Personal Data Protection Notice

1. About this notice

Sabbar is a recruitment technology platform. We operate in two ways, and the difference matters for your data.

As a job board. Candidates create a Sabbar profile, we match them to relevant roles, and we surface them to employers who are hiring. Here, Sabbar decides why the data is collected and how it is used.

As recruitment software for employers. Employers use Sabbar, including our AI recruiter, to run their own hiring process: sourcing, screening, interviewing, scheduling, and onboarding. Here, the employer decides what to ask and why, and Sabbar processes that data on their instructions.

This notice explains how Sabbar handles personal data under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations. It applies to candidates who use the platform, and to employers and the individuals at those companies who recruit through it.

It covers the Sabbar website (sabbar.com), the employer portal (app.sabbar.com), and the Sabbar mobile applications.

Sabbar is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, and if we become aware that we have, we delete it.

Sabbar is not an employer. We do not hire, we do not decide who is hired, we do not issue employment contracts, and we do not pay wages. Those decisions belong to the employer.

2. Who we are

Sabbar Digital Company for Information Technology (a single-person company), operating as "Sabbar". Commercial Registration No. 1010476036, National Number 7005134569, AlThumamah Road, Riyadh, Kingdom of Saudi Arabia.

For all data protection matters, including requests and complaints: privacy@sabbar.com

3. Our role: Controller and Processor

The Personal Data Protection Law distinguishes between the Data Controller, who decides why personal data is collected and how it is used, and the Data Processor, who processes it on the Controller's behalf and on their instructions.

Sabbar is both, depending on which part of the platform your data sits in. Knowing which applies tells you who to go to about it.

Where Sabbar is the Controller

We decide the purpose, and this notice is our notice to you.

Your Sabbar candidate profile and the job board. The profile you build with us, your CV, your job preferences, and your activity on the job board.

Job recommendations. We use your profile, preferences, the city or district you have provided, and your activity to recommend relevant roles to you, and to recommend you to employers hiring for roles you match.

Recommendations to employers include your contact details. When we recommend you to an employer, that employer can view your profile together with your mobile number and email address, so that they can contact you directly about their role. This happens only with your consent. You can withdraw it at any time from Settings → Account, and from that moment we stop recommending you to employers and stop disclosing your contact details. Withdrawing does not affect anything else: you can still browse, apply, and be found through the job board profile you have chosen to make discoverable. If your account was created before this version of the notice, we ask for this consent in the app before including you in recommendations to employers. We do not assume it.

Product research and aggregated data products. We analyse platform data to understand labour market and hiring trends, and we produce aggregated insights and data products, which Sabbar may license or sell to third parties. These are aggregated and anonymised. They do not identify you, and they are not sold or shared in a form from which you could be identified. We apply a minimum group size before any figure is published, suppress results too small to be anonymous, and do not name individual employers without that employer's agreement.

Improving our models. We use platform data to train and improve the models behind our matching and our AI recruiter.

Employer account data. The names, work emails, phone numbers, job titles, and permissions of the individuals at an employer who use the platform.

Platform security. Authentication, fraud prevention, impersonation prevention, and duplicate account detection.

Support communications.

The following are never used for recommendations, research, data products, or model training, in any form: identity data, work eligibility and qualification documents, sensitive personal data, and bank account details.

You can object to the use of your data for research, data products, or model training by email to privacy@sabbar.com. It will not affect your ability to use the platform.

Where Sabbar is the Processor, and the employer is the Controller

When you apply to a specific role, you enter that employer's recruitment process, delivered through our software.

The employer decides what to ask you, what screening criteria apply, which documents are required, and who progresses. Sabbar collects and processes that data on the employer's instructions, as set out in our written agreement with them.

The employer is the Data Controller for it. They are responsible for it under the Personal Data Protection Law, they determine the purpose, and their own privacy notice governs its use. Sabbar does not decide the purpose and does not disclose it to anyone other than that employer, except as our agreement or the law requires.

This covers your application, your screening responses, your conversations with our AI recruiter, your interview scheduling, and any identity, eligibility, qualification, or sensitive data the employer requests.

Data collected on an employer's behalf is used for Sabbar's own purposes, such as research or aggregated data products, only where that employer has permitted it in our agreement with them, and never in a form that identifies you.

4. Data Sabbar collects as a Controller

Profile data. Your name, contact details, CV, work history, education, the city or district you tell us you are in, and the job preferences you set. Used so that you can build a profile, be matched to relevant roles, be recommended to employers where you have consented, and apply to roles.

Location. Location means the city or district you provide. We use it to match you with roles near you. We do not collect your device's precise location, and the app does not request location permission.

Platform and security data. Sign-in records, device information, and activity needed to keep your account secure and to prevent fraud, impersonation, and duplicate profiles.

Support communications. Anything you send us when you contact us.

We do not use your profile, CV, or application data for advertising, and we do not sell data that identifies you. The communications we send you, and the cookies and analytics we use, are described in sections 5 and 6.

5. Cookies and analytics

Our website and apps use cookies and similar technologies, including software development kits (SDKs) in the mobile app, for three purposes.

Essential. Sign-in, session security, fraud prevention, and remembering your settings. The platform does not work without these.

Analytics. Understanding how the platform is used — screens visited, features used, errors and crashes — so that we can improve it. Our analytics providers process device identifiers, IP address, and usage events on our instructions. They do not receive your CV, applications, messages, or documents. The platform uses third party tools for the purpose of analytics: Google Analytics, HotJar, PostHog.

Advertising measurement. Sabbar advertises its own platform on advertising networks: Google Ads, Tiktok, Meta Ads. On our public website and app-install pages, we use those networks' tags to measure whether our campaigns work and to manage how our ads are delivered. These tags process identifiers and campaign events. They never receive your profile, CV, or application data, and we do not use your platform data to target advertising at you or at anyone else.

You can control cookies through your browser settings, and on mobile through your device's advertising and tracking settings. Refusing essential cookies may prevent parts of the platform from working.

6. Communications from Sabbar

We send two kinds of communications.

Service messages. Security alerts, verification codes, confirmations, and updates about your account, applications, and interviews. These are part of running the service and are sent for as long as you have an account.

Job alerts and platform updates. Roles we think match you, and news about Sabbar features. You can opt out of these at any time from Settings, or through the unsubscribe option in the message itself, without affecting your account.

We do not send you advertising on behalf of third parties, and we do not share your contact details with anyone for their marketing.

7. Data employers ask for, which Sabbar processes on their behalf

The following is requested by an employer, not by Sabbar. We present the request, hold the data securely, and make it available to that employer. What is requested is determined by the employer.

Application and screening data. Your responses to the employer's questions, your conversation with our AI recruiter, and your interview scheduling.

Identity data. National ID number for Saudi nationals, or residency permit number for residents, and where the employer requires it, a copy of the corresponding document. Employers, in particular large enterprises and government-linked entities, verify a candidate's legal identity before advancing an application. This is requested when you apply to such an employer, not when you first use the platform.

Work eligibility documents. Passport, visa, or residency documents, where the employer is legally required to confirm your eligibility to work in the Kingdom before hiring.

Qualification documents. Degree certificates, professional licences, training certifications, and registrations, so that the employer can verify the qualifications you have stated.

Sensitive personal data. Medical fitness certificates and police clearance or good conduct certificates. Under the Personal Data Protection Law, health data and criminal record data are sensitive personal data and carry stricter requirements. Employers may request them after an offer has been made, only for that specific role, only where the role carries a legal requirement, and only with your separate, explicit consent given at the moment of the request. They never appear on your profile and are not visible to employers browsing candidates.

8. Bank account details

Your IBAN is requested during onboarding, after an employer has offered you a role and your employment contract is being issued. The employer needs it in order to issue your contract and pay your wages into your account.

Sabbar does not employ you, does not issue your contract, and does not pay your wages. We collect and store your IBAN on the employer's instructions and make it available to them. The employer is the Controller and the party responsible for it. It is processed because it is necessary for your employment contract with that employer, and for their payroll, wage protection, tax, and accounting obligations. Because it is necessary in order to pay you, it is not based on consent and is not optional once you proceed with the contract. If you do not wish to provide it, you may decline the contract before signing.

We hold it encrypted, masked wherever it is displayed, and accessible only to authorised personnel, with every access logged. We retain it only for as long as the employer instructs.

⚠ Fraud warning. Sabbar will never ask you to pay anything for a job, and will never ask for your card number, PIN, or a one-time password. We ask only for your IBAN, an account your employer pays into, and only after you have accepted an offer. No legitimate employer on this platform will ask you for money for an application, an interview, a visa, or training. Any such request is a scam. Do not comply, and report it to privacy@sabbar.com.

9. Automated processing and our AI recruiter

Our AI recruiter conducts conversations with candidates, answers questions, screens against the criteria the employer has set, and schedules interviews.

The employer sets the criteria. Sabbar does not decide who is qualified. Screening reflects the requirements the employer configured, and the result is surfaced to them.

Hiring decisions are made by the employer, by a person. The platform is a tool within their process, not a substitute for their judgement.

You may ask the employer how their criteria were applied to you. You may also ask us at privacy@sabbar.com, and we will refer the request to them and act on their instruction.

10. Data Sabbar processes about employers

For the individuals at an employer who use the platform, Sabbar is the Controller. We process your name, work email, phone number, job title, and permissions in order to provide the service, authenticate you, secure your account, support you, and bill your company. We process company registration and billing details in order to meet our own accounting, tax, and regulatory obligations, and usage data in order to operate, secure, and improve the platform.

We do not sell this data and do not use it for advertising.

11. Employer responsibilities

If you are an employer using Sabbar, you are the Data Controller for every candidate's personal data you request, receive, or view through the platform. Under the Personal Data Protection Law and your agreement with Sabbar, you are responsible for:

• Having a lawful basis for every item of data you request, and being able to state its purpose to the candidate.
• Requesting only what is necessary for that purpose, and not speculatively.
• Sensitive data at the right stage only. Medical and police clearance certificates may be requested only after an offer, for that role, where the law requires them, and with the candidate's separate explicit consent.
• Candidate contact details from recommendations. The mobile number and email address you receive with a candidate recommendation may be used only to contact that candidate about the role you are recruiting for. They may not be used for marketing, added to any mailing list, shared, sold, exported, or retained after your recruitment for that role has closed. Misuse of candidate contact details is grounds for immediate removal from the platform.
• Never requesting money or payment credentials from a candidate. You may receive an IBAN at onboarding in order to pay them. Asking a candidate for money, a card number, a PIN, or a one-time password is grounds for immediate removal from the platform.
• Purpose limitation. Candidate data may be used only for the recruitment purpose it was given for. Not for marketing, not disclosed onward, and not retained beyond your stated retention period.
• Protecting the data to a standard at least equivalent to ours, and notifying Sabbar without delay of any breach affecting candidate data received through the platform.
• Responding to candidates who exercise their rights against you as Controller.

Every employer is bound by a written Data Processing Agreement with Sabbar setting out these obligations.

12. Legal basis for processing

Profile and job board data. Your consent, and the agreement between you and Sabbar for use of the platform.

Recommending you to employers, including disclosure of your mobile number and email address. Your consent, which you may withdraw at any time from Settings without losing access to the platform.

Job recommendations to you, research, data products, and model improvement. Your consent, which you may withdraw at any time without losing access to the platform. Once data is aggregated and anonymised so that no individual is identifiable, it falls outside the scope of the Personal Data Protection Law.

Essential cookies and platform security. Necessary for the performance of the agreement between you and Sabbar, and Sabbar's legal and security obligations.

Analytics and advertising measurement. Sabbar's legitimate interest in operating, improving, and promoting its own platform, as permitted for non-sensitive data under the Personal Data Protection Law, and your device and browser settings, through which you can limit them.

Data processed for an employer. The employer's lawful basis, which they must state to you. In most cases this is your consent, given to the employer through the platform, or the employer's legal obligation, for example verifying eligibility to work.

Sensitive personal data. Your separate, explicit consent, given at the moment it is requested. Never bundled into general terms, and never inferred from continued use of the platform.

Bank account details at onboarding. Necessary for the performance of your employment contract with the employer, and for their legal obligations. Not consent based.

Disclosure to authorities and regulators. Compliance with a legal obligation. Not consent based, and it cannot be objected to or withdrawn.

Employer account and company data. Performance of the agreement between Sabbar and the employer, and our own legal obligations.

13. Is providing your data mandatory?

Your profile data is needed in order to use the job board. Everything an employer asks you for is optional, and the choice is yours.

If you decline identity or eligibility data, you can still use the platform and apply to employers that do not require it. You will not be able to complete applications to employers that make verification a condition of their process, and that employer may pause or reject the application.

If you decline a certificate requested after an offer, the employer will tell you what it means for the offer. Where the certificate is a legal condition of the role, they may withdraw it.

These are the employer's decisions, not Sabbar's. Declining one item does not affect anything else on the platform.

14. Who data is shared with

The employer you applied to, and only that employer. Identity data, documents, and certificates never appear on a public profile and are not visible to employers browsing candidates. An employer receives your application data only after you have engaged with their recruitment process.

Employers we recommend you to. Where you have consented, an employer that receives your recommendation sees your profile together with your mobile number and email address, so that they can contact you about their role. Identity data, documents, certificates, sensitive personal data, and bank account details are never part of a recommendation. The employer's use of your contact details is limited by section 11, and misuse is grounds for their removal from the platform.

Employers browsing the job board see only the profile you have chosen to make discoverable. They do not see identity data, documents, certificates, or your contact details.

Purchasers of our aggregated data products, who receive only aggregated, anonymised information from which no individual can be identified. They never receive identity data, documents, certificates, sensitive personal data, or bank account details in any form.

Our service providers, acting as sub-processors. The providers who host, secure, and support our systems. They are bound by written agreement to process data only on our instructions, apply equivalent safeguards, and never use it for their own purposes.

Competent authorities and regulators. We disclose personal data, in identifiable form, where we are legally required to. This includes disclosure to the Ministry of Human Resources and Social Development, other competent authorities, a judicial order, or a lawful request from a regulator or supervisory authority. This is a legal obligation, separate from and unrelated to our aggregated data products. We disclose only what the request requires, and we record every such disclosure.

15. If Sabbar's ownership changes

If Sabbar is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy notice. The recipient is required to protect it to a standard at least equivalent to this notice, and any transfer outside the Kingdom must comply with the cross-border transfer provisions of the Personal Data Protection Law.

16. Where data is processed

Sabbar's platform is operated using cloud infrastructure that is located inside and outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, the transfer is carried out in accordance with the cross-border transfer provisions of the Personal Data Protection Law and the regulations issued by the Saudi Data and AI Authority, and only where appropriate safeguards are in place.

Those safeguards include written agreements with our infrastructure providers restricting them to processing on our instructions, an assessment of the risks of the transfer, and technical protections applied to the data itself.

Sensitive personal data, meaning medical and police clearance certificates, and identifiers such as National ID numbers and bank account details, are encrypted at rest and in transit, and are accessible only to a limited number of authorised personnel.

Where an employer requires that its candidate data remain within the Kingdom, that is agreed in the contract between Sabbar and that employer.

17. How data is protected

Data is encrypted in transit and at rest. Identifiers such as National ID numbers and bank account details are masked across interfaces, logs, and exports, so that only the final digits are displayed. Documents are stored encrypted and are excluded from search indexes.

Access is limited to a small number of authorised personnel on a strict need-to-know basis, and every access is logged. Each employer's candidate data is segregated, and no employer can see candidates who have not engaged with their roles or been recommended to them with consent.

If a personal data breach occurs. Where Sabbar is the Controller and a breach affects your personal data, we notify the Saudi Data and AI Authority (SDAIA) within the period required by the Personal Data Protection Law and its Implementing Regulations, and we notify you without undue delay where the breach may cause harm to you or to your data. Where Sabbar is the Processor for an employer, we notify that employer without delay so that they can meet their own notification obligations, and we assist them in doing so. We keep a record of every breach, the action taken, and the notifications made.

18. How long data is kept

We keep your data for as long as it is needed to provide the platform and for you to use your account. We do not routinely delete active accounts, so that your profile, history, and applications remain available to you and to the employers you engage with.

You can delete your data yourself at any time: both candidates and employers can delete their account and associated data from Settings → Account → Delete. Candidates can also delete individual items, such as a document, without deleting the whole account.

Where you have not asked us to delete your data, we apply the following limits:

Candidate profile and account data is kept while your account is active. If your account stays inactive for 5 years, we delete or anonymise it.

Identity data and bank account details (such as National ID or residency permit numbers and IBANs) are held for as long as they are needed to support your employment or engagement with the employer, because they are requested throughout that relationship for identity, payroll, and compliance purposes. In any case, we hold them no longer than while that employer maintains an active subscription to the platform. Once the employment ends or the subscription ends, whichever is first, they are deleted, subject to any retention the law requires.

Sensitive personal data (medical and police clearance certificates) is deleted once the recruitment decision is final, and within 5 years at latest. It is never retained on a standing basis, and it is never held for the duration of employment.

Contact details disclosed to an employer through a recommendation are, from the moment of disclosure, also held by that employer as Controller, subject to the use and retention limits in section 11.

Data we hold on an employer's behalf is retained and deleted in line with that employer's instructions and our agreement with them. When our agreement with an employer ends, their candidate data is returned or securely destroyed.

We also delete or anonymise data earlier where we are required to by law, or where it is no longer needed for the purpose it was collected for.

When data is deleted, it is securely destroyed or irreversibly anonymised, including in our backups within a defined period. Aggregated and anonymised data, from which no individual can be identified, is not personal data and may be retained.

19. Your rights

Under the Personal Data Protection Law you have the right to be informed of the legal basis and purpose of collection, to access your personal data, to obtain a copy of it in a readable and portable format, to request correction of data that is inaccurate, incomplete, or out of date, to request destruction of data that is no longer needed for the purpose it was collected for, and to withdraw your consent at any time, free of charge.

Where to exercise them

Where Sabbar is the Controller, covering your Sabbar profile, the job board, recommendations to you and to employers, platform data, cookies and analytics, communications, and support, contact privacy@sabbar.com and we will handle your request directly.

Where the employer is the Controller, covering your application, screening responses, documents, certificates, and bank account details, the request goes to the employer. They decide how it is answered. You may submit it through the platform and we will act on their instruction, or you may contact them directly.

Sabbar will not delete, release, or alter data held on an employer's behalf without their instruction. That decision is not ours to make. We will always tell you which employer holds what, and help you reach them.

20. Withdrawing consent

Each consent is withdrawn on its own, independently of the others. You do not need to delete your account to withdraw a single consent.

Go to Settings → Account, or email privacy@sabbar.com.

Withdrawal applies going forward and does not affect processing lawfully carried out beforehand. Where an employer already holds a copy of your data, they hold it as Controller. We will notify them of your withdrawal, but you may need to contact them directly about what they retain.

Withdrawing consent to recommendations stops us from recommending you to employers and from disclosing your contact details, from that moment. Employers who received your details before you withdrew hold them as Controller and remain bound by the limits in section 11. Withdrawal prevents any further disclosure.

Consent is not the basis for your bank account details once an employment contract is in place, so it cannot be withdrawn while the employer is required to pay you under that contract. You can change the account paid into at any time.

Aggregated and anonymised data already published or licensed cannot be recalled, because it does not identify you and cannot be traced back to you.

21. Complaints

If your concern is about Sabbar's handling of your data, contact privacy@sabbar.com. We will investigate and respond.

If your concern is about an employer's handling of data you gave them, they are the responsible party and you should raise it with them. Tell us as well, and we will help you reach the right contact and act on it under our agreement with them.

In either case, you have the right to lodge a complaint with the Saudi Data and AI Authority, the competent supervisory authority for personal data protection in the Kingdom.

22. Changes to this notice

If the purpose for which data is collected changes, consent is sought again. A new purpose requires a new consent, not an amended one. This notice is versioned, and the version you consented to is recorded against your consent.

When we change this notice, we publish the new version on sabbar.com and in the app, and we tell you by email or by an in-app notice at least 14 days before the change takes effect, unless the law requires it sooner. The previous version stays available on request, and the version you consented to remains recorded against your consent.

This notice is referenced in Sabbar's Terms and Conditions and in the agreements under which the platform is used. Referencing it provides you with notice. It does not by itself constitute your consent. Where consent is required, including for identity data, sensitive personal data, model training, and recommendations to employers, it is requested separately and specifically at the point the data is collected, and it is recorded against the version of this notice you were shown.