Rasan Recruitment and Employer Branding Privacy Policy
PThis policy explains how Rasan collects, uses, stores, shares, and protects personal data relating to visitors to its careers website, job candidates, and references, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom, and any amendments thereto.
This policy is intended to help you understand the personal data we process, the sources from which we obtain it, the purposes and legal bases for processing it, the parties with whom we may share it, your statutory rights, and how you may exercise those rights.
1. Controller and Contact Details
For the purposes of this policy, Rasan is the controller of personal data when it determines the purposes and means of processing personal data associated with recruitment and employer branding.
Controller: Rasan
Contact channel for privacy and data protection requests: [email address or contact form to be added]
Personal Data Protection Officer, if any: [name or title and contact details to be added]
Address: [address to be added]
If you have any questions about this policy or wish to exercise any of your rights relating to your personal data, you may contact us through the contact channel stated above.
2. Scope of This Policy
This policy applies to the following categories:
· Visitor: a person who visits our careers website.
· Engaged candidate: a person who contacts us or creates a profile to receive information about current or future job opportunities.
· Applicant candidate: a person who applies for a job with us through the careers website or through any approved recruitment channel or service.
· Sourced candidate: a person about whom we collect professional information from public or professional sources because we believe their professional profile may be suitable for our current or future opportunities.
· Referred candidate: a person about whom we receive information from one of our employees, partners, or recruitment service providers.
· Reference: a person provided by the candidate as a professional reference or who provides information relating to a candidate.
When the term “candidate” is used in this policy, it includes engaged, applicant, sourced, and referred candidates, unless the context requires otherwise.
3. Definition of Personal Data and Processing
Personal data means any data, regardless of its source or form, that would specifically identify a person or make it possible to identify them directly or indirectly, such as name, contact details, identification data, CV, qualifications, experience, interview details, and technical usage data.
Processing means any operation performed on personal data, including collecting, recording, storing, organizing, using, modifying, disclosing, transferring, destroying, or any other form of handling such data.
4. Personal Data We Process
Depending on the circumstances and purpose, we may process the following categories of personal data:
4.1 Visitor Data
· Internet Protocol (IP) address.
· Browser type and version.
· Device type, operating system, and device settings.
· Preferred language.
· Approximate geographic location.
· Session data and browsing behavior.
· Page addresses visited and source of visit.
· Cookie and tracking technology data, in accordance with the applicable Cookie Policy.
4.2 Contact and Account Data
· Name.
· Email address.
· Phone number.
· Address, city, or country, if provided.
· Account data on the careers website.
· Content of messages, requests, or inquiries sent to us.
4.3 Job Application Data
· CV.
· Cover letter.
· Educational qualifications.
· Work experience.
· Skills and professional certifications.
· Work samples or professional portfolios provided by the candidate.
· Professional links provided by the candidate, such as public professional profiles.
· Expected salary data or work requirements, where necessary for recruitment purposes.
· Any information voluntarily provided by the candidate as part of their application.
4.4 Assessment and Interview Data
· Interview notes.
· Professional test or assessment results.
· Job suitability assessments.
· Notes from recruitment teams or hiring managers.
· Interview recordings, if made with explicit consent where required.
· Reference check results, as permitted by applicable laws.
4.5 Public or Professional Source Data
This may include publicly available professional information, or information provided by the candidate or appearing in public professional sources, such as job title, current or former employer, declared experience, qualifications, skills, and professional achievements.
4.6 Reference Data
· Name of the reference.
· Their contact details.
· Their professional relationship with the candidate.
· Information they provide about the candidate in the context of reference checks or assessing the candidate’s suitability.
4.7 Sensitive Data
We do not usually request sensitive data as part of the recruitment process unless this is required or permitted by law or necessary for a specific and clear purpose. If processing includes sensitive data, we will comply with the relevant legal requirements, including obtaining explicit consent where required.
5. Sources of Personal Data
We obtain personal data from the following sources:
· Directly from you: when you create an account, submit a job application, contact us, attend an interview, or provide additional documents or information.
· From the careers website and technical systems: when you use or interact with the careers website.
· From public or professional sources: such as public professional profiles, employer websites, or professional platforms, provided that obtaining and using the data is lawful and linked to a specific purpose.
· From our employees, partners, or recruitment service providers: when you are referred or nominated for a role.
· From references: when you provide references or a reference provides us with professional information about you.
When we collect personal data from a source other than the data subject directly, we ensure that the processing is necessary and proportionate to the specified purpose and does not affect the rights and interests of the data subject. Where applicable, we notify the data subject within no more than thirty days of receiving the data, stating the categories of data and its source, unless a statutory exception applies.
6. Purposes of Processing and Legal Bases
We process personal data only for specific, clear, and legitimate purposes, and only to the extent necessary to achieve those purposes. This includes the following:
Purpose
Categories of Data Subjects
Data Categories
Possible Legal Basis
Managing and operating the careers website
Visitors
Device data, usage data, and cookies
Legitimate interest, or consent when using non-essential cookies
Creating an account or candidate profile
Candidates
Contact and account data
Request of the data subject, their consent, or taking recruitment-related steps
Receiving and assessing job applications
Candidates
Job application and assessment data
Taking recruitment- or contracting-related steps, or legitimate interest where its conditions are met
Communicating about an application or job opportunities
Candidates
Contact data and application data
Taking recruitment-related steps, or consent when retaining data for future opportunities where required
Sourcing candidates from public professional sources
Sourced candidates
Public professional data
Legitimate interest, subject to necessity, proportionality, and no adverse impact on the candidate’s rights and interests
Purpose
Categories of Data Subjects
Data Categories
Possible Legal Basis
Reference checks
Candidates and references
Contact data and reference information
Taking recruitment-related steps, legitimate interest, or consent where required
Recording interviews
Candidates
Communication or recording data
Explicit consent, unless another clear legal basis exists
Conducting surveys and improving the recruitment experience
Candidates
Contact data and responses
Consent or legitimate interest, depending on the nature of the survey
Protecting legal rights and interests
All categories
Data necessary for a dispute or claim
Compliance with a legal obligation, legitimate interest, or protection of rights
Complying with legal requirements
All categories
Data necessary for compliance
Performance of a legal obligation
Information security, fraud prevention, and incident management
All categories
Technical data, usage data, and data related to the incident
Legitimate interest or compliance with a legal obligation
When relying on legitimate interest, we ensure that the purpose is not contrary to applicable laws, that the processing falls within the reasonable expectations of the data subject, that it does not include sensitive data except on an appropriate legal basis, and that our interests are balanced against the rights and interests of the data subject.
7. Data Minimization
We are committed to collecting and processing only the minimum amount of personal data necessary to achieve the specified purpose. We do not ask you to provide data that is unnecessary for recruitment, communication, or legal compliance. Some data may be mandatory so that we can review your application or contact you, while other data may be optional.
If you do not provide the required mandatory data, we may be unable to complete the recruitment process, provide the service, or respond to your request.
8. Sharing and Disclosure of Personal Data
Where necessary and to the extent required, we may share personal data with the following categories:
· Recruitment service providers and technical systems providers: such as careers website providers, applicant tracking systems, hosting services, and technical support services.
· Affiliates or related companies within the Rasan group: when providing internal support services or participating in the recruitment process.
· Employees, recruitment teams, and hiring managers: who have a professional need to access the data for recruitment purposes.
· Testing, assessment, and interview service providers: where needed to assess the candidate.
· References or professional verification entities: when verifying information provided by the candidate.
· Governmental, judicial, or regulatory authorities: where disclosure is required by law or necessary for compliance or protection of rights.
· Parties related to transactions or restructuring: in the event of a merger, acquisition, or transfer of business, to the extent necessary and after taking appropriate safeguards.
When disclosing personal data, we ensure that the disclosure is linked to a specific and clear purpose, limited to the minimum necessary, and protects the privacy of the data subject and any other individual.
9. Selection of Processors
When engaging processors who act on our behalf, we are committed to selecting processors that provide sufficient guarantees to protect personal data. We also seek to ensure that agreements with processors include, as appropriate, the following:
· The purpose of processing.
· The categories of personal data subject to processing.
· The duration of processing.
· The processor’s obligation to follow Rasan’s instructions.
· The processor’s obligation to notify us in the event of a personal data breach.
· A statement as to whether the processor or its sub-processors are subject to laws outside the Kingdom and the impact of that on compliance with the law.
· Identification of sub-processors or other parties to whom data may be disclosed.
· Confidentiality obligations and appropriate security measures.
· Enabling Rasan to verify compliance where necessary.
10. Transfer of Personal Data outside the Kingdom
Some personal data may be processed or transferred outside the Kingdom when using systems, service providers, affiliates, or technical support entities located outside the Kingdom, or where there is an operational or legal need related to the recruitment process.
We do not transfer or disclose personal data to an entity outside the Kingdom except in accordance with the provisions of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, after verifying the existence of a legal basis and appropriate safeguards that ensure a level of protection no less than that prescribed by the law and its regulations.
Appropriate safeguards may include, depending on the circumstances:
· Approved standard contractual clauses.
· Binding common rules.
· Accreditation certificates or any safeguards approved by the competent authority.
· Assessment of the level of protection in the receiving country or entity.
· Transfer risk assessment where required, such as in cases of continuous or large-scale transfer or transfer of sensitive data.
· Limiting the transfer to the minimum necessary to achieve the purpose.
If the appropriate safeguards are found to be insufficient or unacceptable risks are identified, we take the necessary measures, including stopping the transfer, modifying its mechanisms, or applying additional safeguards.
11. Cookies and Tracking Technologies
We may use cookies and similar technologies to operate the careers website, improve its performance, understand how it is used, and provide users with a better experience. Some cookies may be necessary for the website to operate, while some non-essential cookies may require your consent.
You can manage your cookie preferences through the mechanism available on the careers website or through the Cookie Policy, where available.
12. Retention Period for Personal Data
We retain personal data only for as long as necessary to achieve the purposes for which it was collected, or for the period required by laws or legal, regulatory, or contractual obligations, or to protect legal rights and interests.
In general:
· Visitor data: retained for the period necessary to operate and improve the website and protect its security, in accordance with the Cookie Policy and applicable technical controls.
· Applicant candidate data: retained throughout the recruitment process and thereafter for the period necessary to respond to inquiries or claims or to demonstrate legal compliance.
· Candidate data for future opportunities: retained as long as the candidate wishes to remain in the talent pool, or until the purpose ends, a deletion request is made, or consent is withdrawn, as applicable.
· Reference data: retained for the period necessary to assess the candidate or for the period associated with the relevant candidate file.
· Interview recordings: retained for the period necessary for assessment purposes, then destroyed unless there is a legal basis for retaining them.
· Claims or dispute data: retained until the relevant matter is finally concluded or for the period required by law.
When the purpose of processing ends or when a legal reason for destruction arises, we securely destroy or anonymize personal data, taking into account applicable legal requirements. Where appropriate, we take suitable steps to notify the parties to whom the data was disclosed of the destruction request.
13. Security of Personal Data
We take the necessary organizational, administrative, and technical measures to protect personal data against loss, damage, unauthorized access, unlawful use, unauthorized disclosure, or leakage. Depending on the nature of the data and the risks, these measures include access controls, confidentiality procedures, system protection, periodic review, training of relevant personnel, and incident management.
14. Personal Data Breach Incidents
In the event of a personal data breach, we assess the incident and its potential impacts and take the necessary measures to mitigate its effects and prevent recurrence.
If the incident may cause harm to personal data or the data subject, or conflict with their rights or interests, we will notify the competent authority within no more than 72 hours from becoming aware of the incident, in accordance with legal requirements.
We also notify the data subject without undue delay if the incident may cause harm to their data or conflict with their rights or interests. The notification will be in clear and simple language and will include appropriate information about the incident, potential risks, measures taken, and contact channels.
15. Rights of Personal Data Subjects
You have the right, in accordance with the law and its regulations, to exercise the following rights as applicable:
· Right to be informed: including knowing the legal basis and purpose for collecting and processing your data, the data categories, the retention period or criteria, your rights, and how to exercise them.
· Right of access to personal data: including knowing whether we process your data and accessing the data available to us.
· Right to obtain a copy of personal data: in a clear and readable format where legally possible.
· Right to request correction, completion, or updating of personal data: if it is inaccurate, incomplete, or outdated.
· Right to request destruction of personal data: in cases determined by law, such as the end of the purpose or withdrawal of consent where consent is the sole legal basis for processing.
· Right to withdraw consent: at any time, if processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal.
· Right to file a complaint: with the competent authority if you believe that processing of your personal data violates the law or regulations.
The exercise of certain rights may be subject to statutory restrictions or exceptions, such as protecting the rights of others, legal obligations, or judicial or regulatory requirements.
16. How to Exercise Rights
You may exercise your rights by contacting us through the contact channel stated in this policy or through the means available on the careers website, if any.
Upon receiving your request, we may ask you to provide additional information to verify your identity before fulfilling the request. We will respond to rights requests without undue delay and within no more than thirty days from receipt of the complete request. This period may be extended by no more than an additional thirty days if fulfilling the request requires unexpected or unusual additional effort or if multiple requests are received, provided that you are notified in advance of the extension and its reasons.
We may refuse or not fulfill a request if it is unreasonably repetitive, requires extraordinary effort, or if there is a legal basis for doing so. We will notify you of the reason for refusal where legally required.
17. Complaints
If you have a complaint relating to the processing of your personal data, you may first contact us through the privacy channel stated in this policy so that we can review and address the complaint.
You also have the right to file a complaint with the competent authority in the Kingdom of Saudi Arabia within the period and in accordance with the procedures prescribed by law, including filing the complaint within no more than ninety days from the date of the incident subject to the complaint or from the date you became aware of it, unless the competent authority accepts the complaint after this period as it may determine.
18. Processing for Other Purposes
If we need to process your personal data for a purpose other than the purpose for which it was collected, we will comply with the relevant legal requirements, including clearly identifying the new purpose, verifying the existence of an appropriate legal basis, and providing you with the necessary information before carrying out the additional processing where required by law.
19. Records of Processing Activities
We maintain records of personal data processing activities in accordance with legal requirements. These include, as appropriate, the purposes of processing, data categories, categories of data subjects, retention periods, categories of recipients to whom data is disclosed, transfers outside the Kingdom, and the organizational, administrative, and technical measures applied to protect the data.
20. Updates to This Policy
We may update this policy from time to time when the way personal data is processed changes, when clarification of information is needed, or to comply with any legal or regulatory requirements. The updated version will be published on the careers website or made available through appropriate means, with the date of the latest update stated.
