Privacy Notice — Recruitment and Onboarding

Istify (“we”, “us”) operates this careers portal and is the controller of the personal data collected through it. For any privacy matter, contact us at info@istify.sa.

This notice covers personal data collected when you browse the careers site, apply for a role, create a candidate account, and complete employee onboarding where you have been invited to do so.

• Application data: full name in English and Arabic, email address, phone number, CV and any files uploaded, and answers to role-specific application questions.
• Account data: email, name, and account credentials handled by our authentication provider.
• Onboarding data (invited candidates only): identity details (date and place of birth, nationality, national ID/Iqama or passport number), residential address, emergency contact, education and internship details, bank account details for salary payment, a photo, and supporting documents.

We process application data on the basis of the consent you give at submission. For candidates who proceed to employment, we process personal data to take the steps necessary for entering into and performing the employment relationship, and to comply with legal obligations under the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL).

Consent may be withdrawn at any time by contacting us. Withdrawal does not affect processing already carried out.

Data of unsuccessful applicants, including uploaded files, is retained for twelve (12) months from the date of submission and is then permanently deleted. Data of hired candidates is transferred to our HR system of record and is thereafter governed by our employment data policies.

We do not sell personal data. Access is restricted to authorised HR personnel. Hiring managers may be granted access to application content strictly excluding contact details, unless HR expressly grants fuller access. Data is hosted with our infrastructure providers under contractual safeguards.

We apply role-based access controls, private file storage with time-limited access links, and encryption in transit.

Under the PDPL you have the right to be informed, to access and obtain a copy of your personal data, to request its correction, and to request the destruction of data that is no longer required, subject to legal retention obligations. Requests may be sent to info@istify.sa; we respond within the statutory period.

We may update this notice from time to time. The “Last updated” date above reflects the current version.