Privacy Policy

1. Responsibility and contact

MyProJourny is responsible for the personal information it holds for this service and acts as the data controller for that information.

Our data protection officer is the contact for data protection oversight and assistance with your rights. Article 11 requires appointment of an officer when sensitive personal data is processed.

2. Information we handle

Depending on your requested service, we may process information you provide or authorize someone to provide:

• Contact details: your name, email, phone number, and professional location, such as city and country.
• Career materials: your CV, employment and education history, skills, qualifications, achievements, projects, and professional links.
• Optional portfolio content: photographs, biographies, work samples, testimonials, and the contact details you specifically choose to display.
• Service records: messages, instructions, revisions, approvals, consent choices, and privacy requests.
• Billing information, where applicable: the minimum information needed to invoice you and confirm payment.
• Technical information, where collected: hosting or security logs, such as IP address, browser information, and access times. The relevant provider, purpose, and processing period will be disclosed before that processing begins.

Please remove national ID or passport numbers, full home addresses, signatures, financial documents, and unrelated private details from your career materials unless we have explained a specific lawful need and agreed a suitable submission method. Never send passwords, card security codes, or banking credentials.

3. Extra care for sensitive information

Career documents can reveal sensitive information directly or indirectly. Jordanian law includes origin or race, political opinions or affiliations, religious beliefs, financial status, health or physical or mental condition, genetic or biometric information, criminal records, and other categories designated by the Personal Data Protection Council.

Most of this information is unnecessary for a professional portfolio. We will not ask for or infer sensitive characteristics to evaluate your employability. If a feature you request genuinely requires sensitive information, we will explain what is needed, why, who can access it, and the processing duration, and obtain explicit, documented consent unless a specific legal exception applies.

If unrelated sensitive details arrive in your files, we will restrict access, exclude them from drafts and public pages, and arrange their removal or redaction. Sending sensitive information does not give blanket permission to reuse it.

4. Purposes and consent

We will use authorized information to prepare and revise your professional story, design and deliver your portfolio, communicate about your order, and provide hosting or maintenance you choose. We will also handle necessary billing, privacy requests, and applicable legal obligations.

Before consent-based processing begins, we will provide a written or electronic notice identifying the data, purpose, start date, duration, participating processors, relevant safeguards, and any profiling. Consent must be explicit, recorded, easy to understand, and specific to its purpose and duration. Sending a CV or browsing our website does not authorize every use described in this policy.

We will keep separate choices for service preparation, public publication, promotional reuse, and other optional uses. We will obtain fresh consent for changes in the nature, type, or purpose of processing, or an extension of its duration, where required. Declining marketing will not prevent you from purchasing the core service.

Processing without consent will be limited to a specific applicable exception under Article 6, such as a legal requirement or court order. A general business interest is not a substitute for consent.

5. You decide what becomes public

Permission to prepare a portfolio is separate from permission to publish it. Before publication, we will ask you to review and expressly approve the version, the details to display, the destination website, and the publication period. Private source documents will not become downloadable files unless separately approved.

A public portfolio can be viewed worldwide, indexed by search engines, copied, or shared. An unlisted link or search-engine exclusion setting is not a private access control. We will explain available access options before you choose.

You may request changes or removal from pages we control. We will take reasonable steps to request removal of copies under our providers' control, but cannot guarantee deletion of independently saved copies or immediate removal of search-engine caches.

Using your name, image, portfolio, testimonial, or results in our demos, social media, or advertising requires separate permission. You may refuse or withdraw it.

6. Providers, AI tools, and sharing

Where needed, approved providers may support document preparation, design, storage, communication, hosting, domain registration, or payments. Before processing, we will identify the providers involved, their roles, the information they receive, and relevant locations. Access will be limited to what they need for the authorized task.

Providers acting on our instructions must meet appropriate confidentiality, security, purpose, duration, deletion or return, and incident-reporting requirements. We will document disclosures and obtain the consent required for transfers under Article 14. Legally required disclosures will be limited to their lawful scope.

AI-assisted preparation: If we propose using an external AI service with your personal data, we will first identify the provider, explain what it will receive and why, and disclose relevant retention and training terms. We will remove unnecessary identifiers and sensitive details. We will not submit customer information for general-purpose model training or permit that use under our provider arrangements. Identifiable or sensitive information will not be uploaded unless the necessary consent and protection requirements are satisfied.

AI-assisted wording will receive human review for accuracy before delivery, and you may correct it. We will not use automated profiling to rank your job prospects or make hiring decisions about you.

We will not sell or rent personal data, supply customer lists to advertisers, or share private documents with recruiters or employers without specific authorization, except where disclosure is legally required.

7. Transfers outside Jordan

Cloud, communication, AI, and hosting services may involve storage or access outside Jordan. Before transferring information, we will check the recipient's protection level and comply with Articles 14 and 15, including applicable disclosure, consent, and recordkeeping requirements.

We will explain the relevant recipient, destination, and protection arrangements. A transfer to a recipient offering a lower level of protection will not occur unless a specific statutory exception applies. If relying on the consent exception, we will first inform you that adequate protection is unavailable and obtain your specific consent. Agreement to this policy alone is not that consent.

8. Security commitments

Protecting your information comes first throughout receipt, preparation, publication, and deletion. We will apply technical and organizational measures appropriate to the data's sensitivity, including:

• Access limited to authorized people who need the information, with confidentiality duties and appropriate training.
• Protected accounts, strong authentication, and multi-factor authentication where supported.
• Encrypted transfer methods and appropriate protection for stored files, devices, and backups.
• Separation of private source documents from public portfolio assets.
• Provider review, software updates, access reviews, and procedures to detect and respond to unauthorized activity.
• Secure deletion and controls to prevent deleted data from being reintroduced from backups.

We will explain the safeguards applicable to your processing before it begins. No system can promise absolute security; this does not reduce our responsibility to protect your information and respond to incidents.

9. Retention and deletion

We will not retain identifiable data after its processing purpose has ended unless legislation requires otherwise. Your collection notice will specify actual processing periods rather than open-ended permission to keep files.

• CVs and working drafts: for the agreed preparation and revision period, then erased or irreversibly anonymized unless a lawful, separately specified purpose continues.
• Published content: for the approved publication or hosting period, subject to your withdrawal and removal rights.
• Billing and legally required records: for the applicable statutory period, with restricted access and no reuse for marketing.
• Consent, request, security, and backup records: for defined, lawful periods disclosed in the collection notice. Backup deletion must be scheduled consistently with legal requirements; retained copies must remain protected and unavailable for ordinary use.

We will require relevant processors to erase or return data when their authorized processing ends. If a legal obligation prevents deletion, we will explain its basis and applicable period unless the law prevents disclosure.

10. Your rights and complaints

Subject to the conditions and exceptions in Jordanian law, you may:

• Know what data we hold, access it, and obtain a copy.
• Withdraw prior consent.
• Correct, amend, add to, or update your information.
• Restrict processing to a specified scope.
• Request erasure or anonymization where legally provided.
• Object to unnecessary, excessive, discriminatory, unfair, or unlawful processing or profiling.
• Request transfer of a copy to another controller.
• Be informed about breaches affecting your data in accordance with the law.

Email info@suadspec.website with the service concerned and the action you want. We will use the minimum information needed to verify your identity, acknowledge your request, and respond within the applicable legal period. We will explain the outcome and any lawful limitation. We will not charge or impose a contractual penalty merely for exercising your rights, without prejudice to lawful rights preserved by Article 4(c).

Withdrawal stops future processing that depends on the withdrawn consent. If that information is necessary to continue a requested service, we will explain the practical effect and alternatives. Withdrawal does not authorize us to retain unnecessary data.

You may also complain to Jordan's Personal Data Protection Directorate at the Ministry of Digital Economy and Entrepreneurship through its official complaint and service channels. Using our service does not waive your complaint rights or legal remedies.

11. Data incidents

We will investigate suspected unauthorized access, disclosure, alteration, loss, or other misuse, contain the incident, and document our response. Where a breach could cause serious harm, Article 20 requires notification to affected people within 24 hours of discovery, including measures to reduce the consequences, and notification to the competent Unit within 72 hours of discovery, with available details about the source, mechanism, and affected people.

We will meet applicable notification duties and provide relevant updates. Report suspected exposure promptly to info@suadspec.website.

12. Legal capacity and other people's data

If a customer lacks legal capacity, we will obtain the consent required by law from a parent, guardian, or other recognized authority before consent-based processing.

Please avoid sending private information about referees, colleagues, clients, or family members unless necessary and authorized. We will establish the appropriate consent or other lawful basis for their information; your consent alone does not authorize publication of another person's contact details or confidential work.

13. Website and external platforms

Before introducing optional analytics, advertising trackers, or non-essential cookies, we will disclose the provider, purpose, duration, and data use, and obtain consent where required. Necessary hosting or security processing will be described in the applicable collection notice. This policy does not itself activate or consent to tracking.

Social platforms, payment providers, and other external services may process information under their own privacy notices. We remain responsible for information we receive. Use the agreed protected submission method for sensitive files rather than public comments or public share links.

14. Changes and legal framework

We will publish the effective date of updated versions and notify affected customers of material changes through an appropriate contact channel. An update does not replace fresh consent where required. Nothing in this policy limits your statutory rights.

This draft is based on the supplied Arabic Personal Data Protection Law No. (24) of 2023, particularly Articles 2, 4–15, 18, and 20. The Arabic legislation governs interpretation. Applicable implementing requirements must also be followed; the Ministry maintains an official legislation and guidance collection.