Tamara - Candidate Privacy Notice

Last updated: December 12, 2025

Who is responsible for your Personal Data

Tamara FZE, having its registered office at The Offices 4 – One Central, Dubai World Trade Centre, Dubai, United Arab Emirates is the data controller responsible for your Personal Data (referred to in this Notice as "Tamara" or the pronouns “we”, “our” or "us").

We process your Personal Data in accordance with:

  • UAE Personal Data Protection Law (PDPL) – Federal Decree Law No. 45 of 2021 and its Executive Regulations.
  • Central Bank of the UAE Consumer Protection Regulations & Standards (CPS), including Section 6: Data Protection & Privacy, where applicable to Tamara’s regulated financial activities.

You can contact Tamara at privacy@tamara.co

We have an appointed Data Protection Officer (DPO), who is responsible for following up on inquiries related to this privacy notice and ensuring compliance with the UAE PDPL. The DPO also serves as the primary contact point for data subjects and the competent supervisory authority regarding data protection matters.

Categories of Personal Data

For each category of Candidate Data and Sensitive Candidate Data listed below, Tamara processes this data only for specific, legitimate purposes as described in this Notice. Our processing is underpinned by a clear legal basis as required by the UAE Personal Data Protection Law (PDPL) and Central Bank of the UAE Consumer Protection Regulations & Standards (CPS), including Section 6: Data Protection & Privacy.

We process the following Candidate Data about you:

  • Identification & Contact Data: your name, title, home address, phone number, personal email address, nationality, date of birth, and similar data provided in your application.
  • Application & Assessment Data: CV/resumé, cover letters, application form responses, interview notes, results of assessments or tests.
  • Background & Reference Data (where lawful and relevant to the role): referees’ contact details, reference responses, education and employment verification, criminal-record checks for regulated roles.
  • Communication Data: correspondence with Tamara during the recruitment process (emails, scheduling, recruitment portal logs limited to the process).

We may also process the following Sensitive Candidate Data, but only where permitted or required by law:

  • Health or disability information to enable reasonable adjustments during recruitment.
  • Biometric identification data if used for identity verification or access to Tamara systems.
  • Criminal conviction data for regulated roles, only where permitted or required under UAE law.
  • Religious data only where required for UAE labour law compliance,including (but not limited to)leave/accommodations.

Methods of Collecting and Sources of Personal Data

The source from which your Personal Data originates is typically from you as the candidate, and from third parties lawfully engaged in the recruitment process.

We may collect your Personal Data in the ways listed below:

  • Directly from you, such as through application forms, CV/resumé submissions, interviews, and assessments.
  • Generated during the recruitment process, such as assessment results or interview notes created by Tamara.
  • From third parties, such as referees, background-check providers, or public authorities, but only to the extent permitted by applicable law and relevant to the role you applied for.

Tamara complies with the UAE PDPL and CBUAE CPS requirement to collect only what is necessary and never excessive for the recruitment purpose.

Processing Purposes and Legal Bases

We process your Personal Data to the extent permitted or required under applicable law for the following purposes:

  • Recruitment and Selection Purposes: Evaluating your skills, experience, and suitability for the role; scheduling and conducting interviews or assessments; communicating with you about the recruitment process.

Legal basis: pre-contractual steps necessary to enter into an employment contract; Tamara’s legitimate interests in staffing and recruitment.

  • Background and Reference Check Purposes: Where lawful and relevant to the role, conducting background checks and contacting referees to verify your information.

Legal basis: legal obligation for certain regulated roles; Tamara’s legitimate interests; where required by UAE PDPL, explicit consent for specific sensitive data.

  • Regulatory and Compliance Purposes: Responding to lawful requests from regulators or authorities and complying with applicable laws and regulations.

Legal basis: legal obligation under UAE law or requests from UAE authorities.

  • Future Opportunities (Talent Pool) Purposes: If you consent, retaining your application data to consider you for other positions at Tamara. 

Legal basis:explicit consent as required under UAE PDPL.

Sensitive Candidate Data – Purposes and Legal Basis

We may process certain types of sensitive personal data, but only where permitted or required under the UAE Personal Data Protection Law (PDPL) and relevant regulations.

The following categories may be processed in the recruitment context:

  • Health or Disability Information: to provide reasonable adjustments during assessments, interviews, or other stages of the recruitment process.
  • Biometric Identification Data: if used for identity verification or access to Tamara’s recruitment systems.
  • Criminal Conviction Data: for roles where required by applicable laws or regulatory obligations.
  • Religious Data: only where legally necessary to meet statutory obligations.

Legal basis:

  • Compliance with legal obligations, including—but not limited to—positions subject to regulatory checks.
  • Explicit consent where required under the UAE PDPL, including—but not limited to—retaining sensitive personal data beyond the recruitment process.
  • Legitimate interests in ensuring a fair, safe, and compliant recruitment process, balanced against your rights and freedoms.

Cross-Border Data Transfers

Tamara operates regionally and internationally, and as part of the recruitment process your Personal Data may be transferred to destinations outside the United Arab Emirates. This may include other Tamara group companies or third-party service providers, i.e., including but not limited to background-check or recruitment system providers, engaged to support the hiring process.

Whenever Candidate Data is transferred outside the UAE, Tamara ensures that the transfer complies with UAE PDPL Articles 23–24 and CBUAE CPS standards that at least one of the following conditions is met: 

  • The destination country provides a level of personal data protection recognized as adequate by the UAE Data Office.
  • There is a written agreement or contract with the recipient ensuring sufficient safeguards for your Personal Data.
  • The transfer is necessary for the performance of a contract with you.
  • The transfer is required by law or for public interest purposes.
  • You have provided explicit consent for your Personal Data to be transferred internationally.

Tamara would only transfer the minimum amount of Candidate Data necessary for the recruitment process, and apply appropriate organizational and technical measures to protect your Personal Data during any transfer.

Retention Periods and Deletion

We keep your Personal Data only as long as necessary to fulfill the purposes set out in this Notice and in accordance with UAE PDPL Regulation. 

  • Non-hired candidates: Recruitment records including but not limited to CVs, interview notes, application data are retained for 12 months following the end of the recruitment process, after which they are securely deleted or anonymized, unless we are required by law to keep them longer, or you consent to us retaining them for future opportunities.
  • Hired candidates: If you join Tamara, your data becomes part of your personnel file and is processed under the Employee Privacy Notice, with retention periods that apply to employees, including but not limited to personnel files retained for 5 years after the end of employment.

In some cases, data may be retained longer where required for litigation, regulatory obligations, or public interest purposes, in line with the UAE PDPL and our Data Retention Policy. Once the retention period expires and no lawful basis remains, your Personal Data will be securely destroyed or anonymized so that it can no longer identify you.

Your Rights under UAE PDPL

As a candidate, you have the following rights in relation to your Personal Data, under the UAE Personal Data Protection Law (PDPL) and its Implementing Regulations:

  • To be informed of the legal basis and purposes of processing your Personal Data.
  • To access your Personal Data and obtain a copy.
  • To request rectification of inaccurate or incomplete data.
  • To request erasure of your Personal Data where there is no lawful basis to continue processing.
  • To object to certain types of processing or withdraw your consent where processing is based on consent.
  • To request restriction of processing in certain circumstances.
  • To request portability of your Personal Data to another controller, where technically feasible.
  • To lodge a complaint with the UAE Data Office.

To exercise your rights, please contact privacy@tamara.co. We will respond in line with UAE PDPL requirements and within the statutory timelines.

Data Transfers, Recipients and Legal Justification

We share Candidate Data, where necessary and lawful, with the following categories of recipients:

  • Tamara Group Companies: Other Tamara entities may access Candidate Data to support recruitment, HR, and compliance processes, always subject to the same safeguards and UAE PDPL requirements.
  • Regulators, Authorities, and External Advisors: Where required by law, we may disclose Candidate Data to regulatory bodies, courts, or professional advisors such as auditors, legal counsel in connection with regulatory obligations or legal proceedings.
  • Third-Party Service Providers: We engage service providers to support the recruitment process, such as background-check providers, applicant tracking system (ATS) vendors, and recruitment software/platforms. These providers process Candidate Data solely under Tamara’s instructions and are bound by confidentiality and security obligations.

All transfers are made only where there is a lawful basis under UAE PDPL and CBUAE CPS standards, and only the minimum necessary data is shared.

Information Security

Tamara applies organizational, administrative, and technical measures to protect Candidate Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Access to Candidate Data is restricted to individuals who have a legitimate business need-to-know in the recruitment process, and all such individuals are bound by confidentiality obligations.

Tamara maintains procedures to identify, investigate, and respond to actual or suspected data incidents. Where required under the UAE PDPL and the Central Bank of the UAE, we will notify the competent authority and affected individuals without undue delay.

Automated Decision-Making

Tamara does not take decisions about candidates that are based solely on automated processing and that produce legal or similarly significant effects.

If this changes in the future, Tamara will provide you with specific information about the logic involved, the significance and potential consequences of such processing, and your related rights under the UAE PDPL and CBUAE CPS.

How to Contact Us

If you have any questions about this Notice or wish to exercise your rights under the UAE PDPL, you may contact us at:

  • Email: privacy@tamara.co
  • Data Protection Officer (DPO): appointed by Tamara to oversee compliance with this Notice and the UAE PDPL, and to act as the primary contact point for candidates and relevant authorities.