Personal data means any information about an individual from which that person can be identified. It does not include data where the individual’s identity has been removed (anonymous data).

For each category of personal data and sensitive personal data listed below, Qiddiya processes this data only for specific, clear and lawful purposes as described in this Candidate Privacy Notice. Our processing is underpinned by a clear legal basis as required by the KSA PDPL and its Regulations.

Qiddiya may collect and obtain the following types of personal data:

•  Personal Identifiers - Full name, Date of birth, Age, Gender, Marital status, National identification number or passport number, Signature
•  Contact Information - Home address, Phone number, Email address, Emergency contact details, Social media account (LinkedIn)
•  Professional Information - CV/resumé, Work experience, Skills, Company entity, Job title, Line reporting manager, Office location, Start date, End date and reason for termination, Performance rating, References, Current salary, Salary expectations, Actual salary wage and expectation, Professional membership, Qualifications certifications 
• Education & Skills - Educational degrees, Education and training history, Academic grade 
•  Financial Information - Bank statements, Benefits and entitlements, Compensation data, Bank account numbers
•  Assessment Information - Interview notes, Test results, Results from reference background checks where lawful and relevant to the role 
• Immigration Status - Such as Resident, or Work Visa Holder • Others - Any other personal data that you provide during the job search, application, or interview process with Qiddiya. 

Sensitive personal data requires a higher level of protection. Therefore, additional justification is necessary before processing such data. We will process the following categories of sensitive personal data strictly in accordance with applicable legal requirements:

• Religious Beliefs (Religion as indicated in Iqama)

• Criminal conviction information, including criminal history or records

Failure to collect the required personal data may result in the consequences or risks including inability to process job applications, track Recruitment Activities which may result in potentially reducing the effectiveness and relevance to manage the recruitment process with you.

Qiddiya collects personal data primarily from you as the candidate and, in some cases, from third parties lawfully involved in the recruitment process. This personal data is gathered during the application and recruitment stages to facilitate and support our activities in a transparent and lawful manner.

Information you give us: Directly from you when you:

▪ Apply for a job or internship with us, submit your CV or application, participate in interviews or assessments, register on our recruitment portal, attend recruitment events, or otherwise engage with us as a candidate.

Information collected automatically: Indirectly via:

▪ certain technologies, such as cookies, pixels, tags, APIs, including when you visit our websites and applications; or

▪ collect information using analytics tools, including when you visit our sites or use our applications.

Information from third parties: We may collect personal data from third-party sources, including professional networking platforms such as LinkedIn, recruitment agencies, background check providers like HireRight, applicant tracking systems such as Workable, public databases, and references you have authorized us to contact.  

At Qiddiya, we may process the above types of personal data collected in connection with our Recruitment Activities based on the lawful basis for processing personal data, and we rely on your consent for the following activities:

• Recruitment Activities: Managing and advancing your application includes verifying your details, reviewing qualifications, and issuing offers. If successful, this leads to creating your employment record. The process also involves assessing your skills, experience, and fitness for the role, organizing and conducting interviews or assessments, and maintaining communication with you throughout recruitment.

• Background and Reference Check Purposes: Where relevant and applicable, carrying out background checks and reaching out to referees to confirm the accuracy of your information.

If any activity has relied on your consent, you may withdraw that consent at any time. If you decline to provide personal data, we may be unable to progress with the Recruitment Activities and to provide you with the relevant service or offering as described above. 

We take our responsibility to protect your personal data very seriously. Although we do our best to protect your personal data, we cannot guarantee the security of your information transmitted through the Website, over email or any other digital channel; any transmission is at your own risk.

Qiddiya will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected during the recruitment process unless a longer retention period is required or permitted by applicable laws and regulations. Your personal data will be stored securely, either with cloud service providers or on on-premises servers.

The retention period for each category of personal data depends on the nature of the information, the Recruitment Activities involved, the jurisdictions in which we operate, and the relevant legal or regulatory requirements.

If your application for a job is successful and you become an employee, your personal data will be processed under the Employee Privacy Policy that will be provided to you and retained for a defined period after your employment ends as set out in the Employee Privacy Policy, in line with applicable legal and regulatory requirements. If your application for a job is not successful and you do not become an employee, your personal data will be retained for twenty-four (24) months from the date of your application submission on workable or for any longer retention period required for audit purposes or permitted by applicable laws and regulations.

Once your personal data is no longer needed for recruitment purposes, we will securely destroy it using methods that prevent access, recovery, or misuse. In some cases, we may anonymize the data so that it can no longer be linked to you.

We have in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

In order to manage our Recruitment Activities with you, Qiddiya may disclose your personal data to the following parties, either regularly and/or on one-time basis, including but not limited to, in accordance with the personal data usage described above.

• With our subsidiaries and affiliates, and entities within the Qiddiya corporate family.

• With our service providers performing services on our behalf. These companies are prohibited from using your personal data for purposes other than those requested by us or as required by law.

• With third parties when you direct us to share your personal data with third party sites or platforms, such as social networking sites.

• With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

• With third parties to ensure the safety and security of our customers and third parties, to protect our rights and property and the rights and property of our customers and third parties, to comply with legal processes, or in other cases if we believe in good faith that disclosure is required by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. 

The personal data that we collect from you may be accessed from, transferred to, and stored and used in countries outside the Kingdom, by us and by our third-party service providers or partners. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Candidate Privacy Notice.

Where legally required under the KSA PDPL and the Regulations, transfers of personal data outside the Kingdom will take place to jurisdictions deemed to provide an adequate level of protection for personal data by the relevant competent authority in the Kingdom or alternatively will take place on the basis of an appropriate safeguard or exception.

Subject to applicable privacy laws, you may be able to exercise certain rights in relation to your personal data, including:

• The right to be informed: You have the right to be provided with information about how we use your personal data, and about your rights.

• The right to access: You have the right to access your personal data held by us.

• The right to obtain a copy: You have the right to obtain a copy of your personal data held by us.

• The right to request rectification: You can request the correction or update of any incomplete, inaccurate, or outdated personal data that Qiddiya has collected.

• The right to request destruction of personal data: You have the right to request the deletion of your personal data collected by Qiddiya, including any data shared with third parties. However, please note that Qiddiya may retain such information in accordance with applicable laws and regulations.

• The right to withdraw consent: Where we rely on consent to process your personal data, you have the right to withdraw this consent at any time. You can withdraw consent by filling out the Data Subject Request Form online or or by emailing  DataOffice@qiddiya.com with the same information requested in the Data Subject Request Form.

• The right to file a complaint: You have the right to file complaint with us or to the competent authority when you feel that your rights have not been met.

Unless required by law, you will not incur any fees for exercising this right.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We will respond to all legitimate requests within 30 days of receiving it, however, it may take us longer if your request is particularly complex.

You may submit a request to exercise your rights by filling out the Data Subject Request Form online or by emailing  DataOffice@qiddiya.com with the same information requested in the Data Subject Request Form.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. Your rights may also depend on the jurisdiction in which you reside. 

While we take reasonable steps to protect your personal data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access to your personal data you may be aware of. 

Please note that any personal data you submit during the job registration process, the jobs you view and apply for, and messages exchanged through our third-party platforms are subject to the privacy policies of those third parties. Additionally, our website may contain links to third-party websites or services that we do not operate or control. This Candidate Privacy Notice does not apply to such third-party websites or services, and we are not responsible for their privacy practices, content, or use of your information. We encourage you to review the privacy and cookie notices of these third parties before sharing any personal data with them. 

From time to time, we may modify or update this Candidate Privacy Notice, including reflecting changes in our privacy practices and legal obligations or in accordance with applicable data protection laws and regulations. Please check the Website regularly for notices of changes to our Privacy Policy.

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Policy, the English language version will prevail.