Wow, this is a funny situation.
The fact that a resume (CV where I come from) can potentially contain a whole lot of PII, makes it an interesting issue.
Under GDPR, they'd be in trouble, I think. You have given them your personal information, with the express permission to forward this on to potential recruiters in industry. The unauthorized disclosure to third parties (Outside of their data processing agreement) would constitute a breach. In China, who knows.
However, from a personal point of view, one could argue having your resume floated on the internet is a potentially wonderful thing, should it be up to date and accurate.
I'd go with "it's a minefield" on this occasion
