Your Privacy Matters

Nicso Technology LLC-Fz ("Nokhba", "we", "us", or "our"), registered at Meydan Free Zone, Dubai, United Arab Emirates, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you use the Nokhba platform (nokhba.ai) and related services. This Policy is governed by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and, where applicable, the DIFC Data Protection Law (DIFC Law No. 5 of 2020). By using our services, you acknowledge this Policy and consent to the practices described herein.

Nicso Technology LLC-Fz is the Data Controller for personal data processed through this platform. Registered Address: Meydan Free Zone, Dubai, UAE Data Protection Contact: [email protected] Phone: +971 (50) 328-9455 For data protection enquiries, please contact our Data Protection Officer at [email protected].

We collect the following categories of personal data: Identity & Contact Data • Full name, email address, phone number, and date of birth • Nationality, residency status, and visa category (relevant for GCC employment) • Professional social profiles (LinkedIn, GitHub, etc.) Professional Data • Resume / CV content — work history, education, qualifications, skills • Portfolio items, certifications, and professional references • Career preferences (job type, salary expectations, location) Usage Data • IP address, browser type, device identifiers, and operating system • Pages visited, features used, search queries, and time on platform • Session recordings (where consent is given) Payment Data • Billing name, address, and card last four digits (full card details are processed by Stripe — we do not store them) • Transaction history and subscription records AI-Generated Data • Resume analysis scores and recommendations • Interview performance assessments • Job match scores Sensitive Data We do not intentionally collect special categories of data (race, religion, health, biometric data). If you include such information in your resume, it will be processed only for the purpose of career matching and stored securely.

Under the UAE PDPL, we process your personal data on the following lawful bases: • Contractual necessity — processing required to deliver the services you have requested (creating an account, submitting a job application, making a payment) • Legitimate interests — improving platform functionality, security monitoring, fraud prevention, and internal analytics • Consent — marketing communications, optional personalisation, and cookies (you may withdraw consent at any time) • Legal obligation — processing required to comply with UAE law, regulatory requirements, or court orders

We use your personal data for the following purposes: Service Delivery • Creating and managing your account • AI-powered job matching and candidate screening • Resume analysis, scoring, and improvement recommendations • Mock interview generation and performance feedback • Consultation booking and calendar management • Processing payments and issuing invoices Communications • Sending transactional emails (account confirmations, interview reminders, application updates) • Delivering job alerts you have subscribed to • Responding to support requests Platform Improvement • Analysing usage patterns to improve AI accuracy and user experience • A/B testing new features (always anonymised) • Training AI models (using aggregated, anonymised data only — never individual user data without explicit consent) Legal & Compliance • Complying with UAE Labour Law and Emiratisation reporting obligations • Detecting and preventing fraud, abuse, and unauthorised access • Responding to lawful requests from UAE authorities

We do not sell your personal data. We share data only as follows: With Employers (Candidates Only) When you apply for a job, your resume, profile, and application details are shared with the relevant employer. You control which applications you submit. With Service Providers We use third-party processors who act on our instructions under data processing agreements: • Stripe (payment processing — United States, PCI DSS certified) • MongoDB Atlas (database hosting — with UAE/EU data residency options available) • Brevo (transactional email delivery — EU-based) • OpenAI / DeepSeek (AI processing — data is anonymised before transmission) • Redis Labs (session caching) Legal Disclosure We may disclose data to UAE public authorities, courts, or regulators when required by law or valid legal process. Business Transfers In the event of a merger, acquisition, or asset sale, data may be transferred to the successor entity, with notice provided to affected users.

Some of our service providers process data outside the UAE. Where we transfer personal data internationally, we ensure adequate protection through: • Adequacy decisions or equivalent legal frameworks recognised under UAE PDPL • Standard Contractual Clauses (SCCs) with data processors • Supplementary technical and organisational safeguards (encryption, pseudonymisation) Users who require UAE-only data residency (available for enterprise clients) may request this arrangement through our Data Protection Officer.

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by UAE law: • Active accounts: data retained for the lifetime of the account plus 7 years (UAE Commercial Transactions Law requirement) • Deleted accounts: data anonymised within 90 days, except where legal hold applies • Payment records: 5 years minimum (UAE VAT and financial record-keeping obligations) • Application data: retained for 2 years to allow candidates and employers to access historical records • AI analysis logs: retained for 18 months, then anonymised You may request early deletion of your data (see Section 9).

Under the UAE PDPL and, where applicable, DIFC Data Protection Law, you have the following rights: • Right of Access — request a copy of the personal data we hold about you • Right to Rectification — request correction of inaccurate or incomplete data • Right to Erasure — request deletion of your data (subject to legal retention obligations) • Right to Restriction — request that we restrict processing in certain circumstances • Right to Data Portability — receive your data in a structured, machine-readable format • Right to Object — object to processing based on legitimate interests or for direct marketing • Right to Withdraw Consent — withdraw consent for any processing based on consent (this does not affect past processing) • Right to Lodge a Complaint — file a complaint with the UAE Data Office (www.dataoffice.ae) To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing the request.

We implement technical and organisational measures to protect your data: • AES-256 encryption for data at rest • TLS 1.3 for data in transit • Multi-factor authentication for all staff accounts • Role-based access controls — staff access only the minimum data required • Regular penetration testing and security audits • API key encryption using AES-256-CBC • bcrypt password hashing (12 rounds) • Automated anomaly detection and alerting • Incident response plan aligned to UAE PDPL breach notification requirements (72-hour notification to UAE Data Office for serious breaches) No system is completely secure. If you believe your account has been compromised, contact us immediately at [email protected].

We use cookies and similar technologies. See our full Cookie Policy for details. Summary: • Strictly Necessary Cookies — required for the platform to function (cannot be disabled) • Analytics Cookies — help us understand usage patterns (consent required) • Marketing Cookies — personalise job recommendations and ads (consent required) • Preference Cookies — remember your settings and region (consent required) You can manage cookie preferences at any time via the cookie settings banner or by emailing [email protected].

Our platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us at [email protected] and we will promptly delete the account and associated data.

We may update this Privacy Policy periodically. Material changes will be communicated via email (to registered users) and a prominent notice on the platform at least 30 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the platform after the effective date constitutes acceptance of the updated Policy.

For any privacy-related questions, access requests, or complaints: Data Protection Officer Nicso Technology LLC-Fz Meydan Free Zone, Dubai, UAE Email: [email protected] Phone: +971 (50) 328-9455 UAE Data Office (Regulatory Supervisory Authority): Website: www.dataoffice.ae