Privacy policy

{01}Introduction

Holol Alghad (“Holol Alghad”, “we”, “our” or “us”) is committed to protecting the privacy and security of the personal data entrusted to us by website visitors, clients, prospective clients, job applicants, employees, contractors, suppliers and other business partners.

This privacy policy explains how we collect, use, disclose, store and otherwise process personal data when you visit our website, communicate with us, apply for employment opportunities, use our services or otherwise interact with us.

We process personal data in accordance with applicable privacy and data protection legislation, including, where applicable:

• the Saudi Personal Data Protection Law (PDPL) and its implementing regulations;
• the General Data Protection Regulation (EU) 2016/679 (“GDPR”);
• the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018;
• the data protection laws of the countries where our delivery teams are located;
• and other applicable privacy laws governing our business activities.

{02}Who we are

Holol Alghad is a technology company providing dedicated development teams, IT staff augmentation, technical recruitment, IT consulting, accessibility services and related professional services to organisations in the Kingdom and abroad.

For the purposes of applicable data protection legislation, Holol Alghad acts as either:

• a data controller, where we determine the purposes and means of processing personal data — for example recruitment, marketing, business development, website administration and client relationship management; or
• a data processor, where we process personal data solely on behalf of our clients while providing software development, consulting, dedicated team or recruitment support services, in accordance with contractual agreements and documented instructions.

{03}Scope of this privacy policy

This policy applies to personal data processed through our website, contact forms and online enquiries, e-mail, telephone and other business communications, recruitment activities, candidate sourcing, referrals, business development, marketing campaigns, webinars and events, our CRM systems, contractual relationships with clients and suppliers, and any other interaction with us relating to our business operations.

It applies to website visitors, prospective and existing clients, job applicants, candidates identified through professional networks, job boards, recruitment partners, referrals or publicly available professional sources, suppliers and service providers, business contacts, event participants, newsletter subscribers and anyone else communicating with us.

This policy does not apply to personal data processed by our clients where we act solely as a data processor. In those cases the client remains responsible for determining the purposes and legal basis for processing, and we process the data only in line with the client's documented instructions and our contractual obligations.

{04}Personal data we collect

Contact data

Name, business e-mail, telephone number, employer, job title and the country you contact us from.

Candidate data

CV, work history, education, skills, certifications, salary expectations, notice period, work authorisation, interview notes and technical assessment results.

Client data

Contract details, billing information, project correspondence and the contact details of your team members involved in the engagement.

Website data

IP address, device and browser type, language, referring page, pages viewed and interaction events, collected through cookies and similar technologies.

Marketing data

Subscription status, event registrations and your communication preferences.

{05}How we use personal data

• Responding to your enquiries and providing the services you request.
• Sourcing, screening, interviewing and placing candidates, and keeping them informed about relevant opportunities.
• Managing contracts, invoicing, payroll for placed staff and supplier relationships.
• Operating, securing and improving our website and its content.
• Sending newsletters, event invitations and service updates where you have subscribed or where we have a legitimate interest in contacting you in a business capacity.
• Meeting our legal, regulatory, tax and accounting obligations, and defending legal claims.

{06}Legal bases for processing

Contract

Processing necessary to enter into or perform a contract with you or your organisation.

Legitimate interests

Running and developing our business — recruitment, business development, site security and service improvement — balanced against your rights.

Consent

Newsletter subscriptions, optional analytics and marketing cookies, and retaining candidate data in our pool beyond a single application. You may withdraw consent at any time.

Legal obligation

Where processing is required by law, including tax, accounting, employment and anti-money-laundering rules.

{07}How we share personal data

We do not sell personal data. We share it only where necessary, and always under written agreements.

• Clients, where you are a candidate being proposed for a role — with your prior agreement on what is shared.
• Service providers acting on our behalf: hosting, CRM, applicant tracking, e-mail delivery, analytics, accounting and payroll.
• Professional advisers, auditors and insurers where relevant.
• Authorities and regulators, where we are legally required to disclose.
• An acquirer or successor in the event of a reorganisation, merger or sale of the business.

{08}International transfers

Our delivery teams and service providers operate in several countries, so personal data may be transferred outside the Kingdom of Saudi Arabia or the EEA.

Where data leaves a jurisdiction that requires safeguards, we rely on an adequacy decision, Standard Contractual Clauses or another approved transfer mechanism, together with technical and organisational measures appropriate to the risk. Details of the safeguards used for a specific transfer are available on request.

{09}Data retention

Enquiries

Kept for 24 months from the last contact unless a contract follows.

Candidate data

Kept for 24 months from the last interaction, or longer with your consent while you remain in our talent pool.

Client records

Kept for the duration of the engagement and for the statutory retention period thereafter, typically ten years for tax and accounting records.

Website analytics

Kept for up to 14 months in aggregated form.

Marketing data

Kept until you unsubscribe, and for a short period afterwards to honour your opt-out.

{10}Your rights

Subject to the law that applies to you, you may exercise the following rights free of charge. We may ask for proof of identity before acting on a request.

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete data we no longer have grounds to keep.
• Restriction and objection — limit or object to processing based on legitimate interests, including direct marketing.
• Portability — receive data you provided in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to the Saudi Data & AI Authority (SDAIA) or your local supervisory authority.

{11}Data security

We apply technical and organisational measures proportionate to the risk: encryption in transit and at rest, role-based access control, least-privilege access for delivery teams, background-checked staff under confidentiality obligations, secure development practices, logging and regular reviews.

If a personal data breach is likely to result in a risk to your rights, we notify the competent authority and affected individuals in line with the applicable law's deadlines.

{12}Cookies and similar technologies

Our website uses strictly necessary cookies to function, and optional analytics cookies to understand how the site is used. Optional cookies are set only with your consent, which you can change or withdraw at any time through the cookie settings.

Most browsers also let you block or delete cookies; blocking strictly necessary cookies may affect how parts of the site work.

{13}Children's data

Our services and website are intended for business users and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, contact us and we will delete it.

{14}Changes to this policy

We may update this policy to reflect changes in our practices, technology or legal requirements. The version number and the date of the last update are shown at the top of this page, and material changes are communicated through the website or by e-mail where appropriate.

{15}Contact us

For privacy questions, requests or complaints, write to hello@hololalghad.sa or to Holol Alghad, King Abdullah Financial District, Riyadh 13519, Saudi Arabia. Mark the subject line “Privacy request” so it reaches the right team.