Privacy & Security

1. Data Controller & Split-Role Governance

Under the framework of the PDPL and our multi-sided platform architecture:

• NKTA as Data Controller: NKTA acts as the primary Data Controller for all Student/Candidate profiles, platform usage analytics, and initial onboarding data collected through the Platform. NKTA holds ultimate legal responsibility for establishing the lawful basis for processing this platform-level data.
• Corporate Partners as Data Controllers: Corporate Partners act as Data Controllers exclusively for their proprietary recruitment workflows, interview notes, and specific internal data they generate while interacting with Candidates on the Platform.
• University Stakeholders as Subscribers: University Stakeholders do not control candidate records directly; rather, they subscribe to platform analytics and compliance verification dashboards, receiving strictly aggregated or explicitly consented tracking data.

2. Scope of Data Collection & Onboarding

To maintain a streamlined and privacy-respecting ecosystem, data collection is strictly minimized:

• Student/Candidate Data: During the initial sign-up flow, NKTA collects basic candidate onboarding details including student names, phone numbers, email addresses, and professional profiles.
• Exclusion of Sensitive Government IDs: NKTA does not collect, process, or store national IDs, official government identification documents, or sensitive personal records from students during the initial registration phase.
• Automated Security & Safeguards: NKTA implements robust technical, administrative, and physical security safeguards to secure all personal data localized strictly within the Kingdom of Saudi Arabia.

3. Legal Basis & Explicit Consent Integration

To establish a valid legal basis for processing candidate data as a Data Controller:

• During the initial sign-up flow, all Students/Candidates must affirmatively agree to this standalone Candidate Privacy Policy.
• This explicit consent explicitly authorizes NKTA to process candidate profile data and facilitate authorized recruitment connections with Corporate Partners and University Stakeholders.

4. Data Subject Rights & Direct Execution

As a Data Controller under the PDPL, NKTA assumes direct and primary responsibility for processing and fulfilling all Candidate data subject rights:

• Candidates hold the legal right to access, rectify, port, or securely destroy their personal data.
• Candidates can view and correct their profile data directly in the platform. Requests to export or delete personal data are made by email to privacy@nktaksa.com; self-service controls for these are not yet available.
• Corporate Partners and University Stakeholders are contractually bound to reasonably cooperate with NKTA if a candidate request impacts any operational workflow managed on their end.

5. Data Breach Notification Protocol

In the event of a confirmed security breach or unauthorized access affecting platform-level Candidate Personal Data:

• NKTA shall fulfill its legal duty as a Data Controller by directly notifying the Saudi Data & AI Authority (SDAIA) and the affected Candidates without undue delay, and in no event later than seventy-two (72) hours after becoming aware of the breach, in compliance with PDPL executive regulations.
• If a breach specifically compromises proprietary internal data generated independently by Corporate Partners or University Stakeholders, NKTA will notify the affected stakeholders within the same 72-hour window.

6. Data Localization & Retention

Data Localization: All servers, databases, and backup infrastructure utilized by the Platform are hosted and maintained exclusively within the Kingdom of Saudi Arabia to comply with national data sovereignty mandates. NKTA utilizes certified cloud and infrastructure sub-processors bound by strict contractual data protection terms to maintain platform operations within KSA.

Data Retention: Personal data is retained only for as long as necessary to fulfill the commercial and compliance purposes outlined in this Agreement, or until a valid data deletion request is executed by the candidate. Profiles inactive for more than 24 consecutive months without placement activity may be anonymized or purged.