GCC Statutory Compliance Document

Privacy Policy & Data Protection Notice

Effective Date: July 28, 2026 | Compliant with KSA PDPL, UAE Data Protection Law, Qatar DPL & Oman RD 6/2022

Regulatory Compliance Guarantee: Gulflek adheres strictly to the Saudi Personal Data Protection Law (PDPL - Royal Decree M/19), UAE Federal Decree-Law No. 45/2021, Qatar Law No. 13 of 2016, and regional GCC Heavy Industry Labor Ministry data standards.

1. Scope & Legal Framework

This Privacy Policy governs the collection, processing, encryption, storage, and erasure of personal data provided by candidates, recruitment partners, and corporate employers registered on the Gulflek GCC Heavy Industry Talent Portal ("Platform"). By creating an account or submitting profile information, you acknowledge the data handling procedures outlined herein.

2. Categories of Personal Data Collected

We process the following data categories for the legitimate purpose of verified GCC Heavy Industry talent matching (Construction, MEP Engineering, Structural Engineering, Interior Fit-Out):

Identity & Contact Details: Full Legal Name, Email Address, Contact Phone Number, Passport Validity Details.
Engineering & Work Qualifications: Category → Role → Tag Taxonomy, Years of Experience in GCC, Current Location, Desired GCC Location, Software Proficiency (Revit, BIM, AutoCAD, Primavera), and Work History.
Regulatory & Verification Data: Passport Number, Expiry Date, Passport Country, and Visa Status (processed strictly for GCC work visa issuance eligibility).
Resume Documents & Project Portfolios: Verified PDF Resumes, structural project blueprints, fit-out portfolio attachments, and engineering certifications.

3. PII Masking & Data Encryption Protocol

To safeguard candidate privacy against unsolicited contact and web scraping, Gulflek enforces automated Personally Identifiable Information (PII) masking:

Public Listing Masking: Contact Phone Numbers, Email Addresses, Passport Numbers, and direct CV Links are masked (e.g. ••••••••••••) in public directory views.
Authorized Unmasking: Complete unmasked candidate credentials are only accessible to verified Corporate Employers who complete a formal profile reveal transaction.

4. Candidate Legal Rights under GCC Laws

Under the Saudi Arabia PDPL, UAE Decree-Law 45/2021, and Qatar Law 13/2016, candidates hold statutory rights over their personal data:

Right to Access & Rectification: Account Managers maintain verified candidate profiles on candidate behalf in coordination with Milestone Career Planner.
Right to Erasure ("Right to be Forgotten"): Candidates have the unconditional right to request permanent deletion of their account and all stored candidate records.

5. Data Retention & Regional Infrastructure

All data is hosted securely within regional high-security cloud datacenters complying with Gulf Cooperation Council (GCC) data residency standards.

6. Data Protection Officer (DPO) Contact

For data protection inquiries or privacy requests, contact our Data Protection Officer:

Email: dpo@gulflek.com | Compliance Desk: GCC Regional Operational Center