Last updated: 25 April 2026

Privacy Policy

Jadiroon is committed to protecting the personal data of its users in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and the requirements of the National Cybersecurity Authority (NCA). This policy explains what data we collect, how we use it, and the rights you have to control it.

What we collect

  • Account data: name, email, mobile number, nationality, National ID or Iqama number (optional, when applying for a role).
  • Employer data: company name, sector, team size, adopted skill taxonomy slice.
  • Performance and development data: assessment results, growth plans, role-fit scores.
  • Usage data: login records, platform events, AI requests (hashed).

Lawful basis for processing

We process personal data under one of the bases in Article 6 of the PDPL: explicit consent, performance of an employment contract, compliance with a legal obligation, or the legitimate interest of the employer in performance management and succession planning.

Data residency

All personal data is stored and processed within the Kingdom of Saudi Arabia on sovereign-cloud infrastructure. There is no cross-border transfer of personal data.

Retention

  • Records of candidates not selected: deleted 24 months after the last activity, unless the data subject requests immediate deletion.
  • Employee records: kept for the duration of employment and up to 5 years after, in line with Saudi labour law.
  • AI audit records: 12 months, then reduced to statistical summaries.

Your rights

Under Articles 4 and 21 of the PDPL, you have the following rights:

  • Access the personal data we hold about you.
  • Correct any inaccurate or incomplete data.
  • Request deletion of your data (subject to legal obligations).
  • Withdraw consent for processing at any time.
  • Export your data in a machine-readable format.
  • File a complaint with the Saudi Data and AI Authority (SDAIA).

Candidates can delete their account and all associated data at any time from their profile; the action is immediate and irreversible.

Sharing with third parties

We do not share personal data with external parties for marketing purposes. Limited sharing is permitted only with: sovereign-cloud service providers we contract under strict confidentiality controls, and competent government authorities upon a formal legal request.

Cybersecurity

We apply information security controls in line with the National Cybersecurity Authority’s Essential Cybersecurity Controls (NCA ECC): encryption at rest and in transit, access control under the principle of least privilege, and vulnerability management with documented incident response.

Contact us

For any inquiry or to exercise your rights, contact Jadiroon’s data protection officer at hello@jadiroon.sa. Standard response time: 10 working days.