Naba

Privacy Policy

Last updated: 2026-06-19

This Privacy Policy explains how bayanah Company Business Services, a limited liability company registered in the Kingdom of Saudi Arabia under Commercial Registration / National Number No. 7042231048, released on 23/10/2024 (“Naba,” “we,” or “us”) collects, uses, shares and protects personal data when you use the Naba platform and related services (collectively, the “Services”). It is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, Royal Decree No. M/19 (the “PDPL”), and its Implementing Regulations.

1. Our Role: Controller and Processor

Naba acts as a data controller for personal data we collect directly from you when you create an account on Naba (for example, candidate accounts in our marketplace, salary explorer users, or HR account holders signing up to a workspace) and for usage and security data of the Services.

Naba acts as a data processoron behalf of an HR Workspace customer (the controller) for personal data that the customer uploads to its workspace, such as candidate profiles ingested from intake forms, CV uploads, application notes, and pipeline records. In that case, we process such data only on the controller's documented instructions and in accordance with our agreement with that customer.

2. Categories of Personal Data We Process

  • Identity and contact: name, email address, phone number, country and city of residence.
  • Professional: work history, education, skills, languages, certifications, salary expectations, links to professional profiles.
  • Application content: CVs, cover letters, answers to application questions, file attachments, recruiter notes and pipeline status.
  • AI-derived: structured data extracted from your documents by automated parsing; fit-scores and other inferences produced by our matching models.
  • Account and authentication: password hash, email verification tokens, sign-in events, session metadata.
  • Technical and usage: IP address, device and browser information, referring pages, in-product actions, language preference.
  • Communications: messages you exchange with us or with HR Workspace customers through the Services, including outreach drafts.

We ask you not to submit special-category personal data (such as data concerning religious belief, political opinion, health, or biometrics). If a CV you upload happens to contain such data, we treat it as ordinary professional data unless you tell us otherwise; the lawful basis for processing it is your explicit consent or, where applicable, the controller's.

3. Sources

  • directly from you when you sign up, upload a CV, or apply to a role;
  • from your employer or a prospective employer when they upload your data into their HR workspace;
  • from public job-related sources you have explicitly listed on your profile; and
  • automatically from your device when you use the Services.

4. Purposes and Lawful Basis

We process personal data on the following lawful bases under PDPL Articles 5 and 6:

  • Performance of a contract: to provide, operate, and support the Services you request, including hosting your CV, transmitting applications to employers, and providing matching results.
  • Consent: for marketplace visibility, marketing communications, cross-border transfer where applicable, and for any special-category data you choose to share. You may withdraw consent at any time.
  • Legitimate interest: for service security, fraud prevention, analytics, internal reporting, and product improvement, where this does not override your interests and rights.
  • Compliance with legal obligation: for retention, recordkeeping, tax, and lawful requests by competent authorities.

5. Automated Processing and AI Features

The Services use automated and AI-assisted processing for: (i) parsing CVs into structured records; (ii) generating candidate fit-scores against roles; (iii) suggesting outreach drafts; and (iv) operating the AI career assistant. Automated outputs are provided as decision support only. They are not intended to be the sole basis for any decision producing legal or similarly significant effects on you.

You have the right to object to a decision based solely on automated processing and to request meaningful human review. You can exercise this right by writing to [dpo@nabajobs.com].

6. How We Share Personal Data

6.1 With HR Workspace customers

If you apply to a role, your application is shared with the relevant HR Workspace customer, who becomes the controller of that data for their hiring purposes. If you opt in to marketplace visibility, eligible HR Workspace customers may discover and contact you in accordance with your settings.

6.2 With sub-processors

We rely on a small number of carefully selected service providers (“sub-processors”) to operate the Services, including:

  • cloud infrastructure and database hosting;
  • object storage for CVs and uploaded files;
  • large-language-model providers used for AI parsing and assistance;
  • email and SMS delivery;
  • error-monitoring and analytics.

Each sub-processor is bound by a written data-processing agreement requiring confidentiality, security and PDPL-aligned safeguards. The current list is published at [/legal/subprocessors] and may be updated from time to time.

6.3 With authorities and successors

We may disclose personal data when required to comply with a binding legal request from a competent KSA authority, or in connection with a corporate reorganisation, merger or sale of assets, in each case with appropriate safeguards.

7. Cross-Border Transfer

Some of our sub-processors may be located outside the Kingdom of Saudi Arabia. Where personal data is transferred outside KSA, we rely on a lawful basis under PDPL Article 29, including: (i) your explicit consent; (ii) appropriate contractual safeguards (such as standard contractual clauses) approved or recognised by the Saudi Data and AI Authority (“SDAIA”); and (iii) where required, prior notification or approval. You may request a description of the safeguards in place by contacting [dpo@nabajobs.com].

8. Retention

  • HR-Workspace data: retained for the period configured by the relevant HR Workspace controller in their workspace settings (subject to a default ceiling). Candidates may, in addition, request deletion of their data from a workspace as described in Section 10.
  • Marketplace and candidate accounts: retained while your account is active and for up to twenty-four (24) months of inactivity, unless you ask us to delete it sooner.
  • Audit, security and billing logs: retained for up to seven (7) years to meet KSA regulatory and tax obligations.
  • Backups: deletion in our active systems is propagated to backups on a rolling basis and within ninety (90) days.

9. Security

We protect personal data using technical and organisational measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest, role-based access control, audit logging, secret management, secure software-development practices, and regular review of sub-processors. No system is perfectly secure; if we suffer a personal data breach affecting your data, we will notify SDAIA and, where required, you, in accordance with PDPL Implementing Regulations.

10. Your Rights Under PDPL

Subject to applicable conditions and exceptions, you have the right to:

  • be informed about how your personal data is processed;
  • access your personal data and obtain a copy;
  • request correction or completion of inaccurate or incomplete data;
  • request deletion of your personal data where the conditions are met;
  • request restriction of, or object to, certain processing;
  • request portability of your data in a structured, commonly used format;
  • withdraw consent at any time, without affecting the lawfulness of prior processing;
  • not be subject to a decision based solely on automated processing; and
  • lodge a complaint with SDAIA.

To exercise any of these rights, please contact [dpo@nabajobs.com]. We respond within the period required by the PDPL Implementing Regulations and may need to verify your identity before acting on a request.

For data held in an HR Workspace where Naba acts as a processor, we will, where appropriate, forward your request to the relevant controller and assist them in responding.

11. Children

The Services are not intended for individuals under 18. We do not knowingly collect personal data from anyone under that age. If you believe a minor has provided us with personal data, please contact [dpo@nabajobs.com] and we will take appropriate steps to delete it.

12. Cookies and Similar Technologies

We use a limited set of strictly necessary cookies and equivalent technologies to operate the Services, remember your language preference, and protect against fraud. Where we use optional analytics or marketing cookies, we will request your consent at first visit and you can change your choices at any time from the cookie settings link in the footer.

13. Data Protection Officer and Contact

You can contact our Data Protection Officer at:

  1. Email: [dpo@nabajobs.com]
  2. Postal address: bayanah Company Business Services, [Registered Address, KSA]

You can also reach the Saudi Data and AI Authority (SDAIA) using the channels published on its official website if you wish to lodge a complaint.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest revision. If a change is material, we will provide a more prominent notice (for example, by email or in-product banner) before it takes effect.

15. Language

This Privacy Policy is made available in Arabic and English. In the event of any conflict or discrepancy between the two versions, the Arabic version shall prevail.