHog Inc. (US) — aggregated product usage analytics.
• Sentry, Inc. (US) — application error and crash diagnostics, configured to scrub personal information from error payloads before transmission.
• Anthropic, PBC (US) — AI text generation for the Employer-facing Job Description writer, Job Description quality score, Applicant Summary, and daily Applicant Shortlist email. Inputs are subject to bias-mitigation processing — see Section 4 of the Terms.
• Xero Limited (NZ) — invoice generation and reconciliation. Receives Employer billing-contact details and invoice line items only.

6.3 Authorities and legal requirements

We may share information with regulators, law enforcement, courts, or other authorities when required by law, when responding to lawful process, when necessary to protect our rights or the safety of users, or in connection with a sale, merger, acquisition, or insolvency of Talent Fiji.

6.4 What we never do

We never sell your personal information. We never share your information with advertising networks. We never disclose Candidate personal data to Employers other than those to whom you have applied.

7. International data transfers

Your personal information may be stored, accessed, or processed in:

• United States — Railway, Supabase (US regions), Resend, PostHog, Sentry, Anthropic, Cloudflare.
• European Union — Supabase (EU regions), Cloudflare edge locations.
• Australia / New Zealand — Supabase (AU regions), Cloudflare edge locations, Xero (NZ).

By using the Service, you consent to this cross-border transfer of your information. For NZ-based individuals, transfers are conducted in accordance with the cross-border disclosure provisions of the Privacy Act 2020. For AU-based individuals, transfers are conducted in accordance with Australian Privacy Principle 8.

8. How long we keep your information

• Active account data — lifetime of the account.
• Candidate applications — lifetime of Candidate account, then up to 12 months after account closure.
• Employer Listings — lifetime of Employer account; archived 90 days after Listing expiry.
• Messages — lifetime of the parties' accounts.
• Invoices and payment records — 7 years from transaction date (Fiji Revenue and Customs Service requirement).
• Support tickets — up to 3 years from resolution.
• Security and access logs — typically 90 days, then aggregated or discarded.
• Closed account data — soft-deleted immediately on closure (the account is signed out and disabled). Full hard-deletion runs on a manual review-and-delete basis today; you can request expedited hard-deletion at any time by emailing [email protected].

9. Your rights

• (a) Access — request a copy of the personal information we hold about you, including via our self-service account export.
• (b) Correction — ask us to correct information that is inaccurate or incomplete.
• (c) Deletion — ask us to delete your information.
• (d) Portability — request an export of your personal data in a structured, machine-readable format (JSON). Available via your account settings or by email.
• (e) Restriction — ask us to limit how we use your information in certain circumstances.
• (f) Objection — object to processing based on our legitimate interests.
• (g) Withdraw consent — for any optional processing.
• (h) Lodge a complaint — see Section 13.

To exercise any of these rights, email [email protected]. We aim to respond within 30 days.

10. Security

• TLS 1.2+ encryption in transit (managed by Cloudflare in front of our origin).
• Encryption at rest for data stored in Supabase, including database, file storage, and authentication tables.
• Row-Level Security policies in our database — every table enforces per-user access at the database layer.
• Multi-factor authentication available and recommended for administrative accounts.
• Principle of least privilege for internal access.
• Continuous dependency monitoring via Dependabot.
• Responsible-disclosure programme: [email protected].
• PII scrubbing in error logs — CV content, message bodies, email addresses, and similar personal data are stripped from Sentry payloads before transmission.
• Content Security Policy headers on every page; bot protection via Cloudflare Turnstile.

If you suspect unauthorised access to your account, contact [email protected] immediately.

11. Children's privacy

The Service is not intended for users under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact [email protected] and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email and posted on this page at least 30 days before they take effect.

13. Complaints and contact

To raise a privacy concern with us: [email protected].

If your complaint is unresolved, you may also contact:

• Fiji — the Online Safety Commission of Fiji for matters concerning online content; the Fiji Human Rights and Anti-Discrimination Commission for employment-discrimination matters.
• New Zealand — Office of the Privacy Commissioner (privacy.org.nz).
• Australia — Office of the Australian Information Commissioner (oaic.gov.au).

Vinaka.