Draft 0.1, 7 November 2026
This policy explains what the platform collects about you, why, who sees it, how long it is kept, and how you control it. Your data is yours: none of it is shown to anyone except as you choose or as a service you asked for needs.
Who handles your data
[Name of the owning government body] is responsible for your data on the platform. To contact its data protection officer: [contact details].
What we collect
Your mobile number, your name in Arabic and in Latin letters if you give it, and your governorate or that you live outside Syria.
Your national number if you give it: stored encrypted, used for verification only, and shown to no one but you.
Your passport records and the documents you upload, your applications, your messages and the opportunities you save.
The consents you choose, and when you changed them.
A security log of what happens on your account, holding a keyed hash of your IP address, not the address itself.
Why we use it
To run your account and passport, to show your passport to the people you choose, to send your records to issuers for verification, to send your applications, and to tell you about what concerns you.
To protect the platform and its users from fraud and abuse.
For aggregated statistics for research and planning, only if you agree, and in a form that cannot identify you.
What we do not do
We do not sell your data, show advertising, or use tracking cookies.
Gender, age and governorate are never used in automated candidate ranking; they are used only in filters you chose or in protected statistics.
We do not train artificial intelligence models on the platform's data.
Who sees your data
Employers see your profile in talent search only if you switched on the discoverability consent, and see your application when you apply to their opportunity. Your phone number stays hidden until you apply or accept an invitation.
Issuers see the record you send them for verification and your name, not your national number or phone.
Platform staff see only what their role needs, and their access to sensitive data is logged.
Anyone you share a passport link with sees what you chose to share, until the link expires or you cancel it.
Your consents
Three separate consents, all off until you switch them on: being found by employers, receiving records from issuers, and research statistics.
You can change them at any time on the privacy and consents page; switching one off takes effect at once.
Your rights
To see your data and correct it from your passport and settings.
To download a copy of all your data: a JSON file and a PDF summary, made on request, with no copy kept.
To dispute a record an organization sent, and to delete your account.
How long we keep it
Passport and work history: for the life of the account. 7 days after you ask for deletion, personal data is deleted or anonymized, except what the law requires to keep.
Closed opportunities and applications: five years, then anonymized for statistics if the legal basis allows.
Audit log: seven years, append-only and never erased, subject to legal review.
One-time codes and sessions: 90 days at most. Operating logs: 90 days, with personal data masked.
Documents of a rejected verification request: one year.
Where it is kept and how it is protected
The platform is hosted in data centers inside Syria approved by the owning body.
Data is encrypted in transit, and sensitive fields such as the national number are encrypted at rest. Backups are encrypted.
Staff sign in with a second step, and every change is written to a chained audit log that cannot be altered.
If a breach affects your data, we tell you and the competent authorities as the law requires, without undue delay.
Cookies
We use three only: the session cookie that keeps you signed in, the cookie that protects against forged requests, and one that remembers your choice of light or dark. We use no others.
Changes
This policy may change. Any significant change is announced on the platform before it takes effect, and we ask for your consent again if the purpose of using your data changes.