Privacy Policy

RamalResume.com / Ramal Digital Services, operated under Dubai DED eTrader License Number [Insert License Number] ("we," "our," or "us"), is committed to protecting your personal data globally. This Privacy Policy explains how we collect, process, share, and safeguard your personal information when you use our website, services, and resume creation tools.

This policy is designed to comply with:

• UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL)
• EU General Data Protection Regulation (GDPR) & UK GDPR
• US State Data Privacy Laws (including the California Consumer Privacy Act / California Privacy Rights Act — CCPA/CPRA)

1. Information We Collect

We collect information directly from you when you use our service, automatically through your interaction with our website, and via third-party service providers.

• Account Information: Full name, email address, password, account preferences, and subscription status.
• Resume & Career Content: Contact details (address, phone number, LinkedIn URL), employment history, education, skills, professional summaries, cover letter text, and any personal photos you upload to your resume layout.
• Financial & Payment Data: Payment status, transaction history, billing country, and currency. Note: We do not store or process complete payment card details on our servers; payments are processed securely by Stripe.
• Technical & Usage Data: IP address, device type, browser model, operating system, language preferences, page interactions, referring URLs, and telemetry via cookies or similar tracking technologies.
• Security & Activity Logs: Timestamps and IP addresses associated with account creation, payment or export-pass activation, resume generation, and PDF/Word downloads. These records are maintained strictly to prevent fraud, protect system integrity, and resolve chargebacks or billing disputes.

2. Legal Bases and How We Use Your Data

We process your personal data under the following legal grounds:

• Contractual Necessity: To provide, manage, format, and deliver your electronic CV, resume templates, cover letters, and export passes as requested when you create an account or purchase a subscription.
• Legitimate Interests: To secure our platform, log security events, verify fraud or unauthorized payment usage, enforce our Terms of Service, defend against legal or chargeback claims, and optimize user experience.
• Legal Compliance: To comply with UAE laws, tax accounting standards, and international statutory obligations.
• Consent: Where required by law (such as non-essential performance/analytics cookies or opt-in marketing), based on your explicit, informed consent, which you may withdraw at any time.

We do not sell, rent, or trade your resume content or personal details to third parties or marketing brokers.

3. Data Storage, Hosting, and Security

• Cloud Infrastructure: We do not store user data on local physical hard drives. All platform data, database entries, and generated files are stored securely using Amazon Web Services (AWS).
• Global Hosting & CloudFront CDN: Primary database records are hosted on secure AWS cloud servers. To ensure fast performance worldwide, static assets and web pages are delivered internationally via AWS CloudFront Content Delivery Network (CDN) edge locations.
• Encryption Standards: We enforce strict security protocols, including SSL/TLS encryption for all data in transit across the internet and AES-256 encryption for data stored at rest within AWS storage buckets and databases.

4. Security Activity Logs and Retention

To protect our platform and legitimate users from payment fraud, unauthorized scraping, and unwarranted chargeback disputes, we record security activity logs.

• Logged Data: Event types, UTC timestamps, IP addresses, user-agent strings, account emails, and document download/export IDs.
• Retention Period: These security logs are stored separately from your main resume records and retained for up to twenty-four (24) months, or longer if strictly necessary to resolve active legal claims, open financial disputes, or fraud investigations. Afterward, logs are permanently deleted or anonymized.

5. Third-Party Data Processors

We share necessary data only with trusted third-party service providers (Data Processors) acting on our behalf to operate the platform:

• Cloud Infrastructure: Amazon Web Services (AWS) for computing, database hosting, file storage, and global content delivery.
• Payment Processing: Stripe, LLC for processing credit card transactions, subscriptions, and single export-pass purchases. Your credit card information is submitted directly to Stripe, which adheres to Level 1 PCI-DSS compliance standards.
• Analytics & Performance (Optional): Web analytics providers (such as Google Analytics) if enabled via explicit cookie consent.

6. International Data Transfers

Because we operate globally, your personal data may be accessed, stored, or transferred to servers outside your country of residence (including the UAE, the United States, and AWS global data centers).

When transferring personal data internationally from the European Economic Area (EEA), the UK, or other regulated regions, we rely on legally recognized transfer mechanisms, including Standard Contractual Clauses (SCCs) approved by the European Commission, or third-party adequacy frameworks adopted by our processors (AWS and Stripe).

7. Regional Specific Privacy Rights

A. UAE Residents (UAE PDPL)

Under Federal Decree-Law No. 45 of 2021, you have the right to request access to your personal data, request correction of inaccurate data, request data erasure, and object to processing in specific legal circumstances.

B. EU & UK Residents (GDPR / UK GDPR)

If you reside in the European Economic Area (EEA) or the United Kingdom, you hold specific statutory rights under GDPR:

• Right to Access & Data Portability: You can request a copy of your personal data in a structured, commonly used, machine-readable format (PDF/JSON).
• Right to Erasure ("Right to Be Forgotten"): You can delete your account or demand deletion of your data at any time. (Excludes residual security logs retained under legitimate interest for fraud prevention as noted in Section 4.)
• Right to Restrict or Object to Processing: You can object to data processing based on legitimate interests or request restricted handling.
• Right to Withdraw Consent: Where processing relies on consent (e.g., non-essential cookies), you may withdraw consent at any time without affecting past lawful processing.
• Supervisory Authority: You have the right to lodge a complaint with your local EU or UK Data Protection Authority.

C. United States Residents (CCPA / CPRA & US State Laws)

If you reside in California or other US states with active privacy legislation:

• Right to Know and Access: You may request details about the categories and specific pieces of personal information we have collected about you over the past 12 months.
• Right to Opt-Out ("Do Not Sell or Share My Personal Information"): We do not sell your personal information for monetary value. We also do not share your personal information for cross-context behavioral advertising.
• Right to Correct and Delete: You have the right to request the correction of inaccurate data or complete deletion of your personal information.
• Non-Discrimination: We will never discriminate against you (such as denying service or charging different prices) for exercising your statutory privacy rights.

8. Cookies and Tracking Technologies

• Essential Cookies: Necessary for account authentication, security, shopping cart functions, and core platform operations. These cannot be disabled.
• Optional Analytics & Tracking Cookies: Used to evaluate website traffic and user interaction. On your first visit from relevant regions (such as the EU/UK), a cookie banner will prompt you to explicitly Accept or Reject non-essential cookies before they are set.

You can manage or clear your cookie choices at any time through your web browser settings or by clicking the Cookie Preferences link in our website footer. See also our Cookie Policy.

9. Data Retention and Account Deleting

We retain your resume content and account profile for as long as your account remains active or as needed to provide our services. You can delete individual resumes or completely delete your account at any time via your account dashboard. Deleting your account immediately removes your active resumes and personal profile from our AWS database.

10. Contact Us & Exercising Your Rights

To exercise any of your data protection rights, request data deletion, or ask questions regarding this Privacy Policy, please contact our Data Protection Representative:

• Entity: Ramal Digital Services (RamalResume.com)
• DED License: Dubai DED eTrader License Number [Insert License Number]
• Email: support@ramalresume.com
• Response Time: We aim to respond to and fulfill all legitimate privacy requests within 30 days (or within timelines specified by applicable local law).