Privacy policy

1. Scope and the controller

Itqan operates a career navigation service through which individuals may assess their professional standing, identify target roles, obtain recommendations for training, and review employment opportunities. In relation to the personal data described in this Policy, Itqan acts as the controller and determines the purposes and means of its processing. Itqan is established in the Sultanate of Oman and its processing of personal data is subject to the laws of the Sultanate, and in particular to the Personal Data Protection Law and its Executive Regulations. The competent supervisory authority is the Ministry of Transport, Communications and Information Technology.

This Policy applies to all users of the service and should be read together with our Terms of Use. Capitalised expressions not defined in this Policy carry the meaning given to them in those Terms.

2. Personal data we collect

We collect the data you supply when you register, namely your full name, your email address and the password you select, together with a telephone number and a profile image where you elect to provide them. We further collect the documents you submit to the service, which typically comprise a curriculum vitae and may include academic transcripts, certificates and comparable records, whether uploaded as files or captured as photographs of physical documents.

From those documents we derive a structured professional record consisting of your skills, your educational history, your employment history, your projects and your certifications. We additionally collect the objectives and preferences you state within the service, the content of your exchanges with the assistant made available inside the product, and a record of your consumption of the service measured against the limits of your subscription.

We receive certain technical data automatically when you access the service, including your internet protocol address, the type and version of your browser, and the pages you request. We do not receive, process or store payment card details at any time; those are collected and processed exclusively by our payment processor.

3. Special categories of personal data

We do not request, and our systems provide no means of recording, data revealing religion, marital status, nationality, gender, date of birth or ethnic origin. No such category forms part of the professional record we derive from your documents, and no such category is used in the generation of any recommendation or match.

You should nonetheless be aware that where a document you submit contains information of that nature within its text, that text is transmitted, in the ordinary course of extraction, to the providers described in clause 6. Such information is not retained by us, does not enter your professional record and is not used for any purpose. Images of your documents are not transmitted to any such provider in any circumstances, and character recognition, where required, is performed on infrastructure under our control.

4. Purposes of processing and lawful basis

We process personal data in order to provide the service you have requested. That includes assessing your professional standing, identifying roles consistent with your record and stated objectives, compiling recommendations for training and certification, and presenting employment opportunities matched to your record. We further process personal data in order to administer your account, to communicate with you in connection with the service, to apply and enforce the limits of your subscription, to detect and prevent misuse, and to comply with obligations to which we are subject.

The lawful basis for this processing is your consent, obtained at registration by an affirmative act which is not pre-selected and without which an account cannot be created. We record the version of this Policy presented to you at the time consent was given. Consent may be withdrawn at any time in accordance with clause 9, and withdrawal does not affect the lawfulness of processing carried out before it.

Consent to receive marketing communications is obtained separately and is not comprised within the consent given at registration.

5. Automated processing

The service relies upon automated processing to read submitted documents, derive the professional record, identify suitable roles and compile recommendations. The matching of an individual to a role constitutes profiling within the meaning of applicable data protection law.

No result of that processing is applied until you have reviewed it. A confirmation stage is presented following extraction, at which the derived record is displayed to you together with its source and an indication of confidence, and at which you may amend or remove any element. No subsequent stage of processing occurs until that stage is completed. Any element which cannot be substantiated is presented as provisional and requires your confirmation.

You may object to automated processing and request that a decision be reviewed by a natural person by contacting us at the address in clause 14.

6. Disclosure to service providers

We engage a limited number of service providers to perform functions on our behalf, namely the hosting of our infrastructure and stored data, the provision of artificial intelligence processing used for extraction and for the assistant, the delivery of transactional electronic mail, and the processing of payments. Each such provider processes personal data solely on our instructions and for the purpose for which it was engaged, and each is bound by obligations of confidentiality and security.

We do not sell personal data. We do not disclose personal data for advertising purposes, and we do not permit any provider to use personal data disclosed to it for the development or improvement of its own products or models.

We may disclose personal data where required to do so by law, by order of a competent court, or at the lawful request of a public authority, and where necessary to establish, exercise or defend a legal claim.

7. Transfer outside the Sultanate of Oman

Personal data collected through the service is stored and processed outside the Sultanate of Oman, including in jurisdictions within Asia, Europe and North America. Such transfer is carried out on the basis of your consent, given at registration and capable of withdrawal.

Transfer does not discharge our obligations. We remain responsible for ensuring that each recipient affords personal data a standard of protection no lower than that required by the laws of the Sultanate of Oman, and we impose that standard by contract upon each provider we engage.

8. Retention

Personal data is retained for so long as your account subsists, in order that the record and history associated with your account remain available to you. You may delete an individual document at any time through the service, and such deletion removes both the record of the document and the underlying file.

Where you request the erasure of your account, we will erase the account and the personal data associated with it. Copies contained within backup media are removed as those media are superseded in the ordinary cycle of rotation, and are not retrieved or used in the interim.

9. Rights of the data subject

You are entitled to obtain confirmation of whether we process personal data relating to you and to be provided with a copy of that data; to require the correction of data which is inaccurate or incomplete; to require the erasure of your data; to receive your data in a structured and commonly used format capable of transmission to another party; to withdraw your consent, whereupon further processing shall cease; and to object to processing carried out by automated means and to request review by a natural person.

A request to exercise any of these rights may be made to the address in clause 14 and will be answered within thirty days of receipt. Where we are unable to give effect to a request in whole or in part, we will inform you of the reason. Nothing in this Policy limits your right to lodge a complaint with the Ministry of Transport, Communications and Information Technology.

10. Security

We apply technical and organisational measures appropriate to the nature of the personal data we hold. Passwords are stored as irreversible cryptographic hashes and are not recoverable by us. Session credentials are inaccessible to scripts executing in your browser and are transmitted only over encrypted connections. Access to production systems is restricted to those personnel whose duties require it.

No method of transmission or storage is entirely secure, and we do not warrant absolute security. Where a breach of personal data occurs which is likely to affect you, we will notify you and the supervisory authority without undue delay, and our notification will describe the nature of the breach and the measures taken in response.

11. Cookies

We place two cookies. The first maintains your authenticated session and is strictly necessary for the operation of the service. The second records the language you have selected. We do not place advertising cookies, we do not permit third party tracking, and we do not employ analytics which follow you beyond our website.

12. Minors

The service is available only to persons who have attained the age of eighteen years. We do not knowingly establish an account for any person below that age. Where we become aware that an account has been established in contravention of this clause, we will close the account and erase the personal data associated with it.

13. Amendment of this Policy

We may amend this Policy from time to time. Where an amendment is material we will notify you before it takes effect and, where the law so requires, we will obtain your consent afresh. The version of this Policy to which you consented is recorded against your account, and the version in force is identified by the date stated at the head of this document.

14. Contact and complaints

Any enquiry concerning this Policy, and any request to exercise a right under clause 9, may be addressed to ItqanTeam@outlook.com or to +968 7123 5872.

Where you consider that our processing of your personal data does not comply with applicable law, you are entitled to lodge a complaint with the Ministry of Transport, Communications and Information Technology in the Sultanate of Oman.