Who we are

Rawabit is operated by Ismail Aftal, an individual based in the Netherlands. We are the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).

Because we are established in the Netherlands, we apply the GDPR to all users, wherever you live. For privacy questions or requests, contact us at .

Information we collect

Job seekers: your name, email address, education, skills, work experience, CV, and profile photo if you choose to add one.

Companies: company name, country, the name and contact details of the person managing the account, and billing details.

Everyone:

• Account data, such as your email address, password (stored only in hashed form) and language preference
• Sign-in data, if you sign in with Apple or Google: your name and email address (Apple may give us a private relay email address instead)
• If you allow notifications: a device token, so we can send push notifications to your phone. You can turn them off in your phone settings.
• Applications and their status, and messages you send through the platform
• Reviews you give and receive, and reports or blocks you make or receive
• Payment and invoice records for paid features (card details are handled by our payment provider; we do not store full card numbers)
• Technical data, such as IP address, device and browser type, login times and security logs

Please do not include sensitive information in your profile or CV, such as your religion, ethnic background, political views, health information or ID numbers. Companies don't need this to assess your application. If you choose to include it anyway, it will be shared with companies you apply to.

Why we use your information and our legal basis

Moderation: if a conversation is reported, our moderators may review the messages in that specific conversation to investigate the report. We do not read your messages otherwise.

Matching: our system suggests jobs or candidates based on your profile. These are suggestions only. Rawabit does not make automated decisions about whether you get a job; companies make their own decisions.

We do not use your data to build advertising profiles.

Who can see your information

• Companies you apply to see your profile, CV and application message, so they can respond.
• Candidate listing: if you choose to create a candidate listing, registered companies can view your skills, experience and CV — your name and other identifying details stay hidden until you respond to a company that has expressed interest. This is off by default and you can switch it off at any time.
• Reviews: a company's reviews are shown on its public company page. A job seeker's received reviews are not published anywhere on the platform.
• Service providers that help us run Rawabit, such as hosting, email delivery, payment processing and analytics. They may only use your data on our instructions and under a data processing agreement.
• Authorities, only where we are legally required to under the laws that apply to us.
• A buyer or successor, if Rawabit is ever merged or sold, under the same protections as this policy.

We never sell your personal data and do not share it with anyone for their own marketing.

International transfers

Our servers are located in the Netherlands. Most companies on Rawabit are located in Syria, which is not considered by the European Commission to provide an equivalent level of data protection.

When you apply to a company outside the EU, we send your application to that company because you ask us to. This transfer is necessary to provide the service you requested (Article 49(1)(b) GDPR). Once a company has received your application, that company is responsible for how it handles your data. Please only apply to companies you are comfortable sharing your information with.

Where our own service providers process data outside the EU/EEA, we use appropriate safeguards such as the European Commission's standard contractual clauses.

How long we keep your information

• Account and profile: as long as your account is active. If you don't log in for 24 months, we'll notify you and then delete your account.
• Applications: 12 months after the vacancy closes.
• Messages: as long as the account exists, unless deleted earlier.
• Payment and invoice records: 7 years, as required by Dutch tax law.
• Security logs: 90 days.
• Reports and moderation records: 12 months after the case is closed.
• Backups: deleted data is removed from backups within 30 days.

When you delete your account, we remove your profile and personal data, except records we must keep by law. Applications you already sent remain with the companies that received them. Messages you sent may remain visible to the recipient, shown as sent by a deleted user.

Cookies

We don't place analytics cookies without your consent. The website only stores your language choice in your browser. Website visits may be counted with Vercel Web Analytics, which does not use cookies and does not identify individual visitors.

Security

Passwords are hashed and never stored in plain text. Uploaded documents like your CV are stored outside the public web and are only accessible to you and the people you've chosen to share them with. Login attempts are rate-limited to protect against automated attacks. To do this, your IP address is used only briefly (the counters are removed after about a day), and we do not share it with other companies for advertising or analytics. No system is perfectly secure, but we take reasonable, concrete steps to protect your data. If a data breach occurs that poses a risk to you, we will inform you and the relevant authority as required by law.

Your rights

Every user, in every country, has the right to:

• access the personal data we hold about you
• correct inaccurate data
• have your data deleted
• restrict or object to certain uses of your data
• receive your data in a portable format
• withdraw consent at any time, without affecting earlier use

You can view, edit and delete most of your information directly in your account settings, download a copy of your data in the app (Settings, Privacy), and delete your account at any time (see how to delete your account). For other requests, email . We'll respond within one month and may ask you to confirm your identity first.

If you believe we haven't handled your data properly, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in your own country.

Children

Rawabit is only for people who are at least 18 years old. We don't knowingly collect information from anyone younger and will remove such accounts when we become aware of them.

Changes to this policy

We may update this policy as Rawabit evolves. If we make important changes, we'll notify you by email or in the app before they take effect. The date at the top shows when this policy was last updated.

Language

This policy is available in Arabic and English. If there is any difference between the two versions, the English version applies.