Privacy policy

StaffSyria is responsible for the personal data described here. The data controller is the StaffSyria entity named in your engagement letter. Contact for privacy matters: hello@staffsyria.sy.

• Consultation and proposal requests: your name, work email, company, country, role, planned team size, services of interest, timeline, preferred call times, time zone, any message, and any calculator estimate you bring with you.
• Client Workspace accounts: contact name and email, your password (stored only as a salted hash), two-factor settings and sign-in times.
• Information clients give us to deliver the service: hiring requests; employee details such as name, role, department, start date, salary and contracts; payroll line items; and company documents.
• Security records: an audit trail of sign-ins, two-factor events, password resets, document downloads and payroll approvals, including IP address and browser type.
• Website analytics: page views and button clicks recorded without cookies, identifiers or IP addresses — only the page, the event name and the referring website's domain.

• To respond to your enquiry and prepare a proposal — steps you asked us to take before a contract.
• To deliver the services in your engagement letter: recruitment, HR administration, payroll preparation and compliance filings — performance of our contract, and legal obligations for employment and tax records.
• To keep accounts and data secure — our legitimate interest, and legal obligations where they apply.
• To understand, in aggregate, which pages help visitors — our legitimate interest.

We do not sell personal data and we do not use it for advertising.

• Service providers that host and run the platform for us — hosting and database, file storage, transactional email and rate-limiting infrastructure. They process data only on our instructions.
• Public authorities where Syrian law requires it — for example social-insurance and tax filings made on your company's behalf.
• A client company sees a candidate's information only when we submit that candidate for one of its roles.
• Professional advisers, such as lawyers and accountants, under confidentiality and only where needed.

Most of our clients are outside Syria, and our service providers may store data in other countries, such as the EU or the United States. When we transfer personal data internationally we use providers with appropriate safeguards and contractual protections.

• Consultation requests: 24 months after our last contact, unless they become an engagement.
• Client Workspace accounts: for the engagement plus the 60-day transition; access closes on the end date.
• Employment, payroll and tax records: as long as Syrian law requires your company or us to keep them.
• Security audit records: 24 months.
• Website analytics events: 13 months.

When a retention period ends we delete the data or anonymise it.

Connections are encrypted (HTTPS). Passwords are stored as salted hashes. Clients and staff can protect their accounts with two-factor sign-in, and two-factor secrets are encrypted at rest. Our staff access data by role. Files are stored privately and every download is access-checked and logged. Sensitive actions are recorded in an audit trail, and the database is backed up regularly.

No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay.

You can ask to access, correct or delete your personal data, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it.

To make a request, email hello@staffsyria.sy. We may need to confirm your identity first. You may also complain to the data-protection authority where you live.

We update the date at the top when this policy changes, and we email clients about material changes.

Questions or requests about this document: hello@staffsyria.sy. We reply within 30 days, usually much sooner.