The Works ATS — Privacy Policy

1. Who we are and what this covers

The Works ATS is a trade name of THEWORKS DATA AND SERVICES - FZCO, trade licence no. 93788 issued by the Dubai Integrated Economic Zones Authority, Dubai Silicon Oasis, Dubai, United Arab Emirates (“we”, “us”), which also trades as The Works Group. It is the recruiting system we run. It is used by our own recruiting desk and by agencies and in-house hiring desks that have their own account. For the pipeline we run ourselves, we are the controller of the personal data below under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Where an agency uses the ATS for its own pipeline, that agency is the controller of the data it enters and we process it only on its instructions (PDPL Art 8). A client company that receives a candidate’s profile from us becomes a separate controller of what it then does with that profile; we are not its processor.

2. Whose data, and what we hold

• Candidates and prospects: name, phone, nationality, languages, the company and role we discussed, how we found them, notes, interview and offer feedback, an offer amount where one exists, dates, and a log of each call or message. When a recruiter opens a WhatsApp message to you from the system, our note of it is saved here; the message itself is sent from the recruiter’s own WhatsApp, which belongs to WhatsApp, not to us.
• Client-company contacts: name, role, email, phone.
• Real-estate agents on our register: name, the photograph and licence (BRN) number and dates published with their Dubai Land Department licence, agency, languages, nationality, listing and transaction history, and links to public profiles. These come from public sources: the Dubai Land Department broker list and data, and public agent pages on property portals. We hold contact numbers and emails collected into the register, but we do not show them to users, and an attempt to open them is logged and refused.
• Our own users (recruiters, owners, viewers): name, work email, role, a password stored only as a one-way hash, login times, failed-login counts and lock times, and the network address of failed attempts.
• Everyone using the system: each page view records who, the page address and the browser’s user-agent text. An invitation link records each time it is opened, with the browser text and the time.
• Nationality is data we choose to hold because recruiters and clients search on it. We do not use it to rank or reject anyone, and our terms forbid clients from using it to discriminate.
• We do not ask for payment card details or health data in the ATS.

WhatsApp. If you choose to message us on WhatsApp from this site, you start the conversation from your own WhatsApp account. We receive your phone number and what you write. Replies are written by our team, which includes artificial intelligence (AI) assistants. WhatsApp is run by Meta Platforms Ireland Limited, which handles the messages on its own systems under its own terms. We use your number and messages only to answer you, and we keep our copy on our server in Helsinki, within the European Union (Finland), only as long as that purpose needs. Write STOP and we send nothing further. You can ask us to delete your messages (see "Your rights").

3. Why we use it, and on what ground

• Candidates who apply to us or ask us to act: to take the steps you asked for and to carry out an agreement with you: PDPL Art 4(9).
• Agents and prospects we found from public information: you have not been asked. We rely on Art 4(2) for what you yourself made public, such as your own public agent profile. We do not send marketing to anyone on the register. A recruiter may contact an agent about a role, and if you tell us to stop, or to hide or erase your entry, we do it (Arts 15 and 17).
• Client contacts: to carry out the agreement with that client: Art 4(9).
• Users: to manage access and security: Art 4(8) and 4(9).
• To make or defend a legal claim: Art 4(3).
• Anything else, only with your consent (Art 6), which you can withdraw as easily as you gave it.
• We do not make decisions about you by automated processing alone (Art 18), and we use the data for recruiting and nothing else without a new ground (Art 5).

4. What we do not do

Being in our system is not a promise of a job, an interview or an offer. We do not sell personal data. We use no advertising or analytics provider, no mail provider and no artificial-intelligence service on the data in this system.

5. Who can see it

The recruiters, owners and viewers on the same account, and the platform staff who run the system. Each agency’s data is kept separate from every other agency’s. A manager may view the system as another user only with a recorded reason and a time limit, and every such session is logged. A client company sees only the profile we choose to share with it for a role, and we tell candidates which client companies their profile may go to. Our private office and Allure Travel are kept apart and never share data with this system, in either direction.

6. Where it is held

On a server that we run in Helsinki, within the European Union (Finland). That is outside the UAE, so the transfer is made under PDPL Arts 22 and 23, including the explicit consent of the person where those Articles require it. Cloudflare serves the site at the edge of the network. We have no other processor of this data; if that changes, this page will name it, and the safeguard, before the change takes effect.

7. Cookies

The system sets one session cookie, “ats_session”, to keep you signed in, and a short-lived one during an authorised view-as session. They are not used for advertising. We set no analytics or advertising cookies of our own.

Google Analytics, only if you accept. The public home page at theworksats.com can load Google Analytics, a service run by Google. It loads only if you press Accept on the notice shown when you first visit. Until you choose, and if you press Decline or your browser sends Do Not Track, nothing is requested from Google and no Google cookie is set. If you accept, Google sets cookies in your browser (named _ga, and _ga_ followed by an identifier, lasting up to two years) and receives the pages you view, the page that sent you, your browser and device type, and your approximate location, which Google works out from your network address. Google processes this and may do so on servers outside the United Arab Emirates, including in the United States. By pressing Accept you agree to this transfer. Google keeps the record of each visit for 2 months, and the data tied to its cookie identifier for up to 14 months after your last visit, then deletes it. We use it only to see how the site is used. Advertising features, Google signals and ad personalisation are switched off. It does not run inside the signed-in system. Your choice is kept in your browser's local storage, not in a cookie, and you can change it at any time: change my choice on the home page. We rely on your consent for this, and you can withdraw it the same way.

8. Your rights

Under the PDPL you may ask us, free of charge, what we hold and why, who it is shared with and for how long (Art 13); for a machine-readable copy of what you gave us (Art 14); for correction and, in the cases the law lists, erasure (Art 15); for restriction (Art 16); to stop direct marketing (Art 17); and to object to a decision that results from automated processing (Art 18). If you are an agent on our register and want your entry corrected, hidden or erased, ask us the same way. Write to [email protected]. We answer without undue delay. You may complain to the UAE Data Office (the Bureau, in the PDPL). We may keep records the law requires us to keep or that we need for a legal claim (Art 15(3)).

9. How long we keep it

Candidate, prospect and client-contact records are kept for 24 months after the last activity on them, a period each account can set. A nightly job then anonymises them: names, contact details, notes and feedback are removed, and the dates and counts stay so that pipeline figures remain true. A candidate with a placement inside the period is kept until it ends. The 24 months is our own policy, not a figure the PDPL sets (Art 5(7) says only that data must not be kept once its purpose is over). Login records, usage logs, invitation logs and view-as logs have no automatic deletion period yet; we delete them by hand and will state a period here when we set one. Register data from public sources has no retention rule yet.

10. Security and breaches

Access is by individual account with a lock after repeated failed sign-ins; manager view-as sessions are read-only and logged. If a breach could harm your privacy or the confidentiality of your data, we will tell the UAE Data Office and you, as Art 9 requires.

11. Changes and law

We post any change here with a new date. This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and any dispute is subject to the exclusive jurisdiction of the courts of Dubai (the DIFC courts excluded). Contact: [email protected].