Your data, and how we look after it.

Who we are

Zorwa is a career-acceleration service built and operated by GRG, an independent recruitment firm with 17 years of hiring experience across the UAE and Saudi Arabia. Where this policy says "we", "us" or "Zorwa", it means GRG operating the Zorwa service. GRG is the controller responsible for the personal data described here.

If you have any question about this policy or your data, write to us at privacy@zorwa.com.

What we collect

We only collect what we need to run the service and stay in touch with you:

• Contact details: your name, email address and phone or WhatsApp number.
• Your CV: the CV file you upload, and the text we parse from it so the service can analyse and improve it.
• LinkedIn profile: optional. If you choose to import it, we read your public LinkedIn profile to complete your CV.
• Usage analytics: how you use the site and product, such as pages viewed and features used, so we can understand what works and fix what does not.

We do not ask for special-category data (such as health, religion or political views), and you should not include it in your CV.

Why we use it, and the legal basis

We use your data for two purposes, each with its own legal basis:

• To provide the service: reviewing and improving your CV, preparing you for interviews, matching you to roles and giving you guidance. The legal basis is performance of the service you asked us for.
• To keep you informed and to transfer data across borders: sending you emails about the service and launch, and using the processors below, some of which are outside your country. The legal basis is your explicit consent, which you give when you sign up or join, and which you can withdraw at any time.
• Google user data (Gmail): Zorwa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect your Google account, we request Gmail read and send access solely to let you read replies to, and send, your networking outreach from within the app. We do not use this Gmail data for advertising; we do not sell it; we do not transfer it to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice); and we do not allow humans to read it except with your explicit consent, for security purposes (such as investigating abuse), or to comply with applicable law. You can revoke this access at any time by disconnecting Google in the app or via your Google Account permissions.

The processors we use, and where they are

To run Zorwa we rely on a small set of trusted service providers. Each one only receives the data it needs, and only to do its job for us.

We name the type of service and the country here rather than the specific vendors. The specific companies we use for each service are available on request at privacy@zorwa.com.

Cross-border transfers and safeguards

Because the processors above sit in different countries, your data is transferred outside the UAE and Saudi Arabia. We only make these transfers with your explicit consent, and we put safeguards in place: each processor is bound by a contract that limits them to processing your data on our instructions, requires appropriate security, and forbids them from using your data to train their own models. We keep the number of processors, and the data each one sees, to the minimum the service needs.

How long we keep it

We do not keep data longer than we need it:

• Raw CV files: deleted 30 days after upload.
• Parsed CV text and analysis: kept until 180 days of inactivity, then deleted.
• Lead contact details: kept for 365 days since your last interaction with us, then deleted.

You can ask us to delete your data sooner at any time (see your rights below).

Your rights, and how to exercise them

Under the UAE Personal Data Protection Law and the Saudi Personal Data Protection Law, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your data.
• Withdraw consent, including consent to marketing and to cross-border transfers, at any time.

To exercise any of these, email privacy@zorwa.com. We will respond within 30 days. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

How we protect it

We use encryption in transit, access controls that limit who can see your data, and the minimum retention set out above. We only work with processors that commit to appropriate security. No system is ever perfectly secure, but we treat your CV and contact details as sensitive and handle them accordingly.

Complaints

If you believe we have mishandled your data, please tell us first at privacy@zorwa.com so we can put it right. You also have the right to complain to your data protection regulator:

• United Arab Emirates: the UAE Data Office.
• Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA).

Changes to this policy

If we change how we handle your data, we will update this page and change the "last updated" date at the top. If the change is significant, we will let you know by email.