Soby Enterprises
Recruitment, website, social-media and business communications
We use personal information to respond to enquiries, assess and match candidates, support lawful recruitment and deployment, and operate our services. Candidate information may be shared with the employer for the role and may be transferred outside Pakistan. We collect sensitive identity, medical or immigration documents only when necessary at a later recruitment stage. We do not sell personal data. Final recruitment decisions always involve human review.
1. About this notice
This Privacy Notice explains how Soby Enterprises ("Soby", "we", "us" or "our") collects, uses, discloses, transfers, retains and protects personal information. It applies to candidates, job seekers, placed workers, referees, employer and client representatives, suppliers, website visitors, social-media users and other people who communicate with us.
It covers our main website, jobs portal, application and contact forms, offices, telephone, email, WhatsApp, Facebook, Instagram, LinkedIn and other recruitment or business channels, including Meta Instant Forms where used.
Soby is the controller for the processing described in this notice where we decide why and how personal information is used. An employer client may be a separate controller when it independently decides how to assess, hire or manage a candidate. That employer's own privacy notice and local law may also apply.
This notice is designed around recognised privacy principles and applicable legal requirements. It does not claim that every privacy law applies to every interaction. Where EU or UK data-protection law, the Saudi Personal Data Protection Law or another jurisdiction's law applies to particular processing, the additional rights and safeguards required by that law will apply.
2. Who we are and how to contact us
| Item | Details |
|---|---|
| Organisation | Soby Enterprises |
| Licence | Overseas Employment Promoter (OEP) Licence No. 3046/SKT |
| Office | Soby Tower, Near Grid Station, Circular Road, Daska, Pakistan 51010 |
| Website | https://sobyenterprises.com |
| Privacy and complaints | info@sobyenterprises.com |
| Job applications | jobs@sobyenterprises.com |
| Telephone | +92 52 6613950 |
| Mobile helpline | +92 304 1115075 |
| WhatsApp only | +92 3 111 444 314 |
Please use the privacy address for access, correction, deletion, objection, consent-withdrawal or complaint requests. Do not send passports, national identity cards, bank details or medical records to the privacy mailbox unless we specifically request them through an authorised process.
3. Personal information we collect
3.1 Candidates, job seekers and placed workers
We may collect identification and contact details; CV and employment history; education, licences, certifications and trade skills; preferred roles and locations; salary or availability information; application answers; interview, trade-test and assessment results; references; communications; and records of consent, notices and recruitment decisions.
At later stages, when necessary for a genuine role or legal process, we may collect passport, national identity, photograph, visa, immigration, travel, police-clearance, medical-fitness, vaccination, next-of-kin, bank or payroll details. We do not request these documents through public social-media comments or a first-stage Meta lead form.
3.2 Employer, client, supplier and business contacts
We may collect names, job titles, work contact details, company information, recruitment demands, contracts, correspondence, meeting notes, due-diligence records, billing and transaction information, and service feedback.
3.3 Website, portal and communications data
We may collect IP address, device and browser information, approximate location derived from IP, pages viewed, referral source, timestamps, cookie or analytics identifiers, form submissions, login and security logs, and records of email, telephone, WhatsApp or social-media interactions.
3.4 Sensitive and special-category information
Health, biometric, religious, criminal-record, disability or other legally protected information is collected only where relevant and necessary for lawful recruitment, workplace accommodation, visa, medical, security or regulatory requirements. We use an additional lawful condition or explicit consent where required and restrict access to authorised personnel.
3.5 Required and optional information
Fields marked as required are necessary to respond to an enquiry, assess an application or complete a legal or recruitment step. If required information is not provided, we may be unable to process the request or continue the application. Optional information may be omitted without affecting the initial enquiry or application, unless it later becomes necessary for a disclosed purpose.
4. How we obtain information
We receive information directly from you; from referees and previous employers with appropriate authority; from employer clients; from licensed recruitment partners, trade-test centres, medical providers, travel or visa service providers; from government and regulatory bodies; from social-media and advertising platforms; from publicly available professional sources; and from website, portal, email, telephone and security systems.
If you provide information about another person, such as a referee or next of kin, you should tell them that you have shared their information and direct them to this notice where appropriate.
5. Why we use information and our lawful grounds
We process personal information only for specified purposes and on a lawful ground available under the law that applies to the activity. The grounds below are stated in internationally recognised terms; their precise legal label may vary by jurisdiction.
| Purpose | What we do | Typical lawful ground |
|---|---|---|
| Enquiries and service requests | Respond to candidates, employers and other contacts; provide requested information; maintain service records. | Steps taken at your request; contract; legitimate interests; consent where required. |
| Applications and candidate profiles | Create and manage applications; assess qualifications, experience and availability; communicate about a role. | Steps taken at your request; legitimate interests in recruitment; consent where required. |
| Matching and shortlisting | Compare verified role requirements with candidate skills; prepare and review shortlists. | Steps taken at your request; legitimate interests; consent where required. |
| Employer disclosure | Submit a candidate for the identified role and allow the employer to interview or assess suitability. | Steps taken at your request; legitimate interests; consent or another lawful disclosure ground where required. |
| Checks and assessments | References, licence or certificate verification, trade tests, interviews, background or medical steps appropriate to the role. | Legal obligation; consent; contract or pre-contract steps; legitimate interests, with an additional condition for sensitive data. |
| Placement and deployment | Employment offer support, visa, immigration, Protector of Emigrants, travel, onboarding and post-placement administration. | Contract or pre-contract steps; legal and regulatory obligations; consent where required. |
| Future suitable roles | Maintain an optional talent-pool profile and contact you about materially relevant vacancies. | Consent, or legitimate interests where permitted. You may opt out at any time. |
| Operations and security | Run, secure and improve our website, portal, communications and records; detect abuse, fraud and cyber incidents. | Legitimate interests; legal obligations; consent for non-essential technologies where required. |
| Compliance and disputes | Regulatory reporting, audits, complaints, legal advice, claims, recordkeeping and cooperation with authorities. | Legal obligations; public-interest requirements where applicable; legitimate interests in protecting legal rights. |
Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and do not proceed where those interests are overridden by applicable rights and freedoms. You may request further information about a relevant assessment.
6. Recruitment stages and data minimisation
At the expression-of-interest stage, we normally request only the minimum information needed to identify and contact you and to screen role-related experience or qualifications. Meta Instant Forms, when used, are limited to non-sensitive contact and trade-screening questions.
CVs and supporting certificates may be requested after initial interest. Passport, national identity, medical, police, immigration, banking and similar sensitive records are requested only when a candidate reaches the appropriate verified stage and the information is necessary for the stated employer, visa, deployment or legal process.
Never place identity documents, medical information or bank details in a public comment or unsolicited social-media message. Use only the official channel specified by Soby. If you are uncertain, verify the request through the contact details in section 2.
7. Candidate matching, profiling and human decisions
We may use search, filtering, keyword matching or ranking tools to help recruitment staff find potentially suitable candidates. These tools support, but do not replace, professional judgement. A person reviews relevant information before a candidate is shortlisted, submitted or rejected for a role.
We do not make final recruitment or placement decisions based solely on automated processing that produces legal or similarly significant effects. Where applicable law provides a right to information, challenge or human review, you may contact us using section 2.
Submitting an application, completing a form, joining the talent pool or sharing documents does not guarantee an interview, selection, visa, employment or deployment. Recruitment outcomes depend on verified requirements, lawful processes and decisions by the relevant employer and authorities.
8. When and with whom we share information
We do not sell or rent personal information. We disclose only what is reasonably necessary for the stated purpose and may share it with:
| Recipient category | Reason and limits |
|---|---|
| Employer clients | The employer and its authorised representatives for the particular vacancy, interview, selection and onboarding. We identify the employer and destination country before material candidate disclosure where reasonably possible. |
| Recruitment and deployment providers | Licensed partners, trade-test centres, referees, qualification-verification services, medical providers, insurers, travel agents, airlines, visa or immigration service providers and accommodation or onboarding providers, as appropriate to the stage. |
| Government and regulatory bodies | Bureau of Emigration and Overseas Employment, Protector of Emigrants, embassies, consulates, immigration, labour, police, tax, courts and other competent authorities where required or authorised. |
| Technology and professional providers | Website and portal hosting, cloud storage, email, communications, CRM or applicant systems, security, analytics, Meta and other social platforms, legal advisers, auditors and insurers, under appropriate access and confidentiality controls. |
| Business changes | A genuine prospective buyer, successor or adviser in a merger, restructuring or transfer, subject to confidentiality and applicable law. |
A service provider processing information only on our instructions is required to use it for the contracted purpose and protect it appropriately. An employer or other organisation that independently determines its own purposes may be a separate controller and responsible for its own notice, rights process and security.
9. International transfers
International recruitment necessarily involves sending or making candidate information accessible outside Pakistan, including to employer clients and authorised providers in destination countries such as Saudi Arabia, the United Arab Emirates, Qatar, Oman, Bahrain and other countries relevant to a verified vacancy. Website, cloud, email, analytics or social-platform providers may also process information in other countries.
Privacy protections and government-access rules differ by country. Depending on the transfer and applicable law, we use measures such as data minimisation, role-based access, secure transmission, confidentiality and data-sharing terms, processor agreements, contractual safeguards, transfer assessments, consent, or transfers necessary for a requested recruitment or employment process.
Where EU or UK transfer rules apply, the appropriate transfer mechanism and supplementary safeguards will be assessed for the relevant flow. Where Saudi law applies to a transfer out of Saudi Arabia, the Saudi employer or other Saudi controller is responsible for meeting the Saudi transfer requirements, with our contractual cooperation where relevant.
10. Retention and deletion
We keep identifiable information only for as long as reasonably necessary for the disclosed purpose, applicable legal or regulatory duties, complaints or claims, and secure operational continuity. We then delete, anonymise or securely restrict it. The working schedule below is subject to a longer or shorter mandatory period under applicable law.
| Record | Normal period | Reason |
|---|---|---|
| General enquiries and employer leads | Normally 24 months after the enquiry is closed or the last meaningful contact. | Service follow-up, audit trail and dispute handling. |
| Unsuccessful or incomplete applications | Normally 24 months after campaign closure or the last meaningful candidate contact. | Recruitment administration, complaints and relevant future matching where permitted. |
| Optional talent-pool profile | Normally 24 months after the latest confirmation or meaningful contact; renewed, deleted or anonymised after review. | Future suitable vacancies. Opt-out is available at any time. |
| Successful placement and deployment file | Normally up to 7 years after the placement or case is closed, or another period required by emigration, immigration, employment, tax, audit or regulator rules. | Regulatory records, worker support, audits and legal claims. |
| Identity, medical, police and immigration documents | Only for the recruitment, deployment and mandatory record period; removed or access-restricted as soon as the specific purpose and legal need end. | High-risk records are subject to tighter access and minimisation. |
| Job alerts and other optional messages | Until consent is withdrawn, you opt out, or the list is reviewed for inactivity. A minimal suppression record may be retained to honour an opt-out. | Communication preferences. |
| Website analytics and security logs | Analytics event data is normally retained for the period configured with the provider, commonly up to 14 months; security logs are retained according to operational risk and legal need. | Usage measurement, resilience and incident investigation. |
| Privacy requests and complaints | Normally 3 years after closure, or longer where needed for a legal or regulatory matter. | Demonstrating and improving complaint handling. |
Backups may retain residual copies until they are overwritten under the backup cycle. During that period they are protected and are not used for ordinary business purposes.
11. Security
We use proportionate administrative, physical and technical measures designed to protect personal information, including authorised-access controls, staff confidentiality, account and device protections, secure transmission where supported, backups, malware and firewall controls, service-provider review, incident handling and periodic access review.
No internet transmission or storage system is completely secure. If an incident creates a risk requiring notification under applicable law, we will take containment and notification steps appropriate to the circumstances.
12. Your privacy rights
Depending on the law that applies, you may have the right to request confirmation and access; obtain a copy; correct or complete information; delete information; restrict or object to processing; receive portable information; withdraw consent; opt out of direct messages; and obtain human review or information about relevant automated processing.
Rights are not absolute. For example, we may retain information required by law, needed to protect another person's rights or necessary for a legal claim. Withdrawing consent does not affect processing that was lawful before withdrawal.
To make a request, email info@sobyenterprises.com with your name, contact details, the relevant interaction or application, and the right you wish to exercise. We may request proportionate identity verification and clarification. We will acknowledge and respond within the period required by applicable law; our operational target is to acknowledge a privacy complaint within 30 days and investigate it without undue delay.
13. Complaints
Please first contact our Privacy and Complaints Contact at info@sobyenterprises.com so we can investigate. We will provide an outcome or progress update as appropriate. If a data-protection authority has jurisdiction over the particular processing, you may also complain to that authority. For example, individuals covered by EU or UK data-protection law may contact the competent EU supervisory authority or the UK Information Commissioner's Office, and individuals covered by Saudi law may use the channels of the Saudi Data & AI Authority.
Because Pakistan's comprehensive Personal Data Protection Bill remains draft at the date of this notice, this notice does not describe a Pakistani data-protection authority as though it already existed. Complaints may still be made to other competent courts, regulators or public bodies where applicable.
14. Job alerts, talent-pool consent and direct messages
Messages needed to manage a current enquiry, application, interview or placement are service communications. Separate consent may be requested for optional job alerts or inclusion in a future-opportunity talent pool where required. Declining optional messages does not affect a current application.
You may opt out through the method provided in the message, by replying with a clear stop request, by blocking the relevant WhatsApp or social account, or by emailing info@sobyenterprises.com. We may still send essential communications about an active application or legal process.
15. Cookies, Google Analytics and social platforms
Our website uses essential technologies needed for website delivery, forms, security and administration. It also currently uses Google Analytics 4 to understand visits and improve the website. Google Analytics may receive device, browser, approximate location, page, referral and interaction information and may process it outside Pakistan under Google's own terms and privacy practices.
You can control or delete cookies through your browser and may use Google's available analytics opt-out controls. The site does not currently provide a complete sitewide cookie-preference tool. We are reviewing consent management so that non-essential analytics can be controlled where required. Until that work is completed, the presence of this notice should not be treated as consent to non-essential cookies in a jurisdiction that requires prior consent.
When you use Facebook, Instagram, WhatsApp, LinkedIn or another platform, that platform separately processes information under its own privacy terms. If you submit a Meta Instant Form, Meta processes the form interaction and provides the disclosed answers to us; we use them only for the stated recruitment purpose unless you make a separate optional choice.
16. Third-party websites and the jobs portal
Our website may link to jobs.sobyenterprises.com, employer sites, government services, maps, social networks and other third-party services. Their privacy practices may differ. Review the notice shown by the relevant service. This notice covers Soby's use of information received from those services, but not an independent third party's own processing.
17. Children
Our recruitment services are not directed to children under 18. Do not submit an application or identity documents for a child through our forms or social channels. If we learn that we collected a child's information without a valid lawful basis or necessary guardian involvement, we will delete or restrict it as appropriate.
18. Changes to this notice
We may update this notice when our services, systems, recruitment processes or legal obligations change. The current version and effective date will be published on our website. For a material change, we may provide an additional notice through the website or the communication channel reasonably available to us.
19. Document status and review
This operational notice reflects the information available on the effective date and is intended for public transparency. Soby will review it periodically and when introducing material new data uses, including a candidate-matching portal, new advertising or analytics technologies, or new international processing arrangements.
A privacy notice is only one part of compliance. It must be supported by accurate forms and just-in-time notices, candidate consent records, retention and deletion routines, security controls, incident procedures, vendor and employer agreements, and jurisdiction-specific legal review.
Version 2.0 · Effective 11 August 2026 · Privacy contact: info@sobyenterprises.com