Privacy Policy

GoldinKollar ("GoldinKollar", "we", "us", "our") is a People & Culture consultancy based in Cairo, Egypt, serving clients across Saudi Arabia, Oman and Egypt. This policy explains what personal data we collect through our website, goldinkollar.com, why we collect it, who processes it on our behalf, and the rights you have over it.

We have written it to be specific and honest. Where a legal detail must be completed by us with our counsel before publication, we have marked it clearly rather than guess.

Who We Are and How to Reach Us

GoldinKollar is the controller of the personal data described in this policy. That means we decide why and how it is processed.

• Legal identity: [Registered legal entity name, commercial registration number and registered office address — to be completed by GoldinKollar with counsel before publication]
• Location: Cairo, Egypt
• Contact for privacy matters: islam.yousry@goldinkollar.com

If you have a question about this policy, or you want to exercise any of the rights described below, write to us at the address above.

What We Collect and When

We only collect personal data when you choose to give it to us through one of four routes on our website. We do not build profiles of visitors, and we do not track you across the web.

1. When you use the contact form

If you submit an enquiry through our contact form, we collect:

• Your name, company, and role
• Your email address and phone number
• Your region
• The nature of your enquiry, the product or service it concerns, and your free-text message
• Where your visit came from: the website, search engine or campaign that sent you here, the first page you opened, and, if the form asks, how you tell us you heard about us (see Cookies and Tracking below)

To protect the form against automated abuse, we also record two technical items with each submission: a salted SHA-256 hash of your IP address (not the IP address itself) and your browser's user-agent string. The hash lets us rate-limit repeated submissions without keeping your IP address itself. This pseudonymises the address; it does not make recovery mathematically impossible.

2. When you apply for a role

If you apply for an advertised role, we collect:

• Your full name, email address, and phone number
• Your LinkedIn profile URL
• Your cover letter
• Your CV, uploaded as a file (PDF, DOC or DOCX, up to 5 MB)

As with the contact form, we also record a salted hash of your IP address and your user-agent string for abuse prevention.

3. When you complete a screening assessment

If a role includes a screening assessment, we collect the answers and information you provide as part of it:

• Your written answers — narrative accomplishment records, situational-judgment ratings, forced-choice selections, and fit answers
• Scores and response-quality indicators computed from your answers
• The time you took to complete the assessment
• The language you chose to complete it in
• A record that you gave consent, and which version of the consent notice applied
• Optionally, a CV, if you provide one at this stage

We also record a salted hash of your IP address with the submission.

A note on third parties you mention. In your accomplishment records you may refer to a colleague or witness by first name or initials, and describe that person's role. We do not ask you for, and do not collect, contact details for those individuals at this stage. Please do not include other people's contact details or sensitive information about them in your answers.

4. When you use a free tool

Our free tools — the employee turnover calculator, the internal communication self-check, the ROI calculator and the employee survey templates — show their full result, and the PDF report, after you enter your details. When you do, we collect:

• Your name and work email address, and your phone number if you choose to give it
• The name of your organisation as we read it from your email's domain, which we print on your report
• What you entered into the tool and the result it calculated — for example, your headcount and leavers, or your ten self-check answers and the levels they give
• Whether you ticked the box asking us to send you GoldinKollar insights
• Where your visit came from, as described for the contact form above
• How many files you made, and when we emailed you the PDF

We use this to show you the result, to make your PDF (and, when you download it, to email you a copy), and to follow up with you about it. We email you insights only if you ticked that box, and you can ask us to stop at any time.

Your photo, job title and company. The internal communication self-check lets you add a photo, and type a job title and company, for your PDF report and share image. The photo stays in your browser until you ask for a file. It is then sent with that one request, used to make the file in that moment, and never stored or logged. It is not saved with your result, and the copy of the report we email you never includes it. The job title and company you type are sent with each file request and printed on the file, including the copy we email you; we do not save them.

As with our other forms, we also record a salted hash of your IP address and your user-agent string for abuse prevention.

Your browser also remembers, for 30 days, that you have opened a tool's result (so it does not ask again) and the details you entered (to fill them in on our other tools). This is kept in your browser's local storage, not in a cookie, and you can clear it in your browser's settings at any time. To clear only the details the form fills in, use "Not you? Clear these details" under the form.

How We Use Your Information

We use the information you give us for three purposes, and no others:

• To respond to your enquiry, if you contacted us through the contact form.
• To assess your application, if you applied for a role or completed an assessment. This includes reviewing your answers, considering your suitability, and communicating with you about the role.
• To send you the report you asked for and follow up about it, if you used one of our free tools — and to send you insights, only if you asked for them.

We do not sell your personal data. We do not use it for advertising. We do not share it for anyone's marketing purposes.

Legal basis. Under Egypt's Law No. 151 of 2020, and the equivalent laws of Saudi Arabia and Oman, we process your data on these bases: (1) your consent, given when you choose to submit the contact form, an application, an assessment, or a free tool's form — you may withdraw it at any time (see Your Rights); (2) steps taken at your request before entering a contract, where you apply for a role, since processing your application and assessment is necessary to consider you for employment; and (3) our legitimate interest in preventing automated abuse of our forms, which is the basis for storing a salted hash of your IP address and your user-agent string. Withdrawing consent does not affect processing already carried out before the withdrawal.

No Decision Is Made Solely by Software

We want to be plain about this, because, as a People & Culture consultancy, we hold ourselves to a high standard here.

The assessment computes scores and quality indicators. These are advisory only. No software rejects, selects, ranks-out, or otherwise decides the outcome for any candidate. A person reviews every application and every assessment. In that review, your own written answers carry more weight than any computed score. You are never subject to a decision made solely by automated means.

Who We Share It With

We do not sell or rent your data. We do rely on a small number of service providers ("sub-processors") that process data on our behalf, under our instructions, so that the website and its forms can work. They are:

Self-hosted images. Our website's images are served directly from our own infrastructure on the same domain, not from a third-party image host. No external image CDN receives your IP address or user-agent when a page loads. (An earlier version of this site loaded images from a third-party host, iili.io; that dependency has since been removed.)

We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.

Our website's fonts are self-hosted and built into the site. Displaying them sends no request to Google or any other font provider, so no visitor data is sent to Google for fonts.

International Transfer

We are based in Egypt. Our clients and applicants are in Egypt, Saudi Arabia, Oman and elsewhere. The data described in this policy is stored on servers in the United States (Vercel and Neon). For anyone outside the United States, submitting information to us therefore involves a cross-border transfer of that information to the United States, where data-protection law differs from your own. When you submit a form, you give your explicit consent to this cross-border transfer of your information to the United States. As a safeguard, Vercel and Neon process the data only on our documented instructions under our contracts with them, and only for the purposes described in this policy.

How Long We Keep It

We keep personal data only as long as we need it for the purpose we collected it. The periods below are the periods we apply; we will confirm and finalise them with our counsel.

• Contact enquiries: kept for up to 12 months from your last contact with us about the enquiry, then deleted.
• Job applications: kept for up to 12 months from submission, then deleted.
• Assessment responses: kept for 12 months from submission, then deleted.
• Free tool requests: kept for up to 12 months from your last contact with us about them, then deleted.

If we hire you, the information from your application and assessment becomes part of your employment record and is retained under the terms that govern employee records rather than the periods above.

How We Protect It

We take practical measures to protect the information you give us. Two are worth naming specifically:

• We never store your raw IP address with a submission. Instead we store a salted SHA-256 hash of it, and use it only to rate-limit abuse. Because an IP address is drawn from a limited range, this pseudonymises your address rather than guaranteeing it can never be recovered — it means we do not keep your IP in directly readable form, not that reversal is mathematically impossible.
• Uploaded CVs are stored as private objects. They are not published, not listed, and not accessible to the public by URL.

We also limit who can access submissions to the people who need to handle them. If a breach occurs that affects your personal data, we will notify the competent data-protection authority, and notify you where the law requires it, without undue delay. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We describe what we actually do; we do not promise perfection.

Your Rights

You have the following rights over your personal data:

• Access — to know what we hold about you.
• Correction — to have inaccurate data corrected.
• Deletion — to have your data erased.
• Objection — to object to our processing.
• Withdrawal of consent — where our processing relies on your consent, to withdraw that consent at any time, without affecting processing already carried out before you withdrew it.
• The right not to be subject to a decision based solely on automated processing — which, as stated above, we already honour by design, because a person reviews every application.
• The right to complain — if you believe we have mishandled your personal data, you may lodge a complaint with the competent authority: in Egypt, the Personal Data Protection Center; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA); in Oman, the Ministry of Transport, Communications and Information Technology. We would welcome the chance to resolve your concern first, so please consider contacting us before you do.

To exercise any of these, email islam.yousry@goldinkollar.com. We will respond within the time our applicable law allows.

Please note one consequence of deletion: if you ask us to delete a live application or assessment, that ends your candidacy, because there would be nothing left for us to assess.

Cookies and Tracking

When you first visit, we ask whether you accept analytics and advertising cookies. Both stay off until you choose to turn them on, and the website works fully without them.

• Essential. The website stores your cookie choice in your browser so it does not ask you again. Vercel, our hosting platform, may also set minimal cookies that are strictly operational, for example to route requests or keep the service running reliably.
• Analytics (only with your consent). We use Google Analytics to understand which pages people visit and how they use them. It sets cookies such as _ga and _ga_*.
• Advertising (only with your consent). We use Google Ads to measure how our ads perform and to show our ads to people who visited our website before. It sets cookies such as _gcl_au.
• Where you first came from (only with your consent to analytics). We keep the website, search engine or campaign that first brought you here, the first page you opened and the date, in a first-party cookie called gk_ft for 90 days. If you later send us an enquiry, it is saved with the enquiry so we can see which of our work reached you. It holds no name or contact detail, and it is removed when you withdraw your consent to analytics.

Whether or not you accept cookies, your browser keeps the same details for your current visit only (which website sent you, and the first page you opened) in its session storage. They are sent to us only if you submit a form, and they disappear when you close the tab.

Until you accept, no analytics or advertising cookie is stored on your device. Google may still receive basic signals without cookies — for example, that a page was viewed — which it uses only in aggregated form to estimate how our website and ads perform. These signals carry no identifier stored on your device.

You can change your choice at any time with "Cookie settings" at the bottom of every page. If you withdraw consent, we stop setting these cookies and remove the ones stored for our website. We keep your choice for 12 months if you accept and for 6 months if you decline. After that, we ask you again.

We do not sell your data, and we do not use these cookies to make any decision about you.

Children

Our website, our services, and the roles we advertise are directed at professionals and are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Governing Law

GoldinKollar is established in Egypt, and this policy is governed by Egyptian law, including the Personal Data Protection Law (Law No. 151 of 2020). If you are located outside Egypt — for example in Saudi Arabia, where the Personal Data Protection Law (PDPL) applies, or in Oman — you also have the rights granted by your local law, and we will honour them.

Changes to This Policy

We may update this policy as our practices change — for example, when we move our images to self-hosting. When we make a material change, we will update the date below and, where appropriate, take further steps to let you know. Please check this page from time to time.

Last Updated

10 October 2026.

This policy is being reviewed by legal counsel before final publication. Bracketed items marked "to be completed" will be filled in with our registered legal details at that stage.