This Privacy Policy describes how qaws alraqmiah ("we," "our," or "us") collects, uses, processes, and protects your personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its implementing regulations. This policy applies to all users of our candidate evaluation platform accessible at www.qaws.ai. qaws alraqmiah is committed to protecting your privacy and ensuring the security of your personal data. We believe in transparency and want you to understand how we handle your information when you use our services for candidate evaluation, including educational verification, experience verification, soft skills assessment, and language assessment. By using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

Company Name: qaws alraqmiah Business Address: Al Danah As Shamliyah, Dharan 34258 Contact Email: [email protected] Privacy Contact: [email protected] Website: www.qaws.ai qaws alraqmiah operates as a candidate evaluation platform that provides comprehensive assessment services to both individual candidates and companies. Our services include educational verification, experience verification, soft skills assessment, and language assessment, enabling companies to make informed hiring decisions while providing candidates with opportunities to showcase their qualifications.

Under the PDPL, we process your personal data based on the following legal grounds: Consent: We obtain your explicit consent for the collection, processing, and sharing of your personal data with potential employers and for the purposes outlined in this policy. Your consent is freely given, specific, informed, and can be withdrawn at any time by contacting us at [email protected]. Legitimate Interest: We may process certain personal data based on our legitimate interest in providing candidate evaluation services, improving our platform, and ensuring the security of our systems, provided such processing does not override your fundamental rights and freedoms. Contractual Necessity: We process personal data that is necessary for the performance of our service agreement with you when you create an account and use our evaluation services. We process your personal data based on the following legal bases: - To provide our services: We process your data to fulfill our contractual obligations to you. - With your consent: We will ask for your consent to process your data for specific purposes, such as marketing. - For our legitimate interests: We may process your data for our legitimate interests, such as improving our services, but only where your rights and interests do not override our own. - Legal obligations: We may process your data to comply with legal requirements.

We collect and process the following categories of personal data: 1 Information You Provide Directly Contact Information: - Full name - Email address - Telephone number - Physical address Assessment Data: - Educational background and qualifications - Professional experience and employment history - Assessment results from our evaluation tests - Soft skills assessment outcomes - Language proficiency test results - Documents and certificates uploaded for verification 2 Information Collected Automatically Technical Data: - IP address and device information - Browser type and version - Operating system - Website usage data and navigation patterns - Cookies and similar tracking technologies Assessment Performance Data: - Test completion times - Response patterns and accuracy - Platform interaction data - Progress tracking information 3 Information from Third Parties Verification Data: - Educational verification results from third-party verification services - Professional reference checks - Language assessment results from external testing providers - Background verification information where applicable Under the PDPL, you have the following rights regarding your personal data: - Right to Access: You can request a copy of the personal data we hold about you. - Right to Rectification: You can ask us to correct any inaccurate or incomplete data. - Right to Erasure: You can request that we delete your personal data. - Right to Object: You can object to the processing of your personal data for certain purposes. To exercise any of these rights, please submit a request through our Data Subject Request Form available on our website or email us at [email protected] We will respond to your request within 30 days.

We process your personal data for the following purposes: 1 Primary Service Delivery Candidate Evaluation Services: - Conducting educational verification to confirm academic qualifications and credentials - Performing experience verification to validate professional background and employment history - Administering soft skills assessments to evaluate interpersonal and professional competencies - Conducting language assessments to determine proficiency levels in various languages - Generating comprehensive evaluation reports and candidate profiles Platform Operations: - Creating and managing user accounts - Providing access to assessment tools and resources - Tracking assessment progress and completion - Maintaining assessment records and historical data - Facilitating communication between candidates and potential employers 2 Data Sharing with Companies Employer Access to Candidate Data: As outlined in our Terms and Conditions, companies that use our platform have access to candidate assessment data for recruitment and hiring purposes. This includes: - Complete assessment results and scores - Educational and professional verification outcomes - Soft skills and language assessment reports - Candidate contact information (with consent) - Supporting documentation and certificates Research and Analytics: We may use aggregated and anonymized data for research purposes to improve our assessment methodologies, develop new evaluation tools, and enhance the overall effectiveness of our platform. This research data does not identify individual candidates. 3 Communication and Updates System Communications: - Sending assessment invitations and reminders - Providing assessment results and feedback - Notifying candidates of employer interest or interview requests - Delivering platform updates and service announcements - Responding to customer support inquiries Marketing Communications: We may send candidates and companies updates about our services, new assessment tools, industry insights, and promotional offers. You can opt out of marketing communications at any time by following the unsubscribe instructions in our emails or contacting [email protected]. 5.4 Legal and Security Purposes Compliance and Legal Obligations: - Complying with applicable laws and regulations, including the PDPL - Responding to legal requests and court orders - Protecting our legal rights and interests - Ensuring compliance with industry standards and best practices Security and Fraud Prevention: - Protecting the security and integrity of our platform - Preventing unauthorized access and fraudulent activities - Monitoring for suspicious behavior and security threats - Maintaining audit trails and access logs

1 Sharing with Companies We share candidate assessment data with companies that use our platform for recruitment purposes. This sharing is based on your explicit consent provided when you agree to participate in our evaluation process. Companies receive access to: - Your complete assessment profile and results - Educational and professional verification status - Contact information for recruitment purposes - Any additional information you choose to provide 2 Third-Party Service Providers We may share your personal data with trusted third-party service providers who assist us in delivering our services: Assessment and Verification Partners: - Language assessment providers for conducting specialized language proficiency tests - Educational verification services for confirming academic credentials - Professional reference checking services - Background verification providers where applicable Technology and Infrastructure Partners: - Cloud hosting and data storage providers (with appropriate security measures) - Analytics and performance monitoring services - Customer support and communication platforms - Payment processing services (where applicable) All third-party service providers are contractually bound to protect your personal data and use it only for the specific purposes we authorize. 3 Legal Requirements We may disclose your personal data when required by law or when we believe in good faith that such disclosure is necessary to: - Comply with legal obligations under Saudi Arabian law - Respond to valid legal requests from government authorities - Protect and defend our rights and property - Ensure the safety and security of our users and platform - Investigate potential violations of our terms of service 4 Business Transfers In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

We retain your personal data for the following periods: 1 Assessment Data Active Candidate Profiles: We retain complete assessment data and candidate profiles for a maximum period of 10 years from the date of last assessment or account activity. This extended retention period allows companies to access historical candidate data for future recruitment needs and enables candidates to maintain their assessment credentials over time. Completed Assessments: Individual assessment results and verification data are retained for the full 10-year period to maintain the integrity and validity of our evaluation services. 2 Account and Communication Data User Account Information: Contact details and account preferences are retained for the duration of your account plus 2 years after account closure or last activity. Communication Records: Customer support communications and system-generated messages are retained for 3 years for quality assurance and legal compliance purposes. 3 Technical and Security Data Access Logs and Security Data: Technical logs, IP addresses, and security monitoring data are retained for 1 year for security and fraud prevention purposes. Analytics Data: Aggregated and anonymized usage analytics are retained indefinitely for research and platform improvement purposes. 4 Early Deletion You may request early deletion of your personal data at any time by contacting [email protected]. We will honor such requests unless we have a legal obligation to retain the data or the data is necessary for the establishment, exercise, or defense of legal claims.

We implement comprehensive security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction: 1 Technical Security Measures Encryption and Secure Transmission: - All data transmissions are protected using SSL/TLS encryption certificates - Personal data is encrypted both in transit and at rest using industry-standard encryption protocols - Secure HTTPS connections for all platform interactions Access Controls: - Multi-factor authentication for administrative access - Role-based access controls limiting data access to authorized personnel only - Regular access reviews and permission audits - Secure user authentication and session management Infrastructure Security: - Hosting on Google Cloud Platform with enterprise-grade security features - Regular security monitoring and threat detection - Automated backup systems with secure storage - Network security controls and firewalls 2 Organizational Security Measures Data Governance: - Comprehensive data protection policies and procedures - Regular security training for all employees and contractors - Clear data handling protocols and incident response procedures - Privacy by design principles in system development Monitoring and Auditing: - Continuous monitoring of system access and data processing activities - Regular security assessments and vulnerability testing - Incident detection and response capabilities - Compliance monitoring and reporting 3 Data Breach Response In the event of a data breach that poses a risk to your rights and freedoms, we will: - Notify the Saudi Data & AI Authority (SDAIA) within 72 hours of becoming aware of the breach - Inform affected data subjects without undue delay when the breach is likely to result in high risk - Take immediate steps to contain and remediate the breach - Conduct a thorough investigation and implement additional safeguards as necessary

Currently, qaws alraqmiah does not transfer personal data outside the Kingdom of Saudi Arabia. All personal data collected through our platform is processed and stored within Saudi Arabia using local data centers and service providers. Should we need to transfer personal data outside Saudi Arabia in the future, we will: - Ensure the destination country has been deemed to have adequate data protection levels by SDAIA - Implement appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules - Conduct transfer risk assessments as required by the PDPL Transfer Regulations - Obtain your explicit consent where required by law - Notify you of any changes to our data transfer practices through updates to this Privacy Policy

As a data subject under the PDPL, you have the following rights regarding your personal data: 1 Right of Access You have the right to request information about: - What personal data we hold about you - The purposes for which we process your data - The categories of personal data we collect - The recipients or categories of recipients of your data - The retention period for your data - Your rights regarding your personal data To exercise this right, please contact [email protected] with your request. We will respond within 30 days and provide the information in a clear and accessible format. 2 Right to Rectification You have the right to request correction of any inaccurate or incomplete personal data we hold about you. This includes: - Updating contact information - Correcting assessment data or qualifications - Modifying profile information - Adding missing information to complete your records You can update much of your information directly through your account dashboard, or contact [email protected] for assistance. 3 Right to Erasure (Right to be Forgotten) You have the right to request deletion of your personal data when: - The data is no longer necessary for the original purpose - You withdraw your consent and there is no other legal basis for processing - Your data has been unlawfully processed - Deletion is required for compliance with legal obligations Please note that we may retain certain data if we have a legal obligation to do so or if the data is necessary for the establishment, exercise, or defense of legal claims. 4 Right to Restrict Processing You have the right to request restriction of processing of your personal data in the following circumstances: - You contest the accuracy of the data (restriction applies during verification) - The processing is unlawful but you prefer restriction over deletion - We no longer need the data but you require it for legal claims - You have objected to processing pending verification of our legitimate grounds 5 Right to Data Portability You have the right to: - Receive your personal data in a structured, commonly used, and machine-readable format - Transmit your data to another service provider where technically feasible - Request direct transmission of data between service providers where possible This right applies to data you have provided to us based on consent or contract and that we process by automated means. 6 Right to Object You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon receiving your objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. 7 Exercising Your Rights To exercise any of these rights, please contact us at: Email: [email protected] Subject Line: Data Subject Rights Request Required Information: Please include your full name, email address, and specific details about your request We will respond to your request within 30 days and may request additional information to verify your identity before processing your request.

Our website uses cookies and similar tracking technologies to enhance your user experience and improve our services: 1 Types of Cookies We Use Essential Cookies: - Authentication and session management cookies - Security and fraud prevention cookies - Load balancing and performance optimization cookies Analytics Cookies: - Website usage and performance analytics - User behavior and navigation pattern analysis - Platform improvement and optimization data Functional Cookies: - User preference and settings storage - Language and accessibility preferences - Assessment progress and state management 2 Cookie Management You can control cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of our platform and your ability to access certain features. For more information about cookies and how to manage them, please refer to your browser'shelp documentation or visit www . allaboutcookies . org .

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children under 18 years of age. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such information promptly. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at [email protected] so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes to this policy, we will: - Post the updated policy on our website with a new "Last Updated" date - Notify registered users via email about significant changes - Provide a summary of key changes where appropriate - Obtain new consent where required by law We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us: qaws alraqmiah Email: [email protected] General Contact: [email protected] Website: www.qaws.ai Data Protection Contact: [email protected] For complaints or concerns about our data protection practices, you may also contact the Saudi Data & AI Authority (SDAIA) through their official channels.

This Privacy Policy is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its implementing regulations. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Saudi Arabia

To ensure the highest level of data protection, we have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and implementation to ensure compliance with PDPL requirements. You can contact our DPO at: [email protected]