Nas Talent is operated by SOURCET MANAGEMENT CONSULTING CO. L.L.C / سورسيت لاستشارات الإدارية ذ.م.م, Dubai trade licence 1480538, issued by the Department of Economy and Tourism, Dubai (DET). Contact: hello@nastalent.com, +971 4 514 2832, Office G06-191, Trade Centre 2, Dubai, United Arab Emirates, PO Box 51208.
We act as controller when determining the purposes and means of our own website enquiries, candidate relationships and business records. A client or employer may be a separate controller for its recruitment and employment decisions. We act as processor only for activities performed on a client's documented instructions under an applicable agreement. The actual activity determines the role; calling every recruitment activity “processing for the client” does not make it so.
Our Privacy Policy describes individuals' information and rights. This page does not create a processor agreement merely through a website visit or enquiry.
This is a public technology inventory, not blanket approval of all these providers as subprocessors for every client. A client processing schedule must specify which providers actually handle its data. Email, CRM, document storage or other operational providers must be included in that schedule when used; they must not be assumed absent because they are not website scripts.
Provider information: Vercel privacy notice, Web3Forms privacy policy and DPA, Google privacy policy, Amplitude privacy notice, and Meta privacy policy. These documents govern the relevant providers; they do not certify Sourcet's compliance.
Appropriate safeguards depend on the service and risks. Matters to address include secure transmission, authorised access, staff confidentiality, access removal, record handling, vendor assessment, incident response and deletion. A specific certification, penetration test, encryption configuration, backup cycle or residency commitment applies only if verified and expressly stated in the relevant service documentation. No absolute security guarantee is given.
Our providers may use infrastructure or personnel outside the UAE. We do not promise exclusive UAE residency or that changing the website's DNS provider removes all indirect use of that provider by suppliers. International processing requires assessment under the applicable transfer rules. Server event retention, application records, emailed enquiries, backups and browser cookie lifetimes are distinct. Web3Forms currently publishes a maximum form-submission retention of three years, subject to shorter plan settings or earlier deletion; this is a provider statement, not a three-year retention rule for every Sourcet record.
Send privacy, deletion, security or service-specific processing questions to hello@nastalent.com, marked “Privacy / Security — Nas Talent”. Please describe the issue without attaching unnecessary sensitive material. We verify authority proportionately, identify the responsible controller and coordinate assistance and incident notices required by law or an applicable agreement. See the Privacy Policy for individual rights and complaints.
This addendum becomes effective only when Sourcet and the client identified in Schedule 1 incorporate it into a written service agreement and complete its schedules. It applies solely to personal data Sourcet processes for that client as processor (“Client Personal Data”). Independent-controller activities remain outside its scope and require an appropriate lawful basis and notices.
Applicable mandatory law takes precedence. This addendum controls a conflict concerning its processor obligations, subject to mandatory transfer terms and any expressly agreed valid hierarchy. It does not establish fees, employment responsibilities or regulated service authorisations.
Sourcet shall process Client Personal Data only for the agreed services and documented lawful instructions, unless law requires otherwise. Where legally permitted, it shall inform the client of that requirement before processing. It shall promptly flag an instruction it reasonably believes infringes applicable data protection law and suspend the affected activity while the issue is resolved where appropriate.
The client is responsible for its lawful collection and disclosure, notices, legal basis, accuracy, authorised instructions and minimisation. It shall not instruct undisclosed sensitive processing or provide more data than needed. Neither party may use this clause to avoid its own statutory responsibilities.
Sourcet shall restrict access to authorised persons bound by confidentiality and apply the agreed technical and organisational measures in Schedule 2, proportionate to the processing and risk. It shall maintain those measures, review them when risk changes and not materially reduce the agreed protection during the service without an appropriate lawful arrangement. Any promise of a particular control must be supported by the completed schedule.
Only the subprocessors authorised through Schedule 1 or the agreed approval mechanism may handle Client Personal Data. Sourcet shall impose written obligations providing protection appropriate to the delegated processing and remain responsible to the client for performance of its applicable subprocessor obligations.
For general written authorisation, Sourcet shall give advance notice of an intended addition or replacement, with sufficient information and reasonable time for a data protection objection before the change. The parties shall seek a suitable alternative; if none is available, the affected processing must not continue without lawful resolution, which may include ending the affected service under the main agreement. A marketing analytics provider is not automatically an authorised subprocessor for candidate data.
Sourcet shall not transfer Client Personal Data to an unauthorised country or permit unapproved remote access. Schedule 1 shall identify destinations, onward access and the applicable lawful mechanism. Any additional mandatory transfer instrument shall be executed before the relevant transfer. The parties shall assess the actual protection and assist with required transfer assessments; citing a provider's global policy alone does not satisfy this clause.
Sourcet shall notify the client without undue delay of a request relating to Client Personal Data and provide reasonable assistance to enable a lawful response. It shall not respond substantively on the client's behalf without instructions unless required by law. The client remains responsible for deadlines and decisions applicable to it; requests concerning Sourcet's independent-controller activities are handled separately.
Sourcet shall notify the client without undue delay after becoming aware of a personal data breach affecting Client Personal Data. Available information shall include the nature of the breach, affected data and individuals, likely consequences, containment and remediation, and a contact for follow-up. It shall provide further information as it becomes available, preserve relevant evidence and cooperate with the client's legally required response. An initial notice need not await a complete investigation. Any shorter agreed notification period shall be specified in Schedule 2. Notification is not itself an admission of liability.
Taking account of the processing and information available, Sourcet shall provide reasonable assistance with legally required impact assessments, authority consultations and security obligations. It shall notify the client of a compulsory disclosure of Client Personal Data where legally permitted, disclose only what is lawfully required and document the response appropriately.
Processing shall last for the period in Schedule 1. On completion or termination, Sourcet shall, at the client's lawful choice, return or delete Client Personal Data and direct relevant subprocessors accordingly, except for data legally required to be retained. Retained data shall be limited, protected and used only for the permitted retention purpose. The schedule must address backup deletion cycles and provider limitations. Confirmation of completion shall be provided on request; immediate erasure from every backup must not be promised unless technically supported.
Sourcet shall make available information reasonably necessary to demonstrate these obligations and permit proportionate audits by the client or an appropriately bound independent auditor. Audits shall protect other clients' information, security and confidentiality. Documentation or independent assurance may be considered first where sufficient; it must not eliminate an audit right required by law. Notice, access arrangements and costs may be agreed without frustrating a mandatory right or an urgent incident response.
The parties shall cooperate on amendments needed for applicable law or material service changes. Processor provisions must not be altered merely by editing a public webpage. Liability and remedies follow the valid main agreement and mandatory law; this template does not introduce an unapproved liability cap. Relevant confidentiality, restricted retention, deletion and assistance obligations continue as necessary after termination.
Document verified measures for access control and authentication; confidentiality and training; transmission and storage protection; data segregation and minimisation; patching and vulnerability handling; logs and monitoring; secure sharing; backup and recovery; deletion; incident contacts and timing; provider oversight; and review of automated tools where relevant. Mark a measure not applicable only with a reason. Identify any agreed certification by its actual holder and scope. Complete any request-assistance, audit and incident arrangements, including a specific notification period if agreed. An empty schedule is not evidence that these controls exist.