Privacy Policy

Placeholders to fill before publishing are marked like [COMPANY LEGAL NAME]. Replace all of them. Have this document reviewed by a qualified Saudi lawyer before going live — it is a strong starting draft, not legal advice.

HireXnow ("HireXnow", "we", "us", "our") is a recruitment platform operated by [COMPANY LEGAL NAME], commercial registration number [CR NUMBER], registered at [REGISTERED ADDRESS]. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you use our website and services (the "Platform").

We are committed to handling personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations, as supervised by the Saudi Data & Artificial Intelligence Authority (SDAIA). For the purposes of the PDPL, HireXnow acts as the data controller for the personal data described below.

By creating an account or using the Platform, you confirm that you have read and understood this Policy.

1. Who this Policy applies to

This Policy applies to two main groups of users:

• Candidates — individuals who create a profile, browse jobs, or apply to opportunities through the Platform.
• Employers — organisations and their authorised representatives who post jobs and review applications.

It also applies to visitors who browse the Platform without an account.

2. Personal data we collect

From candidates: full name, email address, phone number, location/city, nationality and residency status (where you choose to provide it), CV/resume and its contents, work history, education, skills, links to professional profiles, and any other information you submit in your profile or application.

From employers: company name, commercial registration details, the name, job title, email, and phone number of authorised representatives, billing information (where applicable), and the content of job postings.

Collected automatically: IP address, device and browser type, log data, and usage information collected through cookies and similar technologies (see Section 11).

We do not require you to provide sensitive personal data (such as data revealing health, religious belief, or ethnic origin). Please do not include such data in your CV or messages unless strictly necessary, and only where you have given explicit consent for us to process it.

3. Legal basis for processing

We process personal data under one or more of the lawful bases recognised by the PDPL:

• Consent — which you provide when you tick the consent checkbox at registration and when you submit an application. Consent is our default basis for collecting and sharing candidate profile data with employers.
• Contractual necessity — to provide the services you have signed up for.
• Legitimate interests — to operate, secure, and improve the Platform, provided this does not override your rights and does not involve sensitive data.
• Legal obligation — where we must process data to comply with applicable law.

Consent is not a precondition for receiving an unrelated service, and you may withdraw consent at any time (see Section 7).

4. How we use personal data

We use personal data to: create and manage your account; match candidates with relevant jobs; allow employers to review applications; enable communication between candidates and employers; verify employer identity and award the Verified Employer badge; review and approve job postings before they go live; investigate reports of fake or fraudulent listings; maintain the security and integrity of the Platform; and comply with legal obligations.

5. Sharing and disclosure of personal data

We do not sell candidate personal data, and we do not share candidate data with employers or third parties for marketing or any other purpose without the candidate's permission.

We disclose personal data only as follows:

• To employers — when a candidate applies to that employer's job, or otherwise consents to share their profile. Employers are independently responsible for their use of candidate data once shared.
• To service providers — hosting, authentication, analytics, and similar processors who act on our instructions under a data processing agreement, solely to operate the Platform.
• To authorities — where required by Saudi law, court order, or a lawful request from a competent authority.

Any disclosure is supported by a legal basis and limited to what is necessary.

6. Cross-border transfers

Where personal data is transferred or stored outside the Kingdom of Saudi Arabia (for example, by our hosting or service providers), we do so only in accordance with the PDPL and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, using approved safeguards such as Standard Contractual Clauses. [CONFIRM HOSTING REGION AND TRANSFER MECHANISM — e.g. Supabase region, Vercel region.]

7. Your rights

Under the PDPL, you have the right to:

• Access the personal data we hold about you and be informed of how it is processed.
• Correct inaccurate or incomplete data.
• Delete your personal data (the "right to be forgotten"), subject to legal retention obligations.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Object to or restrict certain processing.
• Port your data, where applicable.

To exercise any of these rights, use the "Request data deletion" option in your account settings, or contact us at [PRIVACY CONTACT EMAIL]. We will respond within 30 days. If you believe your rights have been breached, you may file a complaint with us within 90 days of becoming aware, and you may also escalate to SDAIA.

8. Data retention

We retain personal data only for as long as necessary to provide the services and to meet legal obligations. When you delete your account or request deletion, we will erase or anonymise your personal data within [RETENTION PERIOD — e.g. 30 days], except where we are legally required to retain certain records.

9. Data security

We take appropriate organisational, administrative, and technical measures to protect personal data against unauthorised access, loss, or disclosure, including access controls, encryption in transit, and secure authentication. No system is completely secure, but we work to protect your data at all times.

10. Data breach notification

In the event of a personal data breach, we will notify SDAIA without undue delay and no later than 72 hours of becoming aware of it, and we will inform affected individuals promptly where the breach poses a significant risk to their personal data.

11. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. You can control cookies through your browser settings. [ADD LINK TO COOKIE BANNER / SETTINGS IF USED.]

12. Children

The Platform is not intended for individuals under the age of 18, and we do not knowingly collect their personal data.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, notify you through the Platform.

14. Contact us

For any privacy question or to exercise your rights, contact:

[COMPANY LEGAL NAME]
Email: [PRIVACY CONTACT EMAIL]
Address: [REGISTERED ADDRESS]