Privacy Policy
How GoldinKollar collects, uses, and protects the information you share with us.
GoldinKollar ("GoldinKollar", "we", "us", "our") is a People & Culture consultancy based in Cairo, Egypt, serving clients across Saudi Arabia, Oman and Egypt. This policy explains what personal data we collect through our website, goldinkollar.com, why we collect it, who processes it on our behalf, and the rights you have over it.
We have written it to be specific and honest. Where a legal detail must be completed by us with our counsel before publication, we have marked it clearly rather than guess.
Who We Are and How to Reach Us
GoldinKollar is the controller of the personal data described in this policy. That means we decide why and how it is processed.
- Legal identity: [Registered legal entity name, commercial registration number and registered office address — to be completed by GoldinKollar with counsel before publication]
- Location: Cairo, Egypt
- Contact for privacy matters: islam.yousry@goldinkollar.com
If you have a question about this policy, or you want to exercise any of the rights described below, write to us at the address above.
What We Collect and When
We only collect personal data when you choose to give it to us through one of three routes on our website. We do not build profiles of visitors, and we do not track you across the web.
1. When you use the contact form
If you submit an enquiry through our contact form, we collect:
- Your name, company, and role
- Your email address and phone number
- Your region
- The nature of your enquiry, the product or service it concerns, and your free-text message
To protect the form against automated abuse, we also record two technical items with each submission: a salted SHA-256 hash of your IP address (not the IP address itself) and your browser's user-agent string. The hash lets us rate-limit repeated submissions without keeping your IP address itself. This pseudonymises the address; it does not make recovery mathematically impossible.
2. When you apply for a role
If you apply for an advertised role, we collect:
- Your full name, email address, and phone number
- Your LinkedIn profile URL
- Your cover letter
- Your CV, uploaded as a file (PDF, DOC or DOCX, up to 5 MB)
As with the contact form, we also record a salted hash of your IP address and your user-agent string for abuse prevention.
3. When you complete a screening assessment
If a role includes a screening assessment, we collect the answers and information you provide as part of it:
- Your written answers — narrative accomplishment records, situational-judgment ratings, forced-choice selections, and fit answers
- Scores and response-quality indicators computed from your answers
- The time you took to complete the assessment
- The language you chose to complete it in
- A record that you gave consent, and which version of the consent notice applied
- Optionally, a CV, if you provide one at this stage
We also record a salted hash of your IP address with the submission.
A note on third parties you mention. In your accomplishment records you may refer to a colleague or witness by first name or initials, and describe that person's role. We do not ask you for, and do not collect, contact details for those individuals at this stage. Please do not include other people's contact details or sensitive information about them in your answers.
How We Use Your Information
We use the information you give us for two purposes, and no others:
- To respond to your enquiry, if you contacted us through the contact form.
- To assess your application, if you applied for a role or completed an assessment. This includes reviewing your answers, considering your suitability, and communicating with you about the role.
We do not sell your personal data. We do not use it for advertising. We do not share it for anyone's marketing purposes.
Legal basis. Under Egypt's Law No. 151 of 2020, and the equivalent laws of Saudi Arabia and Oman, we process your data on these bases: (1) your consent, given when you choose to submit the contact form, an application, or an assessment — you may withdraw it at any time (see Your Rights); (2) steps taken at your request before entering a contract, where you apply for a role, since processing your application and assessment is necessary to consider you for employment; and (3) our legitimate interest in preventing automated abuse of our forms, which is the basis for storing a salted hash of your IP address and your user-agent string. Withdrawing consent does not affect processing already carried out before the withdrawal.
No Decision Is Made Solely by Software
We want to be plain about this, because, as a People & Culture consultancy, we hold ourselves to a high standard here.
The assessment computes scores and quality indicators. These are advisory only. No software rejects, selects, ranks-out, or otherwise decides the outcome for any candidate. A person reviews every application and every assessment. In that review, your own written answers carry more weight than any computed score. You are never subject to a decision made solely by automated means.
Who We Share It With
We do not sell or rent your data. We do rely on a small number of service providers ("sub-processors") that process data on our behalf, under our instructions, so that the website and its forms can work. They are:
| Provider | What they do for us | Where |
|---|---|---|
| Vercel | Hosts the website and its serverless functions, and provides private file storage for uploaded CVs | United States |
| Neon | Provides the PostgreSQL database that holds form and assessment submissions | United States |
| Resend | Sends notification emails to our hiring team when a form is submitted — used only where this is configured | (Email delivery service) |
Self-hosted images. Our website's images are served directly from our own infrastructure on the same domain, not from a third-party image host. No external image CDN receives your IP address or user-agent when a page loads. (An earlier version of this site loaded images from a third-party host, iili.io; that dependency has since been removed.)
We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.
Our website's fonts are self-hosted and built into the site. Displaying them sends no request to Google or any other font provider, so no visitor data is sent to Google for fonts.
International Transfer
We are based in Egypt. Our clients and applicants are in Egypt, Saudi Arabia, Oman and elsewhere. The data described in this policy is stored on servers in the United States (Vercel and Neon). For anyone outside the United States, submitting information to us therefore involves a cross-border transfer of that information to the United States, where data-protection law differs from your own. When you submit a form, you give your explicit consent to this cross-border transfer of your information to the United States. As a safeguard, Vercel and Neon process the data only on our documented instructions under our contracts with them, and only for the purposes described in this policy.
How Long We Keep It
We keep personal data only as long as we need it for the purpose we collected it. The periods below are the periods we apply; we will confirm and finalise them with our counsel.
- Contact enquiries: kept for up to 12 months from your last contact with us about the enquiry, then deleted.
- Job applications: kept for up to 12 months from submission, then deleted.
- Assessment responses: kept for 12 months from submission, then deleted.
If we hire you, the information from your application and assessment becomes part of your employment record and is retained under the terms that govern employee records rather than the periods above.
How We Protect It
We take practical measures to protect the information you give us. Two are worth naming specifically:
- We never store your raw IP address with a submission. Instead we store a salted SHA-256 hash of it, and use it only to rate-limit abuse. Because an IP address is drawn from a limited range, this pseudonymises your address rather than guaranteeing it can never be recovered — it means we do not keep your IP in directly readable form, not that reversal is mathematically impossible.
- Uploaded CVs are stored as private objects. They are not published, not listed, and not accessible to the public by URL.
We also limit who can access submissions to the people who need to handle them. If a breach occurs that affects your personal data, we will notify the competent data-protection authority, and notify you where the law requires it, without undue delay. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We describe what we actually do; we do not promise perfection.
Your Rights
You have the following rights over your personal data:
- Access — to know what we hold about you.
- Correction — to have inaccurate data corrected.
- Deletion — to have your data erased.
- Objection — to object to our processing.
- Withdrawal of consent — where our processing relies on your consent, to withdraw that consent at any time, without affecting processing already carried out before you withdrew it.
- The right not to be subject to a decision based solely on automated processing — which, as stated above, we already honour by design, because a person reviews every application.
- The right to complain — if you believe we have mishandled your personal data, you may lodge a complaint with the competent authority: in Egypt, the Personal Data Protection Center; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA); in Oman, the Ministry of Transport, Communications and Information Technology. We would welcome the chance to resolve your concern first, so please consider contacting us before you do.
To exercise any of these, email islam.yousry@goldinkollar.com. We will respond within the time our applicable law allows.
Please note one consequence of deletion: if you ask us to delete a live application or assessment, that ends your candidacy, because there would be nothing left for us to assess.
Cookies and Tracking
Our application sets no cookies of its own. It runs no analytics, no advertising trackers, and no third-party tracking scripts. We do not profile you and we do not follow you across other websites.
The one honest caveat: Vercel, our hosting platform, may set minimal cookies that are strictly operational — for example, to route requests or keep the service running reliably. These are not used by us to track or advertise to you.
Children
Our website, our services, and the roles we advertise are directed at professionals and are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Governing Law
GoldinKollar is established in Egypt, and this policy is governed by Egyptian law, including the Personal Data Protection Law (Law No. 151 of 2020). If you are located outside Egypt — for example in Saudi Arabia, where the Personal Data Protection Law (PDPL) applies, or in Oman — you also have the rights granted by your local law, and we will honour them.
Changes to This Policy
We may update this policy as our practices change — for example, when we move our images to self-hosting. When we make a material change, we will update the date below and, where appropriate, take further steps to let you know. Please check this page from time to time.
Last Updated
22 July 2026.
This policy is being reviewed by legal counsel before final publication. Bracketed items marked "to be completed" will be filled in with our registered legal details at that stage.