01
Who we are
Pharmagen Recruit ("we", "us", "our") is a recruitment platform operated by Pharmagen, based in Lebanon. We connect global healthcare employers with remote healthcare professionals. This policy describes how we handle personal data we receive from candidates, employers, recruiters, and website visitors.
Contact our data controller at info@pharmagen-recruit.com.
This document is written in English. Translations are provided for convenience; if they differ, the English version prevails.
02
What data we collect
We collect only the data necessary to deliver our service:
- Identity and contact: name, email address, phone number, country of residence.
- Professional information (candidates): CV, work history, qualifications, certifications, licences, language proficiencies, exam results, awards, and links to your LinkedIn / CV / video profile.
- Company information (employers): company name, sector, hiring needs, contact people.
- Application data: jobs you've applied to, cover notes, application status, interview scheduling, notes our recruiters record about your application, some of which may be shared with the employer you applied to.
- Background check (candidates): before a placement, you provide a recent criminal record certificate (issued within the last 3 months). A recruiter reviews it and records only that it was received and cleared, and its issue date. The certificate itself is not stored on the platform. This record is internal and is not shown to employers.
- Account data: hashed password, two-factor authentication enrolment, account activity timestamps.
- Communications: support tickets, contact-form submissions, in-platform messages.
- Newsletter: if you subscribe, only your email address and the list type (candidate or employer); we hash your IP for spam-abuse audit purposes.
- Technical: browser type, IP address (used for rate limiting and security, and received by the providers that deliver the site, such as Cloudflare, Sentry, Fontshare and jsDelivr; we never store it in plaintext long-term), and strictly-necessary cookies / localStorage values (such as your login session). Non-essential cookies are set only with your acceptance — see Cookies & local storage below.
03
How we use your data
- To match candidates with relevant employer opportunities and vice versa.
- To allow you to apply to roles, schedule interviews, and track applications.
- To send transactional emails (account confirmation, password reset, interview notifications, application status changes). These are not optional while your account is active.
- To send marketing emails (newsletter, occasional product updates) — only if you have opted in, at signup, in your account settings, or through the subscribe prompt. You can opt out at any time: unsubscribing through the link in any marketing email, or turning marketing emails off in your account settings, stops all marketing email to that address.
- To verify professional credentials where the placement requires it.
- To confirm, before a placement, that a candidate's criminal record certificate has been received and cleared.
- To detect abuse (rate limiting, captcha verification, security monitoring).
- To meet legal and regulatory obligations (e.g. payroll record retention).
04
Who we share your data with
We do not sell your personal data. We share it only in the following circumstances:
- Prospective employers (candidates): your CV and profile are shared with prospective employers as part of the placement process. You will be notified before your profile is presented to any specific employer.
- Recruiters and admins: Pharmagen Recruit staff have access to your profile data strictly to operate the platform.
-
Third-party processors:
- Supabase — database and authentication, hosted in Australia (Sydney).
- Cloudflare — hosting, content delivery, captcha verification (Turnstile), and cookieless web analytics.
- Resend — transactional and marketing email delivery.
- Sentry — error reporting in the browser and on the server (EU region). Reports can include your account ID but not your name, email address, or profile details; your IP address reaches Sentry's servers when a report is sent.
- Google Web Risk — checks external links you add, such as CV and video links, for malware.
- Fontshare — web fonts.
- jsDelivr — delivery of a JavaScript library.
- Legal: we may disclose data when required by law, court order, or to protect rights, property, or safety.
05
International transfers and GDPR
Your data is stored in Australia (Supabase, Sydney region). Australia does not have an EU adequacy decision, so this transfer is protected by the Standard Contractual Clauses in Supabase's Data Processing Agreement. When we send marketing or transactional email via Resend, the email body transits Resend's infrastructure (US-based). Cloudflare delivers content globally via its CDN. We rely on each processor's Standard Contractual Clauses (SCCs) or equivalent safeguards for any cross-border transfers — this is the legal basis under GDPR Article 46 for transferring personal data outside the EEA.
06
How long we keep your data
- Active accounts: for the duration of your engagement with Pharmagen Recruit.
- Dormant accounts: if you do not sign in for 24 months, we email you, and we delete the account 30 days later unless you sign in.
- After account deletion: personal identifiers, CV, video submissions, and profile data are permanently purged within 30 calendar days.
- Deletion records: after an account is deleted, our internal record of the deletion and the related admin audit entries keep only a non-identifying trace; your name and email address are removed from them within 30 days.
- Payroll and financial records: retained for a minimum of 7 years following the end of an engagement, as required by Lebanese tax and accounting law. Stored separately from the active profile.
- Anonymised aggregate data: may be retained indefinitely for operational reporting (e.g. "applications by month").
- Contact form enquiries: deleted 24 months after we receive them.
- Support conversations: deleted 12 months after the ticket is closed, and always when the account is deleted.
- Newsletter subscribers: email address retained until you unsubscribe; opt-out timestamp retained as proof of consent withdrawal.
07
Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you, in JSON format. Use Account Manager → Data Management → Download my data, or email us.
- Rectification — correct inaccurate data. Most fields are editable from your profile; locked fields can be updated via the "Request edit" workflow.
- Erasure — delete your account at any time via Account Manager → Delete Account. We will purge identifiers within 30 days.
- Restriction — ask us to limit how we use your data while you contest its accuracy, when the processing is unlawful but you do not want the data erased, when you need the data to establish, exercise, or defend a legal claim, or while an objection you have made is being assessed.
- Portability — receive your data in a structured, machine-readable format (JSON).
- Objection — object to processing based on legitimate interest; we will reassess.
- Withdraw consent — withdraw marketing email consent at any time. Withdrawal does not affect prior processing.
- Lodge a complaint — if you are in the EEA, UK, or another jurisdiction with applicable data-protection legislation, you may complain to the relevant supervisory authority.
To exercise any right, email info@pharmagen-recruit.com. We will respond within 30 calendar days.
08
Cookies and local storage
Pharmagen Recruit uses cookies and browser localStorage only where strictly necessary:
- Authentication session — Supabase issues a session token on login. Without it you cannot use the portal.
- Preferences — your theme choice (light / dark), cookie banner acknowledgment, tutorial-seen flag, newsletter widget dismissal — all stored in your browser's localStorage. We never read them server-side.
- Cloudflare Turnstile — captcha verification cookies set by Cloudflare to detect bots. See Cloudflare's cookie policy.
- Analytics — Cloudflare Web Analytics only: cookieless, aggregate visit statistics (such as page views), with no cross-site tracking. We do not use Google Analytics, tracking pixels, or a Facebook pixel.
09
Security
We protect your data through:
- TLS/HTTPS for all data in transit.
- Database row-level security: every sensitive table is gated; an authenticated user can only read their own data (or the records they are explicitly authorised to see).
- Password hashing via bcrypt (handled by Supabase Auth).
- Optional two-factor authentication for any account.
- Rate limiting on public endpoints to prevent brute force, scraping, and spam.
- Captcha verification (Cloudflare Turnstile) on all public forms.
- Strict Content Security Policy enforced in the browser.
- Audit logging of all privileged admin actions.
- Continuous security monitoring with alerting on errors and uptime regressions.
10
Data breach notification
If we confirm a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the incident. The notification will describe the data affected, the likely consequences, the measures we have taken, and the steps you can take to protect yourself.
11
Children
Pharmagen Recruit is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.
12
Changes to this policy
We may update this policy occasionally. Material changes will be announced via email to active account holders and posted at the top of this page. Continued use of the platform after a material change indicates acceptance of the revised policy.
13
Relationship to our Terms & Conditions
This Privacy Policy supplements our Terms & Conditions. The Terms & Conditions govern your overall relationship with Pharmagen Recruit (rights, obligations, liability, termination). This Privacy Policy specifically governs how we handle your personal data. Where the two documents address the same topic, the Privacy Policy takes precedence on data-handling matters.
14
Contact
For any data protection question, request, or complaint, contact us at info@pharmagen-recruit.com.