Privacy Policy

Overview

Owner and Data Controller

• Types of Data Collected
  This Website collects various types of Personal Data, either directly or through third parties, including but not limited to:

  Category	Description
  Identification and Contact Information	Email address, first name, last name, phone number, address, profile picture, User ID, UUID, password (encrypted and securely stored using industry-standard cryptographic algorithms).
  Demographic Information	Gender, date of birth, nationality, country, city, state/province, ZIP/postal code, language.
  Professional Information	Company name, profession, workplace, academic background, number of employees, work history.
  Technical Data	Cookies, usage data, IP address, device information, browser information, operating system, unique device identifiers for advertising.
  Behavioural Data	Clicks, keypress events, mouse movements, scroll position, touch events, browsing history, search history, page views, video views.
  Location Data	Geographic position, latitude, longitude, metro area.
  Interaction Data	Session statistics, number of sessions, session duration, interaction events, custom events.
  Assessment Data	Questionnaire responses, video-based assessment responses, employer-generated assessment content, evaluation materials, skills assessments, competency tests, and other data collected through employer-initiated assessments or candidate evaluation processes.
  Communication Data	Contents of emails or messages, date and time of messages, sender information, user-generated content, answers to questions.

  Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.

  Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Website.

  Unless specified otherwise, all data requested by this Website is required for this Website to provide its Service. In cases where this Website specifically states that some Data is optional, Users are free not to communicate this data, without impacting the availability or the functioning of the Service.

  Where processing is based on consent, under UAE PDPL Users have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, contact [email protected], use the consent management tools in your account settings, or complete the Data Subject Request Form available at https://www.bayt.com/en/data-subject-request/. The Owner will process withdrawal requests within 48 hours of receipt. Where processing is based on contract performance under UAE PDPL, Users understand that certain Personal Data is necessary for the Owner to fulfil its contractual obligations, and failure to provide such Data will prevent the Owner from providing the Service. The Owner will clearly identify which Data is necessary for contract performance at the point of collection.

  Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.

  Cookies – or other tracking tools are used by this Website, or used by the owners of third-party services used by this Website, in providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy. Where required by Applicable DP Law, including for non-essential cookies under UAE PDPL, the Owner obtains User consent before deploying such cookies through a consent banner displayed upon first visit to the Website. Users can manage cookie preferences at any time through their browser settings or the cookie consent management tool accessible in the Website footer. Withdrawal of cookie consent will take effect upon the next page load or within 24 hours, whichever is sooner. Essential cookies necessary for Website functionality do not require consent and cannot be disabled through these tools.

  Users are responsible for any Personal Data they obtain from third-parties , which they publish or share through this Website and, when doing so, must ensure they have obtained all necessary consents and authorizations from such third parties in accordance with Applicable DP Laws, including UAE PDPL. By sharing third-party Personal Data through the Website, Users represent and warrant that they have obtained valid consent from such third parties for the Owner to process their Personal Data as described in this Privacy Policy. Users agree to indemnify and hold harmless the Owner against any claims, damages, or regulatory penalties arising from their failure to obtain such consents or authorisations.

• Mode and Place of Processing Data
  Methods of processing

  The Owner takes appropriate technical and organizational security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of Personal Data. These measures include encryption, access controls, regular security assessments, and employee training on data protection.

  The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner pursuant to written agreements that comply with Applicable DP Law. The updated list of these parties may be requested from the Owner at any time.

  
  

  Place

  The Data is processed at the Owner's operating offices[in the United Arab Emirates and Jordan, and in any other places where the parties involved in the processing (e.g. Users, Employers, Owners, storage servers etc) are located. For a complete list of processing locations and jurisdictions where Personal Data may be transferred, please refer to the section on cross-border data transfers or contact the Owner.

  Depending on the User's location, data transfers may involve transferring the User's Personal Data to a country other than their own The Owner primarily stores data on servers located in Frankfurt, Germany. Please see the cross-border transfer section of this privacy policy.

• The Purposes of Processing
  Personal Data concerning the User is collected based on the following legal bases under Applicable DP Law and for the following purposes:

  
  

  (a) Performance of contract: to provide the Service, including Registration and authentication, Access to third-party accounts, Displaying content from external platforms, Handling payments, Contacting the User, Social features, Managing support and contact requests, and User database management;

  
  

  (b) Legal obligations: to comply with its legal obligations, respond to enforcement requests, and maintain records as required by law;

  
  

  (c) Legitimate interests: to protect the Owner's rights and interests (or those of its Users or third parties), detect malicious or fraudulent activity, and for Tag Management, Spam and bots protection, Hosting and backend infrastructure, Traffic optimization and distribution, Analytics, and Heat mapping and session recording, provided that such interests are balanced against and not overridden by the User's fundamental rights and freedoms as required by Applicable DP Law;

  
  

  (d) Consent: for Advertising, Content commenting, Remarketing and behavioral targeting, Interaction with external social networks and platforms, and Managing contacts and sending messages where not necessary for Service provision.

  
  

  For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

  
  

  Facebook permissions asked by this Website

  This Website may ask for some Facebook permissions allowing it to perform actions with the User's Facebook account and to retrieve information, including Personal Data, from it. This service allows this Website to connect with the User's account on the Facebook social network, provided by Facebook Inc.

  For more information about the following permissions, refer to the Facebook permissions documentation and to the Facebook privacy policy.

  The permissions asked are the following:

  Basic information

  By default, this includes certain User’s Data such as id, name, picture, gender, and their locale. Certain connections of the User, such as the Friends, are also available. If the User has made more of their Data public, more information will be available.

  About Me

  Provides access to the 'About Me' section of the profile.

  Birthday

  Provides access to the birthday.

  Education History

  Provides access to education history.

  Email

  Provides access to the User's primary email address.

  Hometown

  Provides access to the User's hometown.

  List of Friends

  Publish to the Wall

  Enables the app to post content, comments, and likes to a User's stream and to the streams of the User's friends.

  Work History

  Provides access to work history.

• Detailed Information on the Processing of Personal Data
  Personal Data is collected for the following purposes and using the following services:

  
  

  Access to Third-Party Accounts

  This type of service allows this Website to access Data from your account on a third-party service and perform actions with it.

  These services are not activated automatically, but require explicit authorization by the User.

  Facebook account access (Meta Platforms, Inc.)

  This service allows this Website to connect with the User's account on the Facebook social network, provided by Meta Platforms, Inc.

  Permissions asked: About Me; Birthday; Education History; Email; Hometown; List of Friends; Publish to the Wall; Work History.

  Place of processing: United States – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Advertising

  This type of service allows User Data to be utilized for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on this Website, possibly based on User interests.

  This does not mean that all Personal Data are used for this purpose. Information and conditions of use are shown below.

  Some of the services listed below may use Trackers to identify Users or they may use the behavioral retargeting technique, i.e. displaying ads tailored to the User’s interests and behavior, including those detected outside this Website. For more information, please check the privacy policies of the relevant services.

  Services of this kind usually offer the possibility to opt out of such tracking. In addition to any opt-out feature offered by any of the services below, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section "How to opt-out of interest-based advertising" in this document.

  Google Ad Manager (Google LLC)

  Google Ad Manager is an advertising service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows the Owner to run advertising campaigns in conjunction with external advertising networks that the Owner, unless otherwise specified in this document, has no direct relationship with. This service uses the “DoubleClick” Cookie, which tracks use of this Website and User behavior concerning ads, products and services offered.

  Users may decide to disable all the DoubleClick Cookies by going to: Google Ad Settings.

  In order to understand Google’s use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Meta ads conversion tracking (Meta pixel) (Meta Platforms, Inc.)

  Meta ads conversion tracking (Meta pixel) is an analytics service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Personal Data processing, that connects data from the Meta Audience Network with actions performed on this Website. The Meta pixel tracks conversions that can be attributed to ads on Facebook, Instagram and Meta Audience Network.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google AdSense (Google LLC)

  Google AdSense is an advertising service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Personal Data processing. This service uses the “DoubleClick” Cookie, which tracks use of this Website and User behavior concerning ads, products and services offered. Users may decide to disable all the DoubleClick Cookies by going to: Google Ad Settings.

  In order to understand Google’s use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Direct Email Marketing (DEM) (this Website)

  This Website uses the User's Personal Data, with the User's prior consent where required by Applicable DP Law, to propose services and products provided by third parties or unrelated to the product or Service provided by this Website. Users have the right to opt-out of such communications at any time.

  Personal Data processed: email address.

  Legal basis for processing: Consent (where required by Applicable DP Law) or legitimate interest in promoting products and services, subject to the User's right to object.

  Google Ads conversion tracking (Google LLC)

  Google Ads conversion tracking is an analytics service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that connects data from the Google Ads advertising network with actions performed on this Website.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google Ads Similar audiences (Google Ireland Limited)

  Similar audiences is an advertising and behavioral targeting service provided by Google Ireland Limited that uses Personal Data from Google Ads Remarketing in order to display ads to Users with similar behavior to Users who are already on the remarketing list due to their past use of this Website. On the basis of this Personal Data, personalized ads will be shown to Users suggested by Google Ads Similar audiences.

  Users who don't want to be included in Similar audiences can opt out and disable the use of advertising Trackers by going to: Google Ad Settings.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: Ireland – Privacy Policy – Opt out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  LinkedIn conversion tracking (LinkedIn Insight Tag) (LinkedIn Corporation)

  LinkedIn conversion tracking (LinkedIn Insight Tag) is an analytics and behavioral targeting service provided by LinkedIn Corporation that connects Personal Data from the LinkedIn advertising network with actions performed on this Website. The LinkedIn Insight Tag tracks conversions that can be attributed to LinkedIn ads and enables to target groups of Users on the base of their past use of this Website.

  Users may opt out of behavioral targeting features through their device settings, their LinkedIn account settings or by visiting the AdChoices opt-out page.

  Personal Data processed: device information; Trackers; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  RTB House (RTB House S.A.)

  RTB House is an advertising service provided by RTB House S.A.

  Personal Data processed: Tracker; Usage Data.

  Place of processing: Poland – Privacy Policy – Opt out.

  Poland is within the European Economic Area (EEA). Personal Data processed within the EEA benefits from adequate data protection standards under Applicable DP Laws.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Meta Lookalike Audience (Meta Platforms, Inc.)

  Meta Lookalike Audience is an advertising and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Personal Data processing, that uses Personal Data collected through Meta’s Custom Audience in order to display ads to Users with similar behavior to Users who are already in a Custom Audience list on the basis of their past use of this Website or engagement with relevant content across Meta’s apps and services. On the basis of this Personal Data, personalized ads will be shown to Users suggested by Meta Lookalike Audience.

  Users can opt out of Meta’s use of Trackers for ads personalization by visiting this opt-out page.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Microsoft Advertising Universal Event Tracking (Microsoft Corporation)

  Microsoft Advertising Universal Event Tracking is an analytics service provided by Microsoft Corporation that connects Personal Data from the Microsoft Advertising network with actions performed on this Website.

  Personal Data processed: Trackers; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); Universally unique identifier (UUID); Usage Data.

  Place of processing: United States – Privacy Policy – Opt Out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  WhatsApp Marketing Communications (Promotional Content)

  If you choose to provide separate consent, the Owner may send WhatsApp marketing or promotional messages, including updates on new features, career tools, offers, and relevant communications tailored to job seekers.

  Our lawful basis for sending such messages is your explicit consent, as required under GDPR, UAE PDPL, and KSA PDPL. You may opt out of marketing communications at any time by tapping the opt-out button in the chat or by contacting the Owner directly, without affecting your ability to use the Website’s services.

  Personal Data processed: Answers to questions; contents of the email or message; Data communicated while using the service; date of the message; first name; last name; phone number; profile picture; sender of the message; time the message was sent; user content.

  Place of processing: Ireland – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Google Ads Customer Match (Google LLC)

  Google Ads Customer Match is an advertising service provided by Google LLC that allows matching Personal Data that Users have shared with the Owner to existing Google accounts in order to target them or similar Users with personalized ads. Users can opt out of Google’s use of personalized advertising by visiting Google’s Ads Settings.

  In order to understand Google’s use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Trackers; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example).

  Place of processing: United States – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google Ads enhanced conversions (Google LLC)

  Google Ads enhanced conversions is an advertising service provided by Google LLC that allows the Owner to send hashed first-party conversion Data to Google in order to improve conversion measurements.

  Personal Data processed: address; contact details; email address; first name; last name; phone number; Trackers.

  Place of processing: United States – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google Ads Optimized Targeting (Google LLC)

  Google Ads Optimized Targeting is an advertising service provided by Google LLC that allows the Owner to optimize the available target audience by finding new Users who have interests, demographics or online behaviour similar to Users who have recently engaged with the Owner’s content and ads.

  Users can opt out of Google's use of personalized advertising by visiting Google's Ads Settings.

  Personal Data processed: gender; interests; page views; Usage Data.

  Place of processing: United States – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google Ads Smart Bidding (Google LLC)

  Google Ads Smart Bidding is an advertising service provided by Google LLC that maximizes conversions by using various bidding strategies. These strategies may include optimizing bids based on Customer Match lists as well as the User’s device information and behavioral activity. Users can opt out of Google's use of personalized advertising by visiting Google's Ads Settings.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: device information; page views; search history.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Google Ads Audience Expansion (Google LLC)

  Google Ads Audience Expansion is an advertising service provided by Google LLC that allows the Owner to expand the available target audience by finding Users who have interests, demographics or online behaviour similar to an existing audience selected by the Owner. Users can opt out of Google's use of personalized advertising by visiting Google's Ads Settings.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: gender; interests; page views; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Reddit Ad Targeting (Reddit Pixel) (Reddit, Inc.)

  Reddit Ad Targeting (Reddit Pixel) is an analytics service provided by Reddit, Inc. that connects data from Reddit Ads with actions performed on this Website. The Reddit Pixel tracks conversions that can be attributed to ads on Reddit.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  X Ads conversion tracking (X Corp.)

  X Ads conversion tracking is an analytics service provided by X Corp. that connects data from the X advertising network with actions performed on this Website.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Analytics

  The services contained in this section enable the Owner to monitor and analyze web traffic and may be used to analyse User behavior.

  User ID extension for Google Analytics (Google LLC)

  Google Analytics on this Website makes use of a feature called User ID. This setup allows for a more accurate tracking of Users by associating that User with the same ID over various sessions and devices. It is set up in a way that doesn’t allow Google to personally identify an individual or permanently identify a particular device. The User ID extension might make it possible to connect Personal Data from Google Analytics with other Personal Data about the User collected by this Website. The opt-out link below will only opt you out for the device you are on, but not from tracking performed independently by the Owner. Users have the right to object to all tracking activities. To exercise this right and opt out of tracking performed independently by the Owner, contact the Owner via the email address provided in this privacy policy.

  Personal Data processed: Cookies.

  Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google Analytics Advertising Reporting Features (Google LLC)

  Google Analytics on this Website has Advertising Reporting Features activated, which collects additional information from the DoubleClick cookie (web activity) and from device advertising IDs (app activity). It allows the Owner to analyze specific behavior and interests Data (traffic Data and Users' ads interaction Data) and, if enabled, demographic Data (information about the age and gender).

  Users can opt out of Google's use of cookies by visiting Google's Ads Settings.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Tracker; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); various types of Data as specified in the privacy policy of the service.

  Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Analytics collected directly (this Website)

  This Website uses an internal analytics system that does not involve third parties.

  Personal Data processed: Cookies; Usage Data.

  Google Analytics Demographics and Interests reports (Google Ireland Limited)

  Google Analytics Demographics and Interests reports is a Google Advertising Reporting feature that makes available demographic and interests Data inside Google Analytics for this Website (demographics means age and gender Data).

  Users can opt out of Google's use of cookies by visiting Google's Ads Settings.

  Personal Data processed: Cookies; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example).

  Place of processing: Ireland – Privacy Policy – Opt Out.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Amplitude Analytics (Amplitude Inc.)

  Amplitude Analytics is an analytics service provided by Amplitude Inc.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy; France – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Google Analytics for Firebase (for apps) (Google LLC)

  Google Analytics for Firebase (for apps) or Firebase Analytics is an analytics service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Personal Data processing.

  In order to understand Google's use of Personal Data, consult Google's partner policy.

  Firebase Analytics may share Personal Data with other tools provided by Firebase, such as Crash Reporting, Authentication, Remote Config or Notifications. The User may check this privacy policy to find a detailed explanation about the other tools used by the Owner.

  This Website uses identifiers for mobile devices and technologies similar to cookies to run the Firebase Analytics service.

  Users may opt-out of certain Firebase features through applicable device settings, such as the device advertising settings for mobile phones or by following the instructions in other Firebase related sections of this privacy policy, if available.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Google Analytics 4 (Google LLC)

  Google Analytics 4 is a web analysis service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Personal Data processing, ("Google"). Google utilizes the Personal Data collected to track and examine the use of this Website, to prepare reports on its activities and share them with other Google services. Google may use the Personal Data collected to contextualize and personalize the ads of its own advertising network. In Google Analytics 4, IP addresses are used at collection time and then discarded before Personal Data is logged in any data center or server. Users can learn more by consulting Google's official documentation.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: number of Users; session statistics; Trackers; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Cloudflare Web Analytics (Cloudflare, Inc.)

  Cloudflare Web Analytics is an anonymized analytics service provided by Cloudflare, Inc. that gives the Owner insight into the use of this Website by Users without needing to identify them. Further information may be found here and within the service's privacy policy.

  Personal Data processed: device information; language; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Contacting the User

  Phone contact (this Website)

  Users that provided their phone number and consented to marketing communications may be contacted for commercial or promotional purposes related to this Website. Users will always be contacted for fulfilling support requests when necessary. Users may withdraw their consent for marketing communications at any time by contacting the Owner.

  Personal Data processed: phone number.

  Contact form (this Website)

  By completing the contact form with their information, the User authorizes this Website to use these details to respond to the inquiries (like quotes, and any other requests). The data provided will be processed solely for the purpose of responding to the User's inquiry and will not be used for marketing purposes without the User's separate explicit consent.

  Personal Data processed: company name; country; email address; first name; last name; phone number; profession.

  Mailing list or newsletter (this Website)

  By registering on the mailing list or for the newsletter, the User provides explicit consent to their email address being added to the contact list of those who may receive email messages containing information of commercial or promotional nature concerning this Website. This consent is freely given, specific, and informed in accordance with Applicable DP Law. The User's email address will only be added to this list with explicit consent, which may be obtained during sign-up or after making a purchase. Users may withdraw their consent and unsubscribe from the mailing list at any time through the unsubscribe link in each email or by contacting the Owner. Withdrawal of consent will take effect without undue delay and will not affect the lawfulness of processing based on consent before its withdrawal.

  Personal Data processed: email address; first name; last name.

  WhatsApp System Notifications (System Communications)

  If you choose to provide consent, the Owner may send you system-generated messages via WhatsApp, using the phone number you have registered with. These messages may include verification codes, alerts regarding updates to your CV, notifications of recruiter actions on your profile, or other essential account-related information.

  The Owner processes this data in accordance with the Applicable Data Protection Law.

  The lawful basis for processing under the GDPR is your explicit consent (Article 6(1)(a)), and under UAE PDPL is your freely given, specific, and informed consent.

  You may withdraw this consent at any time by updating your communication preferences within your account settings (under “Notification Settings”) or by contacting us directly at [email protected].

  WhatsApp Notice: WhatsApp is a third-party communication platform. When you opt in, certain Personal Data, primarily your mobile number and message delivery metadata, may be processed or stored by WhatsApp in accordance with its own privacy policy and international data transfer mechanisms. Bayt.com will only use WhatsApp for the purposes for which you have provided your explicit consent.

  Assessment Responses (Including Video and Audio Responses)

  This Website facilitates the collection and transfer of assessment responses from job seekers to employers as part of the recruitment process. When an employer requests an assessment, candidates may be asked to respond to questions using various response formats, which may include written responses, multiple-choice selections, file uploads, or recorded video or audio responses.

  
  

  Assessment Response Data We Collect

  When an employer requests an assessment as part of their recruitment process, the Website may collect:

  • Responses submitted by candidates to employer-provided assessment questions (which may include text responses, selected answers, uploaded files, or recorded responses);
  • Assessment evaluation materials or scoring information;
  • Metadata associated with the assessment submission (such as date, time, duration, device or browser information);
  • Any Personal Data voluntarily provided by the candidate within their responses.
  • Where the assessment includes video or audio response functionality, the Website may additionally collect:
    • Video recordings of candidate responses;
    • Audio content within video recordings;
    • Any Personal Data visible or disclosed within the video content (including but not limited to facial images, voice recordings, background environment, and any information the candidate chooses to share);

  Legal Basis and User Consent:

  Processing of assessment response data is based on:

  1. The User's explicit consent provided before taking the assessment, where video or audio recording may be required; and
  2. Performance of contract, where the assessment is necessary to apply for a specific employment opportunity.

  Users will be clearly informed before any video recording begins that:

  • The assessment is being recorded;
  • The recording will be transferred to the prospective employer;
  • The specific employer(s) who will receive access to the recording;
  • Their rights regarding the data, including the right to withdraw consent.

  Users may decline to participate in video and audio assessments without affecting their ability to use other features of the Website, though this may limit their ability to apply for positions that require such assessments.

  Controller/Processor Roles

  For assessment response data:

  • The Owner acts as a Data Processor, facilitating the collection and transfer of assessment responses on behalf of employers;
  • The requesting employer acts as the Data Controller and is responsible for determining the purpose and means of processing the assessment response data;
  • Once transferred to the employer, the employer assumes full responsibility for the assessment response data in accordance with Applicable DP Law.

  Employer Responsibilities

  Employers who request assessments through the Website are required to:

  • Comply with all Applicable Data Protection Laws when processing assessment response data; Implement appropriate technical and organizational security measures;
  • Provide candidates with their own privacy notice explaining how assessment response data will be used;
  • Establish lawful retention periods and securely delete assessments when no longer needed;
  • Respond to data subject requests (access, deletion, rectification) regarding assessment response data in their possession.

  Security Measures

  The Owner implements appropriate technical and organizational measures to protect assessment response data during collection and transfer, including:

  • Encryption of video and audio data during transmission and storage;
  • Access controls limiting who can view assessment responses and recordings;
  • Secure protocols for transferring assessment data to employer systems;
  • Regular security assessments of assessment processing systems.

  User Rights Regarding Assessment Response Data

  Users have the following rights regarding their video and audio assessment data:

  • Right to withdraw consent before submitting video recording (though this will terminate the assessment);
  • Right to request deletion of assessment response data held by the Owner (subject to contractual obligations to employers);
  • Right to access information about which employers have received their assessment responses;
  • Right to contact employers directly to exercise rights (access, deletion, rectification) regarding assessment response data in the employer's possession.

  Important Limitation

  Once an assessment has been transferred to an employer's system, the Owner no longer controls that data. Users must contact the employer directly to exercise their data subject rights regarding the employer's copy of the assessment responses, including any video recordings.

  Retention by the Owner

  Assessment response data held by the Owner is retained:

  • For the duration necessary to facilitate the transfer to the requesting employer;
  • For a reasonable period after transfer to allow for technical issues or employer access problems;
  • Until the User requests deletion, where technically feasible and not in conflict with contractual obligations to employers.

  Place of processing: Frankfurt, Germany

  The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Cross-Border Transfers of Assessments

  Where assessment responses include video or audio recordings and are transferred to employers located outside the UAE or EEA, such transfers are carried out in accordance with the safeguards described in the Cross-Border Data Transfers section of this Privacy Policy. Users may contact the Owner for more information about such transfers and their rights.

  Special Categories of Personal Data in Video Assessments:

  Where assessments include video responses, users should be aware that recordings may capture special categories of Personal Data under GDPR (such as racial or ethnic origin, health information visible in the video, or religious beliefs evidenced by religious attire or symbols) or sensitive Personal Data under UAE PDPL.

  Similarly, audio recordings may reveal sensitive information through voice characteristics, accent, or disclosed content. For video assessments Users are advised to:

  • Choose a neutral background for recordings where possible;
  • Consider what personal information may be visible or audible in the recording;
  • Only disclose information they are comfortable sharing with prospective employers.

  
  

  Processing of any special categories of data present in video assessments is based on the User's explicit consent.

  Third-Party Video and Audio Processing Services

  The Owner may use third-party service providers to facilitate video and audio recording, storage, and transfer. Any such third-party providers:

  • Act as Data Processors under written agreements that comply with Applicable DP Law;
  • Are required to implement appropriate security measures;
  • Are prohibited from using video or audio assessment data for their own purposes;
  • Are listed in the "Detailed information on the processing of Personal Data" section or available upon request from the Owner.

  
  

  Personal Data processed: Assessment responses (written responses, selected answers, uploaded files); Video and audio recordings (for video responses); facial images (for video responses); voice recordings; email address; name; User ID; device information; IP address; timestamp data; any Personal Data voluntarily disclosed by the User within the video or audio content.

  
  

  For questions about video or audio assessments or to exercise your rights, contact the Owner at [email protected].

  Personal Data processed:

  Assessment responses (written responses, selected answers, uploaded files); Video and audio recordings (for video responses); facial images (for video responses); voice recordings; email address; name; User ID; device information; IP address; timestamp data; any Personal Data voluntarily disclosed by the User within the video or audio content.

  
  

  For questions about video or audio assessments or to exercise your rights, contact the Owner at [email protected].

  AI-Powered Application Ranking and Candidate Matching

  What This Service Does

  This Website leverages third-party artificial intelligence services to rank and match job applications with employer requirements. The integrated AI analyses candidate profiles, CVs, work history, skills, qualifications, and other relevant data to assess compatibility with specific job postings and employer preferences.

  
  

  How the AI-Powered Ranking Service Works

  The AI-powered ranking service processes Personal Data including

  • Professional experience and employment history
  • Educational qualifications and certifications
  • Skills and competencies (both self-reported and inferred)
  • Job preferences and career objectives

  The system uses this data to generate compatibility scores, rank candidates relative to job requirements, and present employers with prioritized candidate lists.

  
  

  Legal Basis for Processing

  This processing is based on:

  • Performance of contract: AI-powered matching is necessary to provide the core job matching service Users have registered for;
  • Legitimate interests: The Owner has a legitimate interest in providing employers with relevant candidate matches and in optimizing the job search experience for Users, provided such interests do not override Users' fundamental rights and freedoms; and
  • Explicit consent (where required by Applicable DP Law): For certain AI processing activities that may have legal or similarly significant effects on Users.

  
  

  Automated Decision-Making and User Rights

  The AI ranking service may constitute automated decision-making under GDPR Article 22 and UAE PDPL. Users have the right to:

  • Be informedwhen they are subject to automated decision-making, including profiling, that produces legal effects or similarly significantly affects them;
  • Obtain human intervention: Users may request that a human review any automated decision that significantly affects their access to employment opportunities;
  • Express their point of view: Users may contest an automated decision and provide additional context or information that may not have been considered by the AI service;
  • Obtain an explanation: Users may request meaningful information about the logic involved in the automated decision-making process, including which factors were weighted most heavily in ranking decisions.

  
  

  Limitations and Safeguards

  To ensure fair and non-discriminatory AI processing, the Owner has implemented the following safeguards:

  • Regular reviews of AI-assisted outputs to detect and mitigate potential bias based on protected characteristics (including but not limited to gender, age, nationality, and other characteristics protected under UAE and EU law);
  • Human oversight of AI-assisted outputs, particularly for high-stakes employment decisions;
  • Transparency measures allowing Users to understand how their profiles are being evaluated;
  • Mechanisms for Users to correct inaccurate data that may adversely affect AI-assisted rankings;
  • Reliance on AI providers that implement controls to limit the use of special categories of Personal Data (such as health data, religious beliefs, or racial/ethnic origin), except where permitted by law and consented to by the User.

  
  

  Impact on Employment Opportunities

  Users acknowledge that AI ranking may affect their visibility to employers and the likelihood of their applications being reviewed. However:

  • AI rankings are provided as recommendations to employers and do not automatically exclude candidates from consideration;
  • Employers retain full discretion over final candidate selection decisions;
  • Users may improve their rankings by maintaining complete, accurate, and up-to-date profiles;
  • Users experiencing technical issues or inaccuracies in their AI-assisted rankings should contact the Owner immediately at [email protected].

  
  

  Data Used to Improve AI-Enabled Services

  The Owner may use anonymized and aggregated application data, including historical matching outcomes, to improve its services and the performance of AI-enabled features. This processing:

  • Is based on the Owner's legitimate interest in improving service quality;
  • Uses data that has been anonymized in accordance with Applicable DP Law such that it can no longer identify individual Users;
  • May be subject to the User's right to object where the data has not been fully anonymized.
  • May involve collaboration with third-party AI service providers for system improvement purposes.
  • Users may object to the use of their Personal Data for service improvement purposes by contacting [email protected]. Such objections will be honored where they do not conflict with the Owner's legitimate interests or legal obligations.

  
  

  Retention of AI Processing Records

  Records of AI-generated rankings, scores, and matching decisions are retained for:

  • The duration of the User's active account and for a reasonable period after account closure to facilitate ongoing service improvement and respond to User inquiries; or
  • Such longer period as required by law or to establish, exercise, or defend legal claims.
  • Users may request deletion of their AI processing records subject to the exceptions set forth in this privacy policy.

  
  

  Place of Processing: United States. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  AI-Powered Chatbot and Customer Support

  
  

  What This Service Does

  This Website uses an AI-powered chatbot system to support Users in searching for jobs, creating and managing CVs, and applying for roles. The chatbot may use natural language processing and machine learning to understand User queries and provide relevant responses.

  
  

  Personal Data Processed

  The AI chatbot processes the following Personal Data:

  • Questions, messages, and inquiries submitted by Users through the chat interface;
  • User ID, account information, and service usage history to provide personalized support;
  • Previous chat transcripts and support interactions to provide contextual assistance;
  • Device information, IP address, and technical data to troubleshoot issues;
  • Any Personal Data voluntarily disclosed by the User within chat messages, which may include sensitive information.

  
  

  Important Notice: Do Not Share Sensitive Information

  Users are advised not to share sensitive Personal Data (such as payment card details, national ID numbers, passwords, or other confidential information) through the chatbot unless specifically prompted by verified security protocols. The AI chatbot is designed to assist with general inquiries and should not be used to transmit highly sensitive data. For matters requiring sensitive data disclosure, Users should contact the Owner through secure channels identified on the Website.

  
  

  How Users Are Informed of AI Interaction

  Users interacting with the AI chatbot will be clearly informed at the start of each chat session that they are communicating with an automated system. Messages will include a disclosure such as: "You are chatting with an AI assistant.

  
  

  Legal Basis for Processing

  Chatbot processing is based on:

  • Performance of contract: The chatbot processes personal data to enable the Owner to fulfill its contractual obligations in providing services to Users, including CV creation and management, job applications, and overall job search support;
  • Legitimate interests: The Owner has a legitimate interest in enhancing the platform, delivering personalized recommendations, and improving service quality through AI assistance; and
  • Consent: Where the chatbot processing involves personalized recommendations or optional AIdriven services beyond the core platform functionality.

  
  

  Data Sharing with Third-Party AI Providers

  The AI chatbot may be powered by third-party service providers (such as OpenAI). When Users interact with the chatbot:

  • Their messages and associated Personal Data may be transmitted to the third-party AI provider's servers for processing;
  • The third-party provider acts as a Data Processor under a written agreement requiring compliance with Applicable DP Law;
  • The third-party provider is contractually prohibited from using User data for its own purposes, including training its general AI models, except as explicitly permitted by this privacy policy;
  • Appropriate safeguards, including Standard Contractual Clauses and encryption, are in place to protect data during transmission and storage.

  
  

  Chatbot Accuracy and Limitations

  Users acknowledge that:

  • AI chatbot responses are generated by machine learning algorithms and may contain errors, inaccuracies, or outdated information;
  • The chatbot provides general guidance and should not be relied upon for critical employment decisions, legal advice, or matters with significant consequences without verification;
  • The Owner is not liable for damages arising from reliance on inaccurate chatbot responses, though the Owner makes reasonable efforts to ensure chatbot accuracy;
  • Users experiencing issues with chatbot responses should request human agent assistance.

  
  

  Human Oversight and Accountability

  All AI chatbot interactions are subject to human oversight. The Owner:

  • Reviews chatbot conversation logs to identify errors, improve responses, and ensure quality;
  • Maintains responsibility for AI-generated responses provided through the chatbot.

  
  

  Retention of Chat Transcripts

  Chat transcripts and associated data are retained for:

  • For a reasonable period from the date of the conversation to facilitate ongoing support, service improvement, and dispute resolution; or
  • Such longer period as required by law.
  • Users may request deletion of their chat transcripts by contacting [email protected], subject to the Owner's legitimate interests in maintaining records for quality assurance and legal compliance.

  
  

  Place of Processing: United States. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  AI-Powered CV Tailoring and Optimization

  What This Service Does

  This Website offers an AI-powered CV tailoring tool that analyzes User CVs and job descriptions to provide automated recommendations for improving CV content, formatting, keyword optimization, and alignment with specific job requirements. The AI system may automatically generate suggested edits, rewrite sections, or create alternative versions of User CVs tailored to specific job applications.

  
  

  Personal Data Processed

  The CV tailoring AI processes:

  • Complete CV content including employment history, education, skills, achievements, and personal statements;
  • Job descriptions and employer requirements for positions to which the User is applying;

  Any Personal Data contained within uploaded CV documents, which may inadvertently include special categories of data.

  
  

  User Control and Final Decision Authority

  The AI CV tailoring tool provides recommendations only. Users retain complete control over:

  • Whether to use the AI tailoring service (it is entirely optional);
  • Which AI-generated suggestions to accept, modify, or reject;
  • The final content of their CV as submitted to employers;

  The AI does not automatically modify or submit CVs without explicit User instruction. All changes must be actively accepted by the User through the interface.

  
  

  Legal Basis for Processing

  CV tailoring processing is based on:

  • Explicit consent: Users must actively opt-in to use the AI CV tailoring service and consent to the processing of their CV data for this purpose; and
  • Performance of contract: Where CV tailoring is part of a premium service package, processing is necessary to deliver the contracted service.

  
  

  How the AI CV Tailoring System Works

  The AI system:

  • Analyzes the User's existing CV content and structure;
  • Compares the CV against the target job description to identify gaps, mismatches, or opportunities for improvement;
  • References a database of successful CV patterns and industry-specific best practices (derived from anonymized, aggregated data);
  • Generates specific recommendations such as:
    • Keyword optimization to match applicant tracking systems (ATS);
    • Reordering of sections to highlight relevant experience;
    • Rephrasing of accomplishments to use stronger action verbs;
    • Identification of missing skills or qualifications that appear in the job description;
    • Formatting adjustments to improve readability and ATS compatibility.
  • Presents recommendations to the User for review and approval.

  
  

  Accuracy, Quality, and User Responsibility

  While the AI CV tailoring tool is designed to improve CV effectiveness, Users should be aware that:

  • AI-generated suggestions may contain errors, misinterpretations of the User's experience, or inappropriate recommendations;
  • The AI does not verify the accuracy of information in the User's original CV or the truthfulness of suggested edits;

  Users are solely responsible for ensuring that all CV content is accurate, truthful, and not misleading, regardless of whether it was AI-generated or user-written;

  The Owner is not liable for any consequences arising from inaccurate, misleading, or false information in User CVs, including CVs edited using AI tools;

  Users should carefully review all AI suggestions before accepting them and verify that edited CVs accurately represent their qualifications and experience.

  
  

  Special Categories of Personal Data in CVs

  CVs may inadvertently contain special categories of Personal Data under GDPR (such as information revealing racial or ethnic origin, health information, or religious beliefs) or sensitive Personal Data under UAE PDPL. The AI CV tailoring tool:

  • Does not intentionally collect or process special categories of data;
  • Is configured to detect and flag potential special category data present in uploaded CVs;

  Processing of any special categories of data present in CVs is based on the User's consent as outlined in this privacy policy. By uploading a CV containing such data to the AI tailoring tool, Users consent to its processing for the purposes of CV optimization. In addition, the Owner implements safeguards to detect and minimize the transmission of personal identifiers when interacting with third-party AI service providers.

  Users are responsible for ensuring that sensitive personal information is removed from CVs before using the AI tailoring tool, unless such information is strictly necessary and legally permissible for the job application.

  
  

  Use of CV Data to Train and Improve AI Models

  The Owner may use CV data, job matching outcomes, and User interaction with AI recommendations to train and improve the CV tailoring AI system. This processing:

  • Is based on the Owner's legitimate interest in improving service quality and effectiveness;
  • Uses anonymized and aggregated data that cannot identify individual Users wherever possible;

  
  

  Third-Party AI Service Providers

  The CV tailoring service may utilize third-party AI models and natural language processing services (such as OpenAI, or other providers). When Users utilize the CV tailoring tool:

  • Their CV content is transmitted to the third-party AI provider's servers for processing;
  • The third-party provider acts as a Data Processor under written agreements requiring compliance with Applicable DP Law;
  • Appropriate safeguards including encryption, Standard Contractual Clauses, and data processing agreements are in place.

  The Owner conducts regular audits of third-party AI providers to ensure compliance with contractual data protection obligations.

  
  

  User Rights Specific to AI CV Processing and Data Retention

  In addition to the general rights described in this privacy policy, Users of the AI CV tailoring service have the right to:

  • Obtain information about the general parameters and criteria used by the AI to provide recommendations;
  • Access and review AI-generated recommendations and compare them to their current CV data prior to confirming any changes. Once changes are saved, the original CV and any previous AI-generated versions are permanently overwritten and cannot be recovered. Users are encouraged to maintain independent copies of their original documents if they wish to revert or retain previous versions;
  • Request deletion of their CV and associated personal data in accordance with their data subject rights. Any anonymized or aggregated data used for service improvement or analytics cannot be linked back to individual users and will continue to be used in accordance with applicable law;
  • Object to automated processing. While the Owner does not provide human-led CV reviews as a standard alternative or to verify specific AI outputs, objections will be taken into account in accordance with applicable law;
  • Receive a copy of the AI processing logic and criteria used to generate their specific CV recommendations. To exercise these rights, Users should contact [email protected] with their specific request.

  
  

  Employer Visibility of AI-Tailored CVs

  Employers viewing User CVs are not informed whether the CV has been AI-tailored. AI-tailored CVs are presented to employers in the same manner as manually created CVs. Employers evaluate CVs based on content, not on the method of creation.

  
  

  Place of Processing: United States. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  General AI Processing Principles Applicable to All AI Services

  The Owner is committed to responsible AI use and adheres to the following principles for all AI processing activities:

  • Transparency: Users will be clearly informed when they are interacting with AI systems or when AI processing significantly affects them.
  • Fairness and Non-Discrimination: AI systems are designed, monitored, and audited to prevent discrimination based on protected characteristics including gender, age, nationality, race, religion, disability, or other characteristics protected under Applicable DP Law.
  • Accuracy: The Owner implements measures to ensure AI outputs are accurate and up-to-date, including regular testing, validation, and human oversight.
  • Accountability: The Owner remains responsible for all decisions made or actions taken based on AI processing, regardless of the degree of automation.
  • Human Oversight: Significant decisions affecting Users' rights, employment opportunities, or access to services are subject to human review upon User request.
  • Security: AI processing systems are protected by appropriate technical and organizational security measures including encryption, access controls, and secure data transmission protocols.
  • Privacy by Design: AI systems are designed with privacy protections built-in from the outset, including data minimization, purpose limitation, and user control mechanisms.

  
  

  For questions about AI processing or to exercise any rights related to AI use of Personal Data, Users may contact the Owner at [email protected].

  Content Commenting

  Content commenting services allow Users to make and publish their comments on the contents of this Website.

  Users are responsible for the content of their own comments.

  Comments posted by the User are processed as part of the services provided by the platform and are based on the performance of a contract. The Owner may also process such data based on its legitimate interest in enabling user interaction, maintaining community engagement, and ensuring the integrity and security of the platform.

  Personal Data processed: email address; first name; last name.

  Displaying Content From External Platforms

  This type of service allows you to view content hosted on external platforms directly from the pages of this Website and interact with them. Such services are often referred to as widgets, which are small elements placed on a website or app. They provide specific information or perform a particular function and often allow for user interaction. This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.

  Google Fonts (Google LLC)

  Google Fonts is a typeface visualization service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows this Website to incorporate content of this kind on its pages.

  Personal Data processed: Trackers; Usage Data.

  Legal basis: Consent (for non-essential tracking) and legitimate interests (for necessary service functionality).

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  YouTube video widget (Google LLC)

  YouTube is a video content visualization service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that allows this Website to incorporate content of this kind on its pages.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

  The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Handling Payments

  Payment processing services enable this Website to process payments by credit card, bank transfer or other means. To ensure greater security, this Website shares only the information necessary to execute the transaction with the financial intermediaries handling the transaction.

  Some of these services may also enable the sending of timed messages to the User, such as emails containing invoices or notifications concerning the payment.

  PayPal (PayPal Inc.)

  PayPal is a payment service provided by PayPal Inc., which allows Users to make online payments.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Amazon Payments (Amazon)

  Amazon Payments is a payment service provided by Amazon.com, Inc., which allows Users to make online payments using their Amazon credentials.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Place of processing: See the Amazon privacy policy – Privacy Policy.

  Heat Mapping and Session Recording

  Heat mapping services are used to display the areas of this Website that Users interact with most frequently. This shows where the points of interest are. These services make it possible to monitor and analyze web traffic and analyse User behavior.

  Some of these services may record sessions and make them available for later visual playback.

  Microsoft Clarity (Microsoft Corporation)

  Microsoft Clarity is a session recording and heat mapping service provided by Microsoft Corporation.

  Microsoft processes or receives Personal Data via Microsoft Clarity, which in turn may be used for any purpose in accordance with the Microsoft Privacy Statement, including improving and providing Microsoft Advertising.

  Personal Data processed: Tracker.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Hosting and Backend Infrastructure

  This type of service has the purpose of hosting Data and files that enable this Website to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of this Website.

  Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

  Amazon Web Services (AWS) (Amazon Web Services, Inc.)

  Amazon Web Services (AWS) is a hosting and backend service provided by Amazon Web Services, Inc.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  OpenAI API (OpenAI, L.L.C.)

  The OpenAI API provided by OpenAI, L.L.C. is a service that helps the Owner to automate tasks through its AI engine.

  Personal Data processed: Data communicated while using the service.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Google BigQuery (Google Ireland Limited)

  Google BigQuery is a hosting and backend service provided by Google Ireland Limited.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Place of processing: Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Interaction with External Social Networks and Platforms

  This type of service allows interaction with social networks or other external platforms directly from the pages of this Website.

  The interaction and information obtained through this Website are always subject to the User’s privacy settings for each social network.

  This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.

  It is recommended to log out from the respective services in order to make sure that the processed data on this Website isn’t being connected back to the User’s profile.

  Facebook Like button and social widgets (Meta Platforms, Inc.)

  The Facebook Like button and social widgets are services allowing interaction with the Facebook social network provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  LinkedIn button and social widgets (LinkedIn Corporation)

  The LinkedIn button and social widgets are services allowing interaction with the LinkedIn social network provided by LinkedIn Corporation.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt Out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  X Post button and social widgets (X Corp.)

  The X Post button and social widgets are services allowing interaction with the X social network provided by X Corp.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Managing Contacts and Sending Messages

  This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.

  These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.

  Sendgrid (Sendgrid)

  Sendgrid is an email address management and message sending service provided by Sendgrid Inc.

  Personal Data processed: email address; first name; last name.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Mailchimp (Intuit Inc.)

  Mailchimp is an email address management and message sending service provided by Intuit Inc.

  Personal Data processed: company name; country; email address; first name; last name; phone number; Tracker; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  
  

  Managing Support and Contact Requests

  This type of service allows this Website to manage support and contact requests received via email or by other means, such as the contact form. The Personal Data processed depend on the information provided by the User in the messages and the means used for communication (e.g. email address).

  Intercom (Intercom Inc.)

  Intercom is an AI assistant platform provided by Intercom Inc. or by Intercom R&D Unlimited Company, depending on how the Owner manages the Data processing, that enhances the capabilities of the support and communication channels available on this Website by making use of artificial intelligence techniques. Users interacting with AI-powered features will be informed that they are communicating with an automated system. The Owner remains responsible for decisions made or actions taken based on AI-generated outputs.

  Personal Data processed: email address; Trackers; Universally unique identifier (UUID); Usage Data; various types of Data as specified in the privacy policy of the service.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Registration and Authentication

  By registering or authenticating, Users allow this Website to identify them and give them access to dedicated services. Depending on what is described below, third parties may provide registration and authentication services. In this case, this Website will be able to access some Personal Data, stored by these third-party services, for registration or identification purposes based on the User's explicit consent or as necessary for contract performance under Applicable DP Law. Some of the services listed below may also collect Personal Data for targeting and profiling purposes, where compliant with Applicable DP Law; to find out more, please refer to the description of each service. Users have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

  Facebook Authentication (Meta Platforms, Inc.)

  Facebook Authentication is a registration and authentication service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Facebook social network.

  Personal Data processed: Trackers; various types of Data as specified in the privacy policy of the service.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Google OAuth (Google LLC)

  Google OAuth is a registration and authentication service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Google network.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers as described in the cross-border transfer section of this privacy policy.

  Sign in with Apple (Apple Inc.)

  Sign in with Apple is a registration and authentication service provided by Apple Inc. In cases where Users are required to provide their email address, Sign in with Apple may generate a private relay address on behalf of Users that automatically forwards messages to their verified personal email account - therefore shielding their actual email address from the Owner. Users should be aware that if they use Apple's private relay feature, the Owner will not have access to their actual email address and will only be able to contact them through the relay address provided by Apple. This may affect Service delivery, account recovery processes, and the Owner's ability to fulfill certain contractual obligations. Users may disable this feature at any time through their Apple ID settings.

  Personal Data processed: email address; first name; last name; password; User ID.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Facebook Oauth (Meta Platforms, Inc.)

  Facebook Oauth is a registration and authentication service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Facebook social network.

  Personal Data processed: Tracker; various types of Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Direct registration and profiling (this Website)

  By registering or authenticating directly through this Website, Users allow this Website to identify them and give them access to dedicated services. The Owner may process Personal Data collected when Users register or authenticate also for targeting and profiling purposes; to find out more, Users can contact the Owner using the contact details provided in this document.

  Personal Data processed: country; email address; first name; last name; password (stored in encrypted form); phone number; Trackers; Usage Data.

  Registration and Authentication Provided Directly By This Website

  By registering or authenticating, Users allow this Website to identify them and give them access to dedicated services. The Personal Data is collected and stored for registration or identification purposes only. The Personal Data collected are only those necessary for the provision of the Service requested by the Users.

  
  

  Direct registration (this Website)

  The User registers by filling out the registration form and providing the Personal Data directly to this Website.

  Personal Data processed: academic background; address; city; company name; country; date of birth; email address; first name; gender; language; last name; number of employees; password (stored in encrypted form); profession; workplace.

  
  

  Special Categories of Data: Users may voluntarily provide sensitive Personal Data such as date of birth and gender. Processing of such data is based on the User's explicit consent and is used solely for matching Users with appropriate employment opportunities and complying with employer requirements. Users may choose not to provide this information, though this may limit the relevance of job matches.

  
  

  Remarketing and Behavioral Targeting

  This type of service allows this Website and its partners to inform, optimize and serve advertising based on past use of this Website by the User. Legal basis for processing: Where required by Applicable DP Law, including UAE PDPL, this processing is based on the User's explicit consent obtained through the cookie consent banner. Users have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

  This activity is facilitated by tracking Usage Data (including IP addresses, browsing behavior, pages visited, and interaction with advertisements) and by using Trackers to collect information which is then transferred to third-party partners that manage the remarketing and behavioral targeting activity. These partners are identified in the individual service descriptions below. Where such partners are located outside the UAE, transfers are conducted in accordance with Applicable DP Law using appropriate safeguards, including Standard Contractual Clauses approved by the UAE Data Office or other mechanisms described in the cross-border transfer section of this privacy policy. Personal Data collected for remarketing purposes is retained for no longer than permitted under Applicable DP Law unless the User withdraws consent earlier.

  Some services offer a remarketing option based on email address lists.

  
  

  Users have multiple options to opt out of remarketing and behavioral targeting: (1) withdraw consent through the cookie management tool in the Website footer; (2) visit the Network Advertising Initiative opt-out page; (3) use browser settings to block third-party cookies; (4) contact the Owner at [email protected]; or (5) opt out directly with individual service providers using the opt-out links provided in each service description below.

  Where the Owner uses email addresses for remarketing purposes, this processing is based on the User's explicit consent provided separately from general account registration.

  Users may withdraw consent for email-based remarketing at any time by contacting [email protected] or through their account settings.

  Withdrawal of consent will take effect as soon as reasonably practicable, but in any event within the timeframe specified by Applicable DP Law and will stop future data collection for remarketing purposes. However, data already lawfully processed before withdrawal may continue to be used by third-party partners in accordance with their own retention policies until such data is deleted in the normal course. Users may request confirmation of deletion by contacting the Owner.

  
  

  Users may also opt-out of certain advertising features through applicable device settings, such as the device advertising settings for mobile phones or ads settings in general.

  Meta Custom Audience (Meta Platforms, Inc.)

  Meta Custom Audience is a remarketing and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Website with the Meta Audience Network.

  Users can opt out of Meta's use of Trackers for ads personalization by visiting this opt-out page.

  Personal Data processed: Cookies; email address.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Facebook Remarketing (Meta Platforms, Inc.)

  Facebook Remarketing is a remarketing and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Website with the Meta Audience Network.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Google Ads Remarketing (Google LLC)

  Google Ads Remarketing is a remarketing and behavioral targeting service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Website with the Google Ads advertising network and the DoubleClick Cookie.

  In order to understand Google's use of Personal Data, consult Google's partner policy.

  Users can opt out of Google's use of Trackers for ads personalization by visiting Google's Ads Settings.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Remarketing with Google Analytics (Google LLC)

  Remarketing with Google Analytics is a remarketing and behavioral targeting service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that connects the tracking activity performed by Google Analytics and its Trackers with the Google Ads advertising network and the DoubleClick Cookie.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Cookies; Usage Data.

  Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  X Ads remarketing (X Corp.)

  X Ads remarketing is a remarketing and behavioral targeting service provided by X Corp. that connects the activity of this Website with the X advertising network.

  Personal Data processed: Trackers; Usage Data.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  X Custom Audiences (X Corp.)

  X Custom Audiences is a remarketing and behavioral targeting service provided by X Corp. that connects the activity of this Website with the X advertising network.

  Users can opt out from interest-based ads by going to: Personalization and Data.

  Personal Data processed: email address; Trackers.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Social Features

  Public profile (this Website)

  Users may have public profiles that other Users can display. In addition to the Personal Data provided, this profile may contain Users' interactions with this Website.

  Personal Data processed: city; company name; country; date of birth; email address; first name; gender; geographic position; last name; phone number; picture; profession; province; state.

  
  

  Inviting and suggesting friends (this Website)

  This Website may use the Personal Data provided to allow Users to invite their friends - for example through the address book, if access has been provided - and to suggest friends or connections inside it.

  Personal Data processed: various types of Personal Data as specified in the service's privacy policy.

  
  

  Spam and Bots Protection

  This type of service analyzes the traffic of this Website, potentially containing Users' Personal Data, with the purpose of filtering it from unwanted parts of traffic, messages and content that are recognized as spam or protecting it from malicious bot activities. The legal basis for this processing is the Owner's legitimate interest in maintaining website security and functionality under Applicable DP Law.

  Google reCAPTCHA (Google LLC)

  Google reCAPTCHA is a SPAM protection service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Personal Data processing. The use of reCAPTCHA is subject to the Google privacy policy and terms of use.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: answers to questions; clicks; keypress events; motion sensor events; mouse movements; scroll position; touch events; Trackers; Usage Data.

  Legal basis for processing: The Owner's legitimate interest in ensuring optimal Website security and availability under Applicable DP Law.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Cloudflare Bot Management (Cloudflare, Inc.)

  Cloudflare Bot Management is a malicious bot protection and management service provided by Cloudflare, Inc.

  Personal Data processed: app information; Application opens; browser information; browsing history; city; clicks; country; county; custom events; device information; device logs; geography/region; interaction events; IP address; keypress events; language; latitude (of city); launches; longitude (of city); metro area; motion sensor events; mouse movements; number of sessions; operating systems; page events; page views; province; scroll position; scroll-to-page interactions; search history; session duration; session statistics; state; touch events; Trackers; Usage Data; video views; ZIP/Postal code.

  Legal basis for processing: The Owner's legitimate interest in ensuring optimal Website security and availability under Applicable DP Law.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  
  

  Tag Management

  This type of service helps the Owner to manage the tags or scripts needed on this Website in a centralized fashion. The legal basis for this processing is the Owner's legitimate interest in efficiently managing website functionality under Applicable DP Law.

  This results in the Users' Personal Data flowing through these services, potentially resulting in the retention of this Personal Data.

  Google Tag Manager (Google LLC)

  Google Tag Manager is a tag management service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Personal Data processing.

  In order to understand Google's use of Personal Data, consult their partner policy and their Business Data page.

  Personal Data processed: Usage Data.

  Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

  Traffic Optimization and Distribution

  This type of service allows this Website to distribute their content using servers located across different countries and to optimize their performance. These services typically process Personal Data including IP addresses, Usage Data, Cookies, device information, and browser information. The servers used by these services may be located in the United States, the European Economic Area, and other jurisdictions as specified in the individual service descriptions below. The function of these services is to filter communications between this Website and the User's browser.

  Legal basis for processing: The Owner's legitimate interest in ensuring optimal Website performance, security, and availability under Applicable DP Law.

  The Owner ensures that appropriate safeguards are in place for any international data transfers.

  Cloudflare (Cloudflare, Inc.)

  Cloudflare is a traffic optimization and distribution service provided by Cloudflare Inc. The way Cloudflare is integrated means that it filters all the traffic through this Website, i.e., communication between this Website and the User's browser, while also allowing analytical data from this Website to be collected.

  Personal Data processed: various types of Data as specified in the privacy policy of the service.

  Legal basis for processing: The Owner's legitimate interest in ensuring optimal Website performance, security, and availability under Applicable DP Law.

  Place of processing: United States – Privacy Policy. The Owner ensures that appropriate safeguards are in place for any international data transfers.

  User Database Management

  This type of service allows the Owner to build user profiles by starting from an email address, a personal name, or other information that the User provides to this Website, as well as to track User activities through analytics features. This Personal Data may also be matched with publicly available information about the User (such as social networks' profiles) and used to build private profiles that the Owner can display and use for improving this Website. Some of these services may also enable the sending of timed messages to the User, such as emails based on specific actions performed on this Website. The legal bases for this processing are performance of contract and the Owner's legitimate interest in efficiently managing Website functionality under Applicable DP Law.

  ContactOut (ContactOut Limited)

  ContactOut is a data enrichment service provided by ContactOut Limited. When a user provides their email address, we may use this service to find publicly available professional information associated with that email address to enhance and auto-complete user profiles and CVs.

  Personal Data processed: Email address; professional or employment-related information (such as work history, job titles, and skills); publicly available information (such as links to professional networking profiles).

  Place of processing: United States and other countries. Data may be transferred internationally under the safeguards outlined in the service's privacy policy – Privacy Policy – Opt Out.

Information on Opting Out of Interest-based Advertising

• Further Information About the Processing of Personal Data
  • Selling goods and services online
    The Personal Data collected are used to provide the User with services or to sell goods, including payment and possible delivery. The Personal Data collected to complete the payment may include the credit card, the bank account used for the transfer, or any other means of payment envisaged. The kind of Personal Data collected by this Website depends on the payment system used.
  • Equal protection of User Data
    This Website shares User Data only with third parties carefully selected to ensure that they provide the same or equal protection of User Data as stated in this privacy policy and as required by Applicable DP Law. The Owner ensures that appropriate safeguards are in place for any international data transfers. Further information on data processing and privacy practices by third parties can be found in their respective privacy policies.
  • Preference Cookies
    Preference Cookies store the User preferences detected on this Website in the local domain such as, for example, their time zone and region.
  This Website uses Trackers. To learn more, Users may consult the Cookie Policy.

• Data Processing and Controller Responsibilities
  Role of the Owner

  When you upload your CV or profile to the Website, the Owner acts as a Data Controller, collecting and processing your Personal Data to facilitate job search and employment opportunities.

  When your CV is downloaded, exported, or otherwise transferred by an employer registered on the Website, or by an employer using an external system, the Owner acts as a Data Processor on your behalf to facilitate this data transfer. The receiving employer assumes the role of Data Controller for your CV and any portion of your CV they retain, and is responsible for its storage, processing, and protection in accordance with Applicable Data Protection Laws.

  Role of Employers

  Employers registered on the Website who search, view, download, or export CVs act as Data Controllers for the CV data they access, process, export or otherwise store from the Website.

  As Data Controllers, employers are responsible in full for complying with all Applicable Data Protection Laws, regulations and obligations - including, but not limited to, data subject access, correction, deletion, retention, sharing and security of the candidate data.

  Consent and Acknowledgement

  By uploading your CV or profile data on the Website, you explicitly consent to the Owner transferring your Personal Data to employers or ATS systems in accordance with the Owner's Terms & Conditions and our Privacy Policy.

  You acknowledge that once your CV or profile data has been exported or transferred to an employer's system, the Owner no longer retains control of its processing, and the employer (as Data Controller) assumes responsibility.

  CV Visibility and Employer Access Controls

  Personal Data from CVs and user profiles is used to present job seekers with relevant employment opportunities based on their explicit consent provided in accordance with Applicable DP Law. Such data is only accessible to employers who have been registered and verified on this Website in accordance with the Owner's verification procedures and is processed in accordance with the User's visibility settings and consent preferences.

  Employer Verification

  The Owner conducts verification checks on all employers, including mandatory validation of UAE trade licenses and commercial registration for UAE-based employers, before granting access to User data. The Owner maintains records of all employer verification activities in accordance with UAE PDPL for a minimum of five years.

  For non-UAE employers, the Owner conducts equivalent verification appropriate to the employer's jurisdiction and ensures through binding contractual terms that such employers comply with UAE PDPL requirements when processing UAE residents' data, including adherence to the principles set forth in UAE PDPL (lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability).

• Your Rights Regarding Data Held by Employers
  You have the right to submit requests directly to any employer that holds or processes your CV, such as requesting access, correction, deletion, or portability, in accordance with their privacy policies. The Owner is not responsible for managing or fulfilling data subject requests for copies of your CV data that exist in the employer's system after transfer. You should review the privacy policy or data protection statement of the employer receiving your CV for more information on your rights.

  CV and Profile Data Retention

  Once your CV or profile data is exported to an employer's system, the Owner no longer controls retention, deletion or further processing of that copy - such responsibilities rest solely with the receiving employer (as Data Controller) who will determine the retention period according to their policy or legal obligations.

  You may request deletion of your CV or profile from the Owner's systems, but this request does not extend to copies of your data held by employers or ATS systems outside the Owner's control.

  CV data retained by the Owner will be retained as specified in this privacy policy. Employers who have accessed User data prior to deletion remain subject to their own data retention obligations.

• Further information for users inside and outside the UAE and the European Union (“EU”)
  This section applies to all Users in the UAE under the UAE PDPL; and all Users in the European Union under the General Data Protection Regulation (“GDPR”).

  For such Users, these provisions supersede any other possibly divergent or conflicting information contained in the privacy policy.

  
  

  Users outside the UAE and EU who use this Website acknowledge and consent to the fact that their Data will be processed in accordance with UAE law as the primary governing framework. Where users are located in jurisdictions with data protection laws that provide greater protections than UAE law, the Owner will endeavour to comply with such additional protections to the extent reasonably practicable, but UAE law shall govern in case of conflict.

  
  

  Further details regarding the categories of Data processed, the purposes of processing, the legal basis for processing, the categories of recipients of the Personal Data, if any, retention periods, and further information about Personal Data can be found in the section titled “Detailed information on the processing of Personal Data” within this document. Users may also contact the Owner at the contact details provided in this privacy policy to request additional information about their data processing.

  Legal basis of processing

  The Owner may process Personal Data relating to Users if one of the following applies. For UAE users, processing is conducted in accordance with UAE PDPL; for EU users, processing is conducted in accordance with GDPR :

  • Users have given their consent for one or more specific purposes.
  • provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
  • processing is necessary for compliance with a legal obligation to which the Owner is subject;
  • processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
  • processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of Personal Data.

  In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

  
  

  Cross-Border Data Transfers

  When UAE Users’ Personal Data is accessed by employers located outside the UAE, such transfers are subject to UAE PDPL requirements. The Owner ensures that adequate safeguards are in place before any transfer occurs, relying on one or more of the following mechanisms:

  (a) standard contractual clauses approved by the UAE Data Office requiring recipient employers to provide a level of protection equivalent to that required under UAE PDPL;

  (b) verification that the recipient country has been deemed to provide adequate protection by the UAE Data Office through an adequacy decision; or

  (c) obtaining explicit consent from Users after informing them of the risks associated with the transfer to a country that may not provide adequate protection.

  
  

  Cross-border data transfers from UAE (for example to store Personal Data in Frankfurt, Germany are conducted in accordance with UAE PDPL. Under UAE PDPL, international transfers require either an adequacy decision, appropriate safeguards (including Standard Contractual Clauses approved by the applicable data authorities), or explicit consent, and Users have the right to be informed of the specific transfer mechanism used. Users may request copies of these safeguards by contacting the Owner. Users in the UAE and EU are informed that data transferred to the United States may not provide the same level of data protection as the UAE or EU.

  
  

  Users may object to such transfers through their account settings or by contacting the Owner directly using the contact information provided in this privacy policy. The Owner will acknowledge, review, and respond to such objections within a reasonable timeframe in accordance with applicable data protection laws. If the objection is upheld, the User's data will not be transferred to the specified recipient. If the objection cannot be upheld due to overriding legitimate grounds or legal obligations, the Owner will inform the User of the reasons and their right to lodge a complaint with the UAE Data Office.

  
  

  Data Retention

  Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose for which they have been collected and may be retained for longer due to applicable legal obligation or based on the Users’ consent. The Owner maintains a data retention schedule that complies with both UAE PDPL and GDPR requirements. Users may request deletion of their Personal Data prior to the expiration of the retention period, subject to the exceptions set forth in this document.

  Therefore:

  • Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
  • Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes, provided that such interests do not override the fundamental rights and freedoms of the data subject. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

  The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to fulfill a legal obligation or upon order of an authority. Where Personal Data is retained pursuant to a legal obligation, the specific legal basis for retention will be documented in the Owner's records of processing activities as required by UAE PDPL.

  Once your CV or profile data is exported to an employer's system, the Owner no longer controls retention, deletion or further processing of that copy — such responsibilities rest solely with the receiving employer (as Data Controller) who will determine the retention period according to their policy or legal obligations.

  You may request deletion of your CV or profile from the Owner's systems, but this request does not extend to copies of your data held by employers or ATS systems outside the Owner's control.

  Once the retention period expires, Personal Data shall be securely deleted or anonymized in accordance with Applicable DP Law, unless the Owner is required to retain such data by law or for the establishment, exercise or defense of legal claims. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period and deletion or anonymization of the data.

  Specific retention periods:* Active user account data: retained while account is active and for a reasonable period after last login, unless the User requests earlier deletion or until deletion, whichever occurs first* CV and profile data: retained while account is active, for a reasonable period after last login, or until User requests deletion, whichever occurs first* Job application records: retained for a reasonable period from application date, unless the User requests earlier deletion where legally permissible* Communication records: retained as required to comply with legal record-keeping requirements* Payment and transaction data: retained as required by applicable tax regulations.Users may request information about specific retention periods for different categories of data by contacting the Owner.

  Users may request information about specific retention periods for different categories of data by contacting the Owner.

  
  

  The rights of Users based on the UAE PDPL and GDPR

  Users may exercise certain rights regarding their Personal Data processed by the Owner. Users in the UAE have rights under UAE PDPL, while Users in the EU have rights under the GDPR. Many of these rights are substantially similar, and the Owner is committed to honouring all applicable user rights regardless of jurisdiction. Where rights differ between jurisdictions, the Owner will apply the standard that provides greater protection to the User, except where doing so would violate applicable law or create conflicting legal obligations. To exercise any of these rights, Users may submit a request using the Data Subject Request Form available at https://www.bayt.com/en/data-subject-request/.

  In particular, Users have the right to do the following, to the extent permitted by law:

  • Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Object to processing of their Personal Data. Users have the right to object to the processing of their Personal Data if the processing is carried out on a legal basis other than consent, including processing based on legitimate interests or for the performance of a task carried out in the public interest.
  • Access their Personal Data. Users have the right to learn if Personal Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Personal Data undergoing processing. This right is subject to exceptions under both UAE PDPL and GDPR where disclosure would adversely affect the rights and freedoms of others or is prohibited by law. The Owner may charge a reasonable fee for additional copies requested beyond the first copy.
  • Verify and seek rectification. Users have the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected. Users may also have incomplete Personal Data completed, including by providing a supplementary statement.
  • Restrict the processing of their Personal Data. Users have the right to restrict the processing of their Personal Data in certain circumstances, including when the accuracy of the Personal Data is contested, the processing is unlawful, or the User has objected to processing. In this case, the Owner will not process their Personal Data for any purpose other than storing it, except with the User's consent, for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.
  • Have their Personal Data deleted or otherwise removed. Users have the right to obtain the erasure of their Personal Data from the Owner, subject to certain exceptions including where the Owner is required to retain the data by law, for the establishment, exercise or defense of legal claims, or for compliance with legal obligations.
  • Receive their Personal Data and have it transferred to another controller. Users have the right to receive their Personal Data in a structured, commonly used and machine readable format and, where technically feasible, to have it transmitted to another controller without any hindrance, where the processing is based on consent or contract and is carried out by automated means.
  • Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

  Users are also entitled to learn about the legal basis for Personal Data transfers abroad including to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures and appropriate safeguards taken by the Owner to safeguard their Personal Data. Under UAE PDPL, international transfers require either an adequacy decision, appropriate safeguards, or explicit consent, and Users have the right to be informed of the specific transfer mechanism used.

  Details about the right to object to processing

  Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection. The Owner will cease processing unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User, or for the establishment, exercise or defense of legal claims.

  Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time, free of charge and without providing any justification. Where the User objects to processing for direct marketing purposes, the Personal Data will no longer be processed for such purposes. To learn whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

  How to exercise these rights

  Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document or by completing the Data Subject Request Form available at https://www.bayt.com/en/data-subject-request/. Such requests are free of charge and will be answered by the Owner as early as possible.

  Response Timeframes

  * Under the GDPR: within one month of receipt of the request, which may be extended by two further months where necessary, taking into account the complexity and number of requests. The Owner will inform the User of any such extension within one month of receipt of the request, together with the reasons for the delay.

  * Under the UAE PDPL: within 15 business days from the date of receipt of the request, or such other reasonable timeframe as specified in the Executive Regulations. Where the Owner requires additional time, it will notify the User and provide reasons for the delay.

  The response will provide Users with the information required by law. Any rectification or erasure of Personal Data or restriction of processing will be communicated by the Owner to each recipient, if any, to whom the Personal Data has been disclosed unless this proves impossible or involves disproportionate effort. At the Users’ request, the Owner will inform them about those recipients.

  Employer Verification: The Owner conducts verification checks on all employers, including mandatory validation of UAE trade licenses and commercial registration for UAE-based employers, before granting access to User data.

  The Owner maintains records of all employer verification activities in accordance with UAE PDPL for a minimum of five years. For non-UAE employers, the Owner conducts equivalent verification appropriate to the employer's jurisdiction and ensures through binding contractual terms that such employers comply with UAE PDPL requirements when processing UAE residents' data, including adherence to the principles set forth in UAE PDPL (lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability).

  User Control Options

  Users may exercise the following controls over their Personal Data through their account settings or by contacting the Owner:

  1. Visibility Controls: Users have the following options for visibility controls:

  - Hidden

  - Visible to employers only

  - Public

  Note: Visibility restrictions apply only to future employer access. Employers who have already lawfully accessed User data prior to the implementation of restrictions will retain access to that data in accordance with their own data retention obligations and applicable law.

  
  

  2. Transfer Controls: Users may object to cross-border data transfers to specific countries or regions, subject to the limitations described in the Cross-Border Data Transfers section above.

  
  

  3. Marketing Controls: Users may opt out of marketing communications at any time through their account preferences or by using the unsubscribe mechanism provided in each communication.

  
  

  Filing Complaints

  * Users in the UAE have the right to lodge a complaint with the UAE Data Office (Office of Data Governance and Protection) if they believe their rights under the UAE PDPL have been violated.

  * Users in the EU have the right to lodge a complaint with their local supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement.

• Additional Information About Data Collection and Processing
  Legal action

  The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Website or the related Services. The legal basis for such processing is the Owner's legitimate interest in establishing, exercising, or defending legal claims.

  The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

  Additional information about User's Personal Data

  In addition to the information contained in this privacy policy, this Website may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

  System logs and maintenance

  For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) or use other Personal Data (such as the IP Address) for this purpose.

  Information not contained in this policy

  More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

• Changes to This Privacy Policy
  The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Website and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. Where changes materially affect Users' rights or the processing of their Personal Data, the Owner will provide advance notice of at least 30 days before the changes take effect. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

  For purposes of this section, changes that materially affect Users' rights or the processing of their Personal Data include, but are not limited to:

  (a) changes to the categories of Personal Data collected or the purposes for which Personal Data is processed;

  (b) changes to the legal basis relied upon for processing Personal Data;

  (c) changes to the third parties with whom Personal Data is shared, or the introduction of new categories of recipients;

  (d) changes to the retention periods applicable to Personal Data;

  (e) changes that affect how Users may exercise their data protection rights, including rights of access, rectification, erasure, or objection;

  (f) changes to the countries or jurisdictions to which Personal Data is transferred; and

  (g) changes to the Owner's identity or contact details for data protection matters.

  Should the changes affect processing activities performed on the basis of the User's consent, the Owner shall collect new consent from the User, where required. Under UAE PDPL, consent must be freely given, specific, informed, and unambiguous, and Users have the right to withdraw consent at any time.