1. Who we are
This policy explains how Maazaia (“Maazaia”, “we”, “us”, “our”) collects, uses, discloses, transfers, retains and protects personal data. Maazaia is the data controller for the processing described here.
We are a manpower and recruitment business operating in the Kingdom of Saudi Arabia. For any question about this policy, or to exercise any right described in section 10, email us at info@maazaia.com.
We process personal data in accordance with the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, and its Implementing Regulations (together, the “PDPL”), supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
2. Scope
This policy applies to personal data we process through maazaia.com, our recruitment and manpower services, our client and supplier relationships, and the employment we administer on behalf of ourselves or our clients. It does not apply to third-party websites we link to, or to the internal privacy practices of employers to whom we lawfully disclose candidate data.
Where we process personal data on a client's instructions rather than our own, for example running payroll for a client's own employees, we act as a processor and the client is the controller. In those cases the client's own privacy notice governs the purposes of processing, and our contract with them governs our obligations.
3. Personal data we collect
We collect only what we need for the purposes set out in section 4. The categories differ by how you interact with us.
3.1 Website visitors
- Technical data: IP address, browser type and version, device type, operating system, language preference, referring page, pages viewed and timestamps.
- Security data: information generated by Cloudflare Turnstile when you submit a form, used to distinguish humans from automated abuse.
- Any content you type into a form, including a message you choose to send us.
3.2 Employers and business contacts
- Identification and contact data: name, job title, employer name, work email, telephone number, city or project location.
- Commercial data: the services you enquire about, trades and headcount requested, target dates, correspondence and meeting notes.
- Contract and billing data where you become a client, including commercial registration details, VAT number, authorised signatory details and bank payment references.
3.3 Jobseekers and candidates
- Identification data: full name, date of birth, nationality, gender where required by a role's regulated requirements, passport and iqama or national ID numbers, photograph if included in your CV.
- Contact data: email address, telephone or WhatsApp number, current country and city of residence.
- Employment data: curriculum vitae, work history, salary expectations, notice period, education, certificates, trade test and licence records, references, iqama transferability status, and interview or assessment notes.
- Right-to-work data: visa status, sponsorship details, profession stated on your iqama, and documents required by the Ministry of Human Resources and Social Development or a client's site access rules.
3.4 Workers we employ or deploy
- Employment administration data: contract terms, salary, allowances, bank account details for Wage Protection System transfers, attendance and timesheets, leave records, disciplinary and performance records, end-of-service calculations.
- Statutory data: General Organization for Social Insurance (GOSI) registration, medical insurance enrolment, iqama issue and renewal records, exit and re-entry records.
- Dependants' data where you claim a benefit or visa that requires it, limited to names, relationship, dates of birth and identification numbers.
3.5 Sensitive personal data
Some processing involves sensitive personal data as defined in the PDPL. We limit this to what a specific legal or contractual requirement compels, and we do not use it for any other purpose:
- Health data from pre-employment and visa medical examinations, and fitness-to-work certificates required by Kingdom regulations or a client's site rules.
- Biometric data where a government platform or a client's site access system requires fingerprints or facial recognition. We do not operate our own biometric database for marketing or profiling.
- Criminal record or good-conduct certificates where a role or source country legally requires them.
- Data revealing religion where it is required for a visa or Hajj and Umrah season deployment permit.
We never ask for, and you should never send us, bank card numbers, passwords, or sensitive data that a role does not require. If you send unsolicited sensitive data we will delete it.
4. Purposes and legal bases
Article 5 of the PDPL requires a lawful basis for each purpose. We rely on the following.
| Purpose | Legal basis under the PDPL |
|---|---|
| Responding to a manpower request, quotation or general enquiry you send us | Necessary to implement an agreement, or take steps at your request prior to one |
| Assessing your application, matching you to roles, and presenting you to prospective employers | Your explicit consent, given when you submit an application, and withdrawable at any time |
| Keeping your candidate profile on file for future roles for up to 12 months | Your explicit consent |
| Verifying documents, certificates, licences and references | Necessary to implement an agreement with you, and our legitimate interest in supplying competent workers |
| Employing, sponsoring, paying and administering workers we deploy | Necessary for the performance of the employment contract and to comply with statutory obligations |
| Visa, iqama, Qiwa, Muqeem, GOSI, Wage Protection System and Saudization filings | Compliance with a legal obligation imposed on us |
| Occupational health, safety and site access control | Compliance with a legal obligation, and protection of vital interests |
| Invoicing, accounting, tax and audit records | Compliance with a legal obligation |
| Protecting the website and our systems from fraud, abuse and automated attacks | Our legitimate interest in the security and integrity of our services |
| Sending service updates or marketing to business contacts | Your consent, withdrawable through the unsubscribe link in any message |
| Handling complaints, disputes and legal claims | Our legitimate interest in establishing, exercising or defending legal rights |
Where we rely on consent, you may withdraw it at any time by writing to info@maazaia.com. Withdrawal does not affect processing already carried out, and it does not affect processing we must continue for a statutory reason, such as retaining payroll records.
We do not use personal data for any purpose incompatible with the purpose for which it was collected, and we do not sell personal data. We do not process personal data for marketing purposes on the basis of legitimate interest.
5. Cookies, analytics and third-party embeds
This website does not use advertising cookies, cross-site trackers or behavioural profiling. We use the minimum technology needed to make the site work and keep it secure:
- Cloudflare network and security cookies, set when serving and protecting the site. These are strictly necessary and are not used to track you across other websites.
- Cloudflare Turnstile, our CAPTCHA alternative on forms. Turnstile assesses signals from your browser to confirm you are not a bot. It does not use tracking cookies for advertising.
- Google Maps on our contact page. The map is not loaded until you click to load it, so no request reaches Google, and no Google cookie is set, unless you ask for the map.
- Google Fonts, served to render the site's typefaces. If you prefer no request to Google at all, the fonts can be self-hosted; write to us and we will confirm the current configuration.
If we later introduce analytics, we will add a consent mechanism before any non-essential cookie is set, and we will update this policy first. Most browsers let you block or delete cookies; blocking strictly necessary cookies may prevent forms from working.
6. Who we disclose personal data to
- Prospective and actual employers, where you have applied for or been matched to a role. We share the CV and assessment information relevant to the vacancy, and we tell you which employer if you ask.
- Government authorities and platforms, as required to lawfully employ and sponsor workers: the Ministry of Human Resources and Social Development and Qiwa, the General Directorate of Passports and Muqeem or Absher, the General Organization for Social Insurance, the Wage Protection System and Mudad, the Zakat, Tax and Customs Authority, approved medical examination centres, and the Ministry of Foreign Affairs or Saudi missions abroad for visa processing.
- Licensed recruitment partners in source countries, limited to what is needed to source, screen, test and mobilize a candidate.
- Service providers acting on our instructions under a written processing agreement: hosting and website security (Cloudflare), email delivery, document storage, payroll and HR software, medical insurance administrators, accommodation and transport suppliers, and professional advisers.
- Banks and insurers, to process salary transfers and enrol workers in mandatory cover.
- Auditors, legal advisers, courts, labour committees and regulators, where required to establish or defend legal rights, respond to a lawful order, or comply with a regulatory request.
- An acquirer, if we sell or reorganise our business, subject to the same protections described here.
We do not disclose candidate contact details to an employer before you have consented to that specific submission. We require every recipient acting on our behalf to process personal data only on our instructions, apply appropriate safeguards, and return or destroy it when the engagement ends.
7. Transfers outside the Kingdom
Some processing necessarily involves recipients outside the Kingdom: licensed recruitment partners in source countries, and service providers whose infrastructure is located abroad.
We transfer personal data outside the Kingdom only where the PDPL and the Regulation on Personal Data Transfer outside the Kingdom permit it, meaning the transfer serves a purpose permitted under the law, is limited to the minimum data needed, does not prejudice national security or the vital interests of the Kingdom, and one of the following applies:
- the destination is covered by an adequate level of protection recognised by the competent authority;
- the transfer is made under appropriate safeguards, including standard contractual clauses or binding common rules approved by SDAIA, supported by a transfer risk assessment where required; or
- an exemption under the law applies, for example where the transfer is necessary to perform an obligation to which you are party, or to protect vital interests.
Where a transfer requires a risk assessment, we complete one before the transfer and review it when circumstances change. You may request information about the safeguards applied to a specific transfer by writing to info@maazaia.com.
8. How long we keep personal data
We keep personal data only as long as the purpose requires, then destroy it or anonymise it. Where the law sets a minimum period, the statutory period prevails.
| Category | Retention period |
|---|---|
| Unsuccessful candidate applications | 12 months from your last interaction, then destroyed unless you renew consent |
| Candidates presented to an employer but not hired | 24 months, to evidence the lawful basis of the submission |
| Employee and deployed worker records | Duration of employment plus 5 years, or longer where labour, insurance or tax law requires |
| Payroll, WPS and GOSI records | Minimum 10 years, in line with accounting and tax obligations |
| Client contracts and commercial correspondence | Duration of the contract plus 10 years |
| Invoices, tax and zakat records | Minimum 10 years as required by the Zakat, Tax and Customs Authority |
| Website enquiry messages | 24 months from the last exchange |
| Server and security logs | Up to 12 months |
| Records of data subject requests | 3 years, to evidence compliance |
9. How we protect personal data
- Encryption in transit using TLS across the website and our form endpoints, and encryption at rest for candidate documents.
- Role-based access control, with candidate and payroll data restricted to staff who need it for a defined task.
- Written confidentiality undertakings from every employee and contractor, and privacy training on joining and annually.
- Data processing agreements with every processor, and due diligence before engagement.
- Logging and monitoring of access to candidate and worker records, with periodic review.
- Backups, tested restoration, and a documented incident response procedure.
- Privacy impact assessments before launching a new product, platform or processing activity that carries higher risk.
No safeguard is absolute. If you believe your data has been compromised, contact info@maazaia.com immediately.
10. Data breaches
If a personal data breach occurs, we record it, contain it, and assess the risk it creates. We notify SDAIA within 72 hours of becoming aware of a breach where the law requires it, and we notify affected individuals without undue delay where the breach may cause serious harm to their data or to them, describing what happened and the steps they can take.
11. Your rights
Subject to the conditions and exceptions in the PDPL, you have the right to:
- be informed of the legal basis and purpose for collecting your personal data, which this policy is intended to provide;
- request access to your personal data held by us;
- request a copy of your personal data in a readable, clear format;
- request correction, completion or updating of your personal data;
- request destruction of personal data that is no longer needed, and withdraw consent where consent is the basis we rely on.
To exercise a right, write to info@maazaia.com with enough detail to identify yourself and your request. We may ask for proof of identity to avoid disclosing data to the wrong person. We respond within 30 days of a complete request, and will tell you if the law requires or permits us to refuse a request in whole or in part, together with the reason. Exercising your rights is free of charge, unless a request is excessive or repetitive, in which case we will tell you the cost before proceeding.
Requests to destroy data may be limited where we must keep records to comply with labour, tax, insurance or immigration obligations. In that case we restrict the data to those purposes and destroy it when the statutory period ends.
12. Complaints
If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent supervisory authority for the PDPL, through its official channels at sdaia.gov.sa. We would prefer the chance to resolve the matter first, so please contact us before escalating if you are able to.
13. Children and automated decisions
Our services are directed at adults of legal working age. We do not knowingly collect personal data from children, and we process data about a worker's dependent children only where a visa, insurance or benefit claim requires it, on the basis of the parent's or guardian's instruction.
We do not make decisions producing legal effects about you by automated means alone. Shortlisting tools may rank or filter applications, but a person reviews every decision to present, reject or hire a candidate.
14. Changes to this policy
We may update this policy to reflect changes in our processing, our service providers or the law. The version and date at the top of the page always identify the current text. If a change materially affects how we use personal data we already hold, we will notify affected individuals directly before it takes effect, and obtain fresh consent where the law requires it.
15. How to contact us
Privacy and data protection enquiries: info@maazaia.com.
If we appoint a data protection officer, the appointment and contact details will be published in this section.