Candidate Privacy Notice (PDPL)
Version 7.0 · effective 5 October 2026
| Data controller | NAZZTEC INFORMATION TECHNOLOGY COMPANY, Regus, Hamad Tower, 4th Floor, King Fahd Branch Road, Al Olaya, Riyadh 12212, Kingdom of Saudi Arabia |
|---|---|
| Privacy contact | privacy@nazztec.com.sa · Data Protection Officer: dpo@nazztec.com.sa |
| Applies to | https://careers.nazztec.com.sa (NAZZTEC Careers) |
| Legal framework | the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom, supervised by the Saudi Data & AI Authority (SDAIA) |
| Version | 7.0 — effective 5 October 2026 |
1. What this notice covers
This notice explains how NAZZTEC INFORMATION TECHNOLOGY COMPANY ("NAZZTEC", "we") collects and uses your personal data when you use NAZZTEC Careers. It supplements the general privacy policy at https://www.nazztec.com.sa/privacy-policy/.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, mobile and optional WhatsApp number, country and city | You |
| Professional profile | Headline, current employer, years of experience, notice period, skills, languages, LinkedIn / GitHub / portfolio links, professional summary, employment and education history | You (and text read from your CV to pre-fill empty fields, which you review) |
| CV and documents | CV / résumé files you upload, verification documents NAZZTEC requests, and text extracted for search | You |
| Application data | Roles applied for, answers to screening questions, cover note, application status and history | You and NAZZTEC recruiters |
| Assessment data | Interview schedules, interviewer feedback and scorecards, offer details | NAZZTEC staff |
| Optional compensation data | Current and expected salary and currency (only if you choose to provide it) | You |
| Consent and acknowledgement records | Which document versions you accepted, when, and keyed one-way hashes of your IP address and browser | Generated by the Portal |
| Security and technical data | Sign-in times, failed sign-in counts, session records, audit log entries, IP address, time zone | Generated by the Portal |
We do not ask for special-category or sensitive data (such as health, religion, ethnicity, biometrics or criminal records) through the Portal. Please do not include it in your CV. If a role later requires lawful background or medical checks, we will tell you separately.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your candidate account | Your consent (PDPL Art. 5) and steps you request |
| Assessing your application, interviews and offers | Your consent and steps preceding a potential employment contract (PDPL Art. 6) |
| Keeping you in the NAZZTEC talent pool for future roles | Your consent — you can withdraw it at any time |
| Sending job alerts | Your separate, optional consent |
| Security, fraud prevention and audit logging | Legitimate interest and legal obligations of the controller (PDPL Art. 6) |
| Compliance with Saudi labour, visa and regulatory requirements | Legal obligation (PDPL Art. 6) |
We do not make recruitment decisions by automated means alone. Matching scores and CV keyword search only help recruiters, who review every application.
4. Who can see your data
- Authorised NAZZTEC recruiters, hiring managers and administrators, on a need-to-know basis. Interviewers see only what they need for their interview and never your contact details.
- Our hosting provider (Massar Cloud, with servers located in the Kingdom of Saudi Arabia) and email provider, acting as processors under contract.
- Other NAZZTEC group companies only where you apply for a role they are hiring for.
- Authorities where the law requires it. We never sell your personal data.
5. Where your data is stored and international transfers
The Portal is hosted on Massar Cloud, with servers located in the Kingdom of Saudi Arabia. If you apply for a role with a NAZZTEC entity outside the Kingdom (India or the United States), the data needed for that application is transferred only as permitted by Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, with appropriate safeguards and your acknowledgement at sign-up.
6. How long we keep it
Profiles with no activity for the retention period set by NAZZTEC (24 months by default) are automatically anonymised. Deleted accounts are erased immediately, except minimal records we must keep to evidence compliance (for example, the audit entry that your data was erased and your consent history, which contains no contact details).
7. Your rights
- Right to be informed about how your data is processed (this notice).
- Right of access to your personal data and to obtain a copy in a readable format — use Download my data.
- Right to request correction of inaccurate or incomplete data — edit your profile at any time.
- Right to request destruction of your data when it is no longer needed — use Delete my account.
- Right to withdraw your consent at any time, without affecting earlier lawful processing.
- Right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).
Self-service tools are on the Privacy & account page. For anything else email privacy@nazztec.com.sa. We respond within 30 days of receiving a verified request, as required by the PDPL Implementing Regulation.
8. Security
The Portal enforces HTTPS, hashes passwords with scrypt, encrypts stored secrets with AES-256-GCM, protects every form against cross-site request forgery, limits sign-in attempts, checks every uploaded file by its content, applies role-based access control and records security-relevant actions in an audit log. Staff accounts require two-step verification.
9. Personal data breaches
If a breach affects your data we will notify SDAIA within 72 hours of becoming aware of it where required, and notify you without undue delay where the breach may cause you harm.
10. Changes
We publish a new version number whenever this notice changes materially, and ask you to acknowledge it the next time you sign in.