CV Scopes Logo
CV SCOPES
Back

Privacy Policy

Last Updated: July 7, 2026

1. Introduction & Data Controller Identity

Welcome to CV Scopes. The data controller for your personal information is CV Scopes, registered in the Kingdom of Saudi Arabia. For all privacy-related matters, contact us at: privacy@cvscopes.com. This Privacy Policy explains how we collect, use, and safeguard your personal information in accordance with Saudi Arabia's Personal Data Protection Law (PDPL) issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

2. Information We Collect

We collect various types of information to provide and improve our services for you:

  • Account Information: Name, email address, password, and account type (Candidate or Employer).
  • CV Data (for Candidates): Skills, experiences, education, location, contact info, and other details you include in your profile.
  • Company Data (for Employers): Company name, description, and job openings.
  • Usage Data: Your interactions with the platform (e.g., saved profiles, searches).

3. How We Use Your Information & Legal Basis

We use your data for the following purposes, each with a defined legal basis under Saudi Arabia's PDPL:

  • Matching candidates with employers — Legal basis: Consent (candidate opts to share their CV).
  • Account management & platform security — Legal basis: Contractual necessity (performance of Terms of Use).
  • Payment processing — Legal basis: Contractual necessity.
  • Communications regarding account or job updates — Legal basis: Legitimate interest.
  • Algorithm improvement & aggregated analytics — Legal basis: Legitimate interest.
  • Responding to legal requests from official authorities — Legal basis: Legal obligation.

4. Information Sharing

We never sell your personal information. However, by the nature of the service, we share your information as follows:

  • With Employers: If you are a candidate and you have consented, your CV is visible to verified and registered employers seeking talent that matches your profile.
  • With Service Providers (Sub-Processors): We use trusted third-party service providers to operate the platform, including:
    • Neon Inc. — Database hosting (servers located in Germany, AWS eu-central-1 region), governed by a signed Data Processing Agreement (DPA) and SDAIA-approved Standard Contractual Clauses.
    • Moyasar — Licensed payment gateway.
    • Cloudflare R2 — Encrypted file and attachment storage.
  • For Legal Reasons: If required by a binding legal request from official authorities in Saudi Arabia.

5. Cross-Border Data Transfers

Our primary database is hosted by Neon Inc. on servers located in Germany (AWS eu-central-1), outside the Kingdom of Saudi Arabia. This cross-border transfer is governed by the following safeguards in accordance with PDPL Article 29:

  • SDAIA Standard Contractual Clauses (SCCs): The transfer is subject to mandatory SCCs approved by SDAIA (Controller-to-Processor format), binding our provider to the same level of data protection required under PDPL.
  • Data Processing Agreement (DPA): We have a signed DPA with Neon Inc. specifying its obligations as a sub-processor regarding security, confidentiality, data subject rights, and breach notification.
  • Technical Safeguards: All data is encrypted in transit (TLS) and at rest. Neon maintains SOC 2 Type II and ISO 27001 certifications.

6. Automated Decision-Making

Our platform uses automated algorithms to rank and present candidate profiles to employers based on criteria such as experience, skills, and location. These algorithms do not make final hiring decisions — all employment decisions remain with the employer.

7. Data Security

We use advanced security measures and data encryption to protect your information from unauthorized access, alteration, or destruction. All communications are encrypted with TLS and passwords are hashed using industry-standard algorithms.

8. Data Retention

We retain your data for as long as your account is active. Upon account deletion, all your personal data and CV information is immediately erased from our active databases. Encrypted backups may be retained for up to 30 days, after which they are automatically deleted.

9. Your Rights Under PDPL

As a user of our platform, you have the following rights under Saudi Arabia's Personal Data Protection Law:

  • Access & Rectification: Update, correct, or edit your profile and CV at any time from your dashboard.
  • Account Deletion (Right to Erasure): Delete your account and all associated data using the "Delete Account" button in your dashboard.
  • Data Portability: Request a copy of the data we hold about you in a machine-readable format by contacting us.
  • Withdraw Consent: You may withdraw your consent to data sharing at any time by deleting your CV or your account. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

10. Complaints & Supervisory Authority

If you have concerns about how we handle your data, you have the right to lodge a complaint with SDAIA (Saudi Data and Artificial Intelligence Authority) — the competent supervisory authority in Saudi Arabia. SDAIA website: sdaia.gov.sa

11. Data Breach Notification

In the event of a personal data breach that may cause harm to your rights or interests, we are committed to the following in accordance with PDPL:

  • Notifying the Saudi Data and Artificial Intelligence Authority (SDAIA) via the National Data Governance Platform (dgp.sdaia.gov.sa) within 72 hours of discovering the breach.
  • Notifying you directly via your registered email address without undue delay if the breach poses a risk to your data.
  • Maintaining an internal incident register for all security events as part of our compliance framework.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a prominent notice on our platform before the changes take effect.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: privacy@cvscopes.com