Privacy notice.

This notice describes how [Company Name] processes personal data on the Trabaho.AE platform under the United Arab Emirates Personal Data Protection Law — Federal Decree-Law No. 45 of 2021 (PDPL).

1. Who we are #

[Company Name], [Emirate], UAE. The Privacy Lead is reachable at privacy@trabaho.ae with a 30-day response SLA consistent with PDPL Articles 13–16. Under PDPL Art. 10, Trabaho.AE has not appointed a Data Protection Officer because our processing does not meet any Art. 10 trigger (no large-scale profiling with legal effect, no sensitive personal data at scale). This position is re-assessed annually.

2. What we collect, and why #

Category	What	Lawful basis (PDPL Art. 5)
Account identity	Email address (from Google/Apple/Microsoft SSO or email + password), display name, sign-in timestamps.	Consent — sign-in to apply for postings.
Seeker profile (optional)	Anything you choose to add to your profile: a mobile number, a one-line headline, a short list of skills, and a profile photo. All optional; leaving a field blank stores nothing, and clearing it deletes it.	Consent — you decide what, if anything, to share.
Job application	Name, contact email, mobile number, CV file, profile photo (only if you added one), message text, job applied to. Your photo and phone are snapshotted as they were at the moment you applied.	Performance of a request initiated by you.
Employer account	Company name, trade-licence file, billing email, payment metadata, attestation.	Performance of contract (AED 29 listing) + legal obligation (UAE Labour Law).
Access logs	IP address, user-agent string, request paths, response codes.	Legitimate interest — security, abuse prevention.
Payment record	Stripe payment_intent_id, last 4 digits of card, billing name, amount, currency.	Performance of contract. We never see or store the full card number.

3. How long we keep it #

• Job applications — substantive record for 2 years per UAE Labour Law (Federal Decree-Law 33/2021), then crypto-shredded. The hash-chained audit envelope (which records that an application happened) is retained indefinitely without PII.
• Payment, invoice, and attestation records — 7 years per UAE Corporate Tax Law (Federal Decree-Law 47/2022) Article 56.
• Access logs — 90 days rolling, then deleted.
• VAT records (once registered) — 5 years per FDL 8/2017 Art. 78.

4. Your rights (PDPL Art. 6–9) #

• Right of access — request a copy of the personal data we hold about you.
• Right of rectification — ask us to correct inaccurate data.
• Right of erasure — withdraw an application or close an account. Subject to statutory retention exceptions in PDPL Art. 8 (legal claims, regulatory record-keeping).
• Right to restrict / object — ask us to pause processing while a dispute is resolved.
• Right to portability — receive a JSON export of your application history.
• Right to withdraw consent — for any processing whose lawful basis is consent. Withdrawal does not affect prior lawful processing.

To exercise any of these, email privacy@trabaho.ae from the address on your account. We respond within 30 days.

Withdraw an application yourself.If you've signed in, you can withdraw any application at any time from My applications. The employer immediately loses access to the substantive record; the 2-year retention applies only to the audit envelope.

Edit or remove your profile yourself.Your optional profile details — mobile number, headline, skills, and photo — live on My profile. Edit them or clear any field at any time; clearing removes the live value immediately. (Applications you already sent keep the snapshot taken when you applied, until you withdraw them or the 2-year retention shred runs.)

5. Sharing #

We share personal data only with:

• The employer of the listing you applied to. They see your name, email, mobile number, CV, your message, and any optional profile details you added (headline, skills, profile photo) — only after they've paid for the listing, only for applications submitted to that specific listing, and only as those details stood when you applied. Withdraw the application and they lose access immediately.
• Stripe (Stripe Payments UAE Limited, ADGM) — billing email + Stripe-side payment metadata of employers only. Job seekers never transit Stripe.
• UAE regulators when responding to lawful requests (MOHRE, FTA, courts).

We do not sell personal data. We do not share CVs with third-party recruiters. We do not run third-party advertising or analytics on this site.

6. Cross-border processing #

Primary processing happens on UAE-resident infrastructure. The only documented cross-border flow is payment metadata to Stripe (EU/US) under PDPL Article 23 transfer safeguards (Standard Contractual Clauses executed with Stripe). No applicant personal data is transferred outside the UAE.

7. Security #

TLS in transit. CVs and trade licences are content-addressed by SHA-256 and isolated per-listing. Authentication cookies are HMAC-signed with a key never exposed to logs or backups. Every server response includes a request ID so we can investigate access disputes. We run an append-only hash-chained event log so unauthorised changes to records would be detected at next boot.

8. Children #

Trabaho.AE is not intended for users under 18. If you believe a minor has registered, email privacy@trabaho.ae and we will remove the account.

9. Breach notification #

If we determine that a personal-data breach has occurred, we will notify affected users and the UAE Data Office within the 72-hour assessment window in PDPL Art. 9, and we will publish a post-incident summary at /security/incidents.

10. Changes #

If this notice changes materially, we will note the change in the footer of this page and, where possible, email account holders. Continued use after the change date constitutes acknowledgement of the updated notice.