Privacy Policy for Job Seekers

1. Who we are

• BidLX is a restaurant management platform owned and operated by BIDLX SOLUTIONS SDN. BHD., a private limited company registered in Malaysia ("BidLX", "we", "us").
• We are the data controller (Data User under the Malaysian PDPA / Controller under the Saudi PDPL) for the data described in this policy.
• Data Protection Officer: reachable at support@bidlx.com with the subject "Data Protection".

2. Data you provide

• Account data: email and password (hashed).
• Professional profile: name, photo, country, city, country of residence, nationality, marital status, languages, education level and field, experience, skills, desired roles, expected salary, employment type, work permit status, availability date, phone, WhatsApp, email, and your CV if uploaded.
• Applications: the jobs you applied to and the status of each.
• Email, password and name are mandatory to create an account; other data is optional but leaving it out may reduce your chances. Please do not include unnecessary sensitive data (such as health or religious details) in your CV.

3. Purposes and legal basis

• Creating your account and managing your profile and applications — performing the service you requested.
• Sharing your profile with the restaurant you apply to — your explicit consent, given by pressing apply for each job.
• Protecting the platform from fake accounts and abuse — legitimate interest.

4. Who sees your profile

• Your profile is not public and does not appear in search engines. Only the restaurant whose job you apply to can see it, after you apply.
• Once you apply, the restaurant becomes an independent controller for its use of your data for recruitment, subject to the laws in its country.
• The BidLX team accesses data only when needed for support, preventing abuse or legal compliance.

5. Retention and withdrawing applications

We keep your profile while your account exists. You can withdraw any application from your profile, edit your profile at any time, and request account deletion, which we complete within 30 days. Deletion does not cover what a restaurant already received before you withdrew; you can ask it directly or through us to delete it.

6. Your rights

• Right to be informed: to know what we collect about you and why, as set out in this policy.
• Right of access and to obtain a copy of your data.
• Right to correct or update inaccurate or incomplete data.
• Right to request deletion or destruction of your data once it is no longer needed, unless the law requires us to keep it.
• Right to data portability: to receive your data in a structured, commonly used format, or have it transmitted to another party where technically feasible.
• Right to withdraw consent at any time where processing is based on consent, without affecting prior processing.
• Right to object to or restrict processing, and to prevent processing for direct marketing.
• We respond within the statutory periods: 21 days under Malaysian law and 30 days under Saudi law, and may verify your identity first. Requests are free; we may decline repetitive or manifestly unreasonable requests where the law allows.

7. Complaints to the regulator

Please contact us first at support@bidlx.com so we can resolve any concern. You may in any case lodge a complaint with the competent regulator: the Personal Data Protection Commissioner of Malaysia (JPDP), the Saudi Data & AI Authority (SDAIA) if you are in Saudi Arabia, or the competent authority in your country.

8. International transfers

• We host the service with technical providers whose servers may be located outside Malaysia, Saudi Arabia or your country. We transfer data only to parties offering an adequate level of protection, under binding contractual safeguards, and only as necessary to provide the service, in compliance with the transfer requirements of Malaysian law, the Saudi PDPL and its regulation on transferring data outside the Kingdom.
• Our main providers are currently Supabase Inc. (database, authentication and file storage), Vercel Inc. (website hosting) and Stripe (payment processing for restaurant subscriptions). We update this list when it changes.

9. Security and breach notification

• We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including encryption in transit, irreversible password hashing, isolating each restaurant's data through database security rules, limiting each user to their permissions, and restricting our staff's access to what each task requires.
• No system is absolutely secure. If a breach likely to cause harm occurs, we notify the competent regulator within 72 hours of becoming aware of it and notify affected individuals without undue delay where the law requires, explaining what happened, the measures taken and what they can do to protect themselves.

10. Children

BidLX account services (restaurants, staff and jobs) are intended for people aged 18 or over. We do not knowingly collect personal data from anyone younger, and will delete it if we become aware of it.

11. No sale of data, no automated decisions

We do not sell, rent or share personal data with advertisers, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

12. Changes to this document

We may update this document as our services evolve or laws change, and show the last-updated date at the top of the page. For material changes we notify account holders by email or in the system a reasonable time before they take effect, and ask for fresh consent where the law requires.

13. Language

This document is available in Arabic and English. In case of any difference in interpretation the English version prevails, unless a mandatory law requires otherwise.

14. Contact us

BIDLX SOLUTIONS SDN. BHD. — Email: support@bidlx.com, for any question or request about your data or this document.