Privacy Policy

1. Introduction

Welcome to CADREMY.

CADREMY is a professional capability and career advancement platform based in Riyadh, Kingdom of Saudi Arabia. Our purpose is to help people understand, develop and demonstrate their capabilities and connect those capabilities with learning, professional development and career opportunities.

Our principle is simple:

Capability Creates Opportunity.

We respect your privacy and are committed to protecting your personal data responsibly, transparently and securely.

This Privacy Policy explains how CADREMY collects, uses, stores, shares and protects personal data when you use our websites, platforms, services, Digital Capability Profile (DCP), learning services, opportunity services and related products and communications.

It also explains the choices and rights available to you.

2. Who We Are

For the purposes of this Privacy Policy, the organisation responsible for determining how and why your personal data is processed is:

CADREMY

SARD Cultural Centre

King Saud University

Riyadh

Kingdom of Saudi Arabia

Privacy enquiries: hi@cadremy.org (hi@cadremy.org)

Where another organisation independently determines how it uses your information, that organisation may also act as a separate controller and its own privacy policy may apply.

3. Who This Policy Applies To

This Privacy Policy may apply to people interacting with CADREMY including:

• CADREMY Professionals;
• Students and graduates;
• Prospective users;
• Job and opportunity seekers;
• Learners and trainees;
• Educators, trainers, assessors and mentors;
• Employer representatives and recruiters;
• University representatives;
• Government representatives;
• Sponsors and strategic partners;
• Learning and training partners;
• Website visitors; and
• Other people who interact with CADREMY.

CADREMY is based in Saudi Arabia but may provide services to users internationally.

Where another country's data-protection law applies to our processing, we will take reasonable measures to comply with the applicable requirements and provide additional privacy information where required.

4. The Personal Data We May Collect

The information we collect depends upon how you interact with CADREMY.

4.1 Identity and Contact Information

This may include:

• Name;
• Email address;
• Telephone/mobile number;
• Country or region;
• Date of birth or age information where required;
• Preferred language; and
• Other information required to establish or manage your account.

4.2 Professional and Career Information

Where relevant to the services you use, this may include:

• Employment history;
• Job titles and professional roles;
• Industry or sector;
• Skills and capabilities;
• Professional experience;
• CV or résumé information;
• Professional qualifications;
• Certifications;
• Licences;
• Portfolios;
• Career interests;
• Employment preferences;
• Opportunity applications; and
• Information you choose to include in your professional profile.

4.3 Education and Learning Information

This may include:

• Educational history;
• University or institution;
• Qualifications;
• Courses;
• Assessments;
• Training records;
• CPD activity;
• Learning progress;
• Certificates; and
• Professional development activity.

4.4 Digital Capability Profile Information

Where you participate in CADREMY's Digital Capability Profile system, we may process information relating to:

• Your DCP;
• Capability assessments;
• Verified skills and evidence;
• Professional experience;
• Development activity;
• Capability progression;
• Learning recommendations;
• Professional-development recommendations; and
• Other information relevant to understanding and developing professional capability.

A DCP level or assessment should not be understood as a guarantee of employment, professional competence, regulatory status or future career outcomes.

4.5 Opportunity and Matching Information

We may process information about:

• Opportunities viewed;
• Searches performed;
• Career interests;
• Applications;
• Matching preferences;
• Capability-to-opportunity matching;
• Employer interactions; and
• Related activity within CADREMY or integrated opportunity services.

4.6 Documents and Information You Provide

You may choose, or in some services be required, to provide documents supporting your qualifications, professional experience, learning or identity.

CADREMY will seek to collect only information reasonably necessary for the relevant purpose.

Where official identification documents are required, additional controls may apply.

4.7 Communications

We may retain information contained in communications with us, including customer-service enquiries, emails, forms, surveys, platform messages and other communications.

4.8 Payment and Transaction Information

Where you purchase a CADREMY service, we may process information relating to the transaction, subscription, invoice or payment status.

Payment-card or banking information may be processed directly by authorised payment providers. CADREMY does not necessarily receive or store complete payment-card credentials.

4.9 Technical and Usage Information

When you use our digital services, we may collect technical information such as:

• IP address;
• Browser and device information;
• Operating system;
• Login activity;
• Website or platform usage;
• Pages visited;
• Referral information;
• Cookie identifiers;
• Security logs; and
• Similar technical information.

Further information will be provided in the CADREMY Cookies Policy.

5. How We Collect Personal Data

We may obtain personal data:

Directly from you when you register, create a profile, complete an assessment, upload information, apply for an opportunity, enrol in learning, purchase a service, communicate with us or otherwise interact with CADREMY.

Through your use of CADREMY when you interact with our websites, platform, DCP, learning environment and opportunity services.

From organisations you interact with, where lawful and appropriate, including employers, universities, learning providers, training partners and opportunity partners.

From integrated services and technology providers, where required to provide functionality you have requested.

From publicly available sources, where collection and use are lawful and appropriate.

Where personal data is obtained from another source, we will provide applicable information about that processing where required by law.

6. Why We Use Personal Data

Depending upon the service and applicable law, CADREMY may process personal data to:

• Create and administer accounts;
• Provide requested services;
• Create and maintain professional profiles;
• Operate the digital capability profile;
• Assess and develop professional capability;
• Verify information where appropriate;
• Provide learning and professional-development services;
• Recommend learning, CPD and development pathways;
• Identify potentially relevant career opportunities;
• Match capabilities with opportunities;
• Facilitate applications and employer interactions;
• Provide employer and talent services;
• Administer training programmes;
• Manage subscriptions and transactions;
• Provide customer support;
• Communicate important service information;
• Improve our services and user experience;
• Analyse platform performance;
• Maintain platform security;
• Detect or prevent fraud and misuse;
• Fulfil contractual commitments;
• Comply with legal and regulatory obligations; and
• Establish, exercise or defend legal rights where appropriate.

We will not intentionally use personal data for purposes incompatible with the purpose for which it was collected unless permitted by applicable law.

7. Our Legal Bases for Processing

The legal basis we rely upon depends upon the particular processing activity and applicable law.

These may include:

Consent

We may ask for your consent where required, including for certain marketing, optional processing, sensitive data or other activities for which consent is the appropriate legal basis.

Where processing is based on consent, you may withdraw that consent through the mechanisms we provide, subject to applicable law.

Contractual Necessity

We may process information where necessary to provide a service you have requested or to perform obligations arising from our relationship with you.

Legal Obligation

We may process information where necessary to comply with applicable law, regulation, court orders or lawful regulatory requirements.

Legitimate Interests

Where permitted by applicable law, we may process personal data where this is necessary for a legitimate interest and that interest does not improperly override your rights and interests.

Examples may include platform and network security, fraud prevention and appropriate service improvement.

We will conduct any assessment required by applicable law before relying upon legitimate interests.

Other Lawful Bases

Other legal bases may apply where processing is necessary to protect vital interests, fulfil a legal or public-interest requirement, or in other circumstances permitted by applicable law.

8. Artificial Intelligence, DCP and Automated Processing

Technology, data and artificial intelligence form an important part of CADREMY's long-term capability platform.

CADREMY may use AI, machine learning, algorithms and other data-driven technologies to assist with:

• Analysing professional capabilities;
• Developing and maintaining DCP information;
• Identifying skills and capability gaps;
• Recommending learning and CPD;
• Recommending professional-development pathways;
• Matching capabilities with opportunities;
• Identifying potentially relevant candidates for employers;
• Generating career insights; and
• Improving CADREMY's services.

Our objective is for AI to support human capability and decision-making, not replace human judgement where a decision could have a significant effect on an individual.

Where required, CADREMY will implement safeguards such as appropriate human oversight, transparency, mechanisms to challenge or correct information, and impact assessments.

CADREMY does not intend solely automated processing to make final employment decisions on behalf of employers.

Employers remain responsible for their own recruitment and employment decisions.

Where applicable law provides rights relating to automated decision-making or profiling, CADREMY will respect those rights.

9. Employer Visibility and Privacy by Design

CADREMY is designed to help capability create opportunity without requiring Professionals to surrender unnecessary control over their personal information.

Our intended approach is therefore privacy by default and progressive disclosure.

Depending upon the service and your settings, the journey may operate broadly as:

Discoverable capability → Limited professional profile → Identifiable professional profile → Direct contact/application

Registering with CADREMY does not, by itself, mean that your complete identity, contact details, CV or other personal information should automatically become publicly available to employers.

Employers may be able to discover relevant capability information or limited professional information where appropriate.

Additional information may become available when you:

• Change your privacy or visibility settings;
• Express interest in an opportunity;
• Apply for an opportunity;
• Authorise additional disclosure; or
• Otherwise request or reasonably expect CADREMY to facilitate an employer interaction.

Specific visibility controls may evolve as CADREMY develops. We will provide appropriate information and controls within the platform.

10. Children and Younger Users

CADREMY's mission includes supporting students and future professionals. Some users may therefore be under the age at which they can independently provide legally valid consent in their jurisdiction.

We take the privacy of younger users seriously.

Where a user lacks full or partial legal capacity, CADREMY will seek appropriate involvement or consent from a parent or legal guardian where required by applicable law and will take appropriate measures to verify that authority.

CADREMY intends to apply enhanced privacy protections to younger users. Depending upon age, jurisdiction and service, these may include:

• More restrictive privacy settings by default;
• Restrictions on employer visibility;
• Restrictions on direct employer contact;
• Limits on profiling;
• Age-appropriate privacy information;
• Additional safeguards around AI and automated processing;
• Restrictions on marketing;
• Parental or guardian involvement where legally required; and
• Additional controls over sharing personal information.

The interests, safety and privacy of younger users will take priority over commercial optimisation or employer discoverability.

Where a service cannot safely or lawfully be provided to a younger user, CADREMY may restrict access to that service until the applicable age or consent requirements have been satisfied.

11. Marketing and Communications

CADREMY may communicate through:

• email;
• SMS;
• WhatsApp;
• Platform notifications; and
• Other appropriate communication channels.

We distinguish between service communications and marketing communications.

Service communications may include security information, account information, transactional communications and important information necessary to provide a service.

Marketing communications may include information about CADREMY programmes, opportunities, learning, events, products, services or promotions.

Where consent is required for direct marketing, CADREMY will seek it before sending such communications.

You can withdraw your marketing consent or change your preferences using the mechanisms provided in the communication or by contacting us at hi@cadremy.org (hi@cadremy.org).

Stopping marketing communications will not necessarily prevent us from sending essential service or transactional communications.

12. Sharing Personal Data

CADREMY does not treat personal data as a commodity to be indiscriminately sold.

We may disclose or make personal data available where necessary and lawful to organisations involved in delivering or supporting our services, which may include:

• Cloud and hosting providers;
• CRM providers;
• Learning-management and education providers;
• Career wallet and opportunity-service partners;
• Employers and recruiters;
• Universities;
• Training and learning partners;
• Payment processors;
• Analytics providers;
• Communications providers;
• Professional advisers;
• Technology and security providers;
• Government or regulatory bodies where legally required; and
• Other service providers acting on our behalf.

The information shared and the recipient's role will depend upon the particular service.

Where a provider processes personal data on CADREMY's behalf, we will seek appropriate contractual and organisational safeguards.

Some partners may independently determine how they process information provided to them. Their own privacy policies and legal obligations may then apply.

We will not disclose personal data merely because an organisation wishes to access it. Disclosure must have an appropriate purpose and legal basis.

13. Career Wallet and Opportunity Services

CADREMY may integrate with Career Wallet or other opportunity providers to provide access to employment, career and professional opportunities.

Where you interact with an integrated opportunity service, personal information may need to be exchanged between CADREMY and the relevant provider to deliver the requested functionality.

Before material information is transferred to an independent third-party service, CADREMY will seek to provide appropriate information about the relationship and any choices available to you.

Third-party services may operate under their own privacy policies and terms.

14. International Data Transfers

CADREMY is based in Saudi Arabia but is designed to operate internationally.

Some technology providers, partners or service providers may process personal data outside Saudi Arabia.

Where personal data is transferred outside the Kingdom, CADREMY will seek to ensure that the transfer is carried out in accordance with applicable Saudi requirements governing international transfers and with appropriate safeguards.

Depending upon the circumstances, these safeguards may include recognised adequacy arrangements, contractual safeguards, binding rules, regulatory exemptions or other mechanisms permitted by applicable law.

Where personal data relating to users in another jurisdiction is transferred internationally, additional safeguards required by that jurisdiction may also apply.

CADREMY will seek to transfer only the information reasonably necessary for the relevant purpose.

15. Data Security

CADREMY takes reasonable organisational, administrative and technical measures designed to protect personal data against:

• Unauthorised access;
• Unlawful use;
• Accidental loss;
• Alteration;
• Unauthorised disclosure; and
• Destruction.

Our security measures will develop with the scale, complexity and risk profile of the platform.

Access to personal information should be restricted according to legitimate operational requirements.

No internet-based service can guarantee absolute security. Users should also take reasonable steps to protect their accounts, including maintaining secure passwords and not sharing account credentials.

Where a personal-data breach occurs, CADREMY will assess and notify the relevant authorities and affected individuals where required by applicable law.

16. Data Retention

CADREMY will retain personal data only for as long as reasonably necessary for the purpose for which it was collected, or for another period required or permitted by applicable law.

Retention periods will take account of factors including:

• The purpose for which information was collected;
• The type and sensitivity of the information;
• The duration of the relationship with the user;
• Legal and regulatory requirements;
• Contractual obligations;
• Security and fraud-prevention requirements;
• Dispute and legal-claim periods; and
• Whether information can appropriately be anonymised.

Where personal data is no longer required and there is no lawful reason to retain it, it will be securely destroyed, deleted or anonymised in accordance with applicable requirements.

CADREMY will maintain and develop an internal data-retention schedule appropriate to its processing activities.

17. Your Privacy Rights

Your precise rights depend upon the law applicable to you and may be subject to lawful limitations or exceptions.

Under applicable Saudi data-protection law, these may include rights to:

• Be informed about the processing of your personal data;
• Access personal data held about you;
• Request a copy of your personal data in an appropriate format;
• Request correction, completion or updating of inaccurate information; and
• Request destruction of personal data where applicable.

Where processing relies upon consent, you may also have the right to withdraw that consent.

Depending upon your location, additional rights may apply, including rights concerning:

• Deletion or erasure;
• Restriction of processing;
• Objection to certain processing;
• Data portability; and
• Automated decision-making and profiling.

To exercise an applicable privacy right, contact:

hi@cadremy.org (hi@cadremy.org)

We may need to verify your identity before fulfilling a request.

Where a request concerns a person who lacks full or partial legal capacity, additional verification of parental or legal-guardian authority may be required.

18. Complaints

We encourage you to contact CADREMY first if you have concerns about how your personal data has been handled.

Email: hi@cadremy.org (hi@cadremy.org)

We will review privacy concerns and seek to resolve them appropriately.

You may also have the right to submit a complaint to the competent data-protection authority.

For matters governed by Saudi Arabia's Personal Data Protection Law, the competent authority is the Saudi Data & AI Authority (SDAIA).

If another country's data-protection legislation applies to your circumstances, you may also have the right to complain to the relevant supervisory authority in that jurisdiction.

19. Third-Party Websites and Services

CADREMY may contain links to or integrations with external websites, platforms or services.

We are not responsible for the privacy practices of independent third parties.

We encourage you to review their privacy policies before providing personal information directly to them.

20. Cookies and Similar Technologies

CADREMY may use cookies and similar technologies to provide essential functionality, maintain security, remember preferences, understand service usage and, where permitted, support analytics and marketing.

Where required, non-essential cookies will be subject to appropriate consent or preference controls.

Full details will be provided in the CADREMY Cookies Policy.

21. Changes to This Privacy Policy

CADREMY may update this Privacy Policy as our platform, technology, services, partnerships or legal obligations develop.

When we make material changes, we will take reasonable steps to notify users where required.

The latest version will be published on the CADREMY website with its effective or last-updated date.

Where a new use of personal data requires additional consent or notice under applicable law, updating this Privacy Policy alone will not replace those requirements.

22. Contact CADREMY

For questions about this Privacy Policy, your personal data or your privacy rights, contact:

CADREMY

SARD Cultural Centre

King Saud University

Riyadh

Kingdom of Saudi Arabia

Email: hi@cadremy.org