Privacy policy
How THUNDER collects, uses, and protects your personal data.
Privacy Policy
THUNDER
Effective date: 7 September 2026 — Version 1.0
1. Who we are
THUNDER ("THUNDER", "we", "us") is a recruitment company serving the tourism and hospitality sector in the Arab Republic of Egypt, established in 2026 and based in Cairo, operating through its website thundergroupeg.com.
THUNDER is the data controller for all personal data described in this policy and is responsible for determining the purposes and means of its processing.
Data protection contact: privacy@thundergroupeg.com
2. Scope
This policy covers the personal data we collect through thundergroupeg.com and its associated contact channels, in relation to three groups:
- Candidates — individuals submitting their details and CVs in search of work.
- Company representatives — people contacting us on behalf of employers to request staff.
- Site visitors and senders of general enquiries.
3. Definitions
- Personal data: any data relating to an identified or identifiable natural person.
- Controller: the party determining the purposes and means of processing — THUNDER.
- Processor: a party processing data on the controller's behalf and on its instructions — the technical providers listed in section 9.
- Processing: any operation performed on personal data, from collection and storage through modification, sharing and erasure.
4. Data we collect
### 4.1 Candidate data
Mandatory fields in the application form:
| Field | Purpose |
|---|---|
| Name | Identifying the candidate |
| Email address | Contact and updates |
| Mobile number | Prompt contact about opportunities |
| Governorate | Matching your location with job locations |
| Educational qualification | Assessing suitability |
| CV file | Assessing experience and putting you forward |
Accepted CV formats: PDF, DOC or DOCX, up to 5 MB.
Optional fields: university, graduation year, field of study, years of experience, current job title, expected salary, availability date, LinkedIn profile, English level, military service status (including a "prefer not to say" option).
Leaving optional fields blank does not prevent you from applying, but it may reduce how accurately we can match you to available roles.
### 4.2 Company representative data
Contact person's name, company name, work email, sector, roles required, headcount, target timing.
### 4.3 General enquiry form data
Name, email address, message content, and anything else the sender chooses to include.
### 4.4 Technical data
When you visit the site, limited technical data is processed, including IP address, browser type, operating system and request time, for the purposes of operating and protecting the site and detecting faults. Error monitoring data is scrubbed of personal data before storage.
### 4.5 What we do not collect
- We do not ask for your national ID number at any stage of application or referral.
- We do not ask for financial or payment card data, because our candidate services are entirely free (section 15).
- We do not ask for religion, marital status or health status, and no field in our forms is designed to capture them (section 10).
5. Sources of data
We collect data directly from the candidate or the company representative through the site's forms, or through the contact channels published on it (email and WhatsApp). We do not buy candidate databases and do not scrape data from external platforms.
6. Purposes of processing and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Receiving and reviewing a candidate's application | Candidate data and CV | The candidate's express consent given on submission |
| Retaining the candidate in our talent database and matching them with future roles | Candidate data and CV | The candidate's express consent given on submission |
| Putting the candidate forward to our employer clients | Candidate data and CV | The candidate's express consent, with notification and a right to object (section 8) |
| Communicating with the candidate about their application | Contact details | Consent and carrying out what the candidate requested |
| Sending new job alerts | Email address | Separate, optional consent |
| Providing recruitment services to employers | Company representative data | Performance of a contract or pre-contractual steps |
| Responding to general enquiries | Enquiry form data | Carrying out what the sender requested |
| Site security, bot prevention and fault monitoring | Technical data | THUNDER's legitimate interest in protecting its services and users |
7. The talent database and matching
We operate an "apply once" model: when you send your application, your details and CV are stored in our talent database, and we return to it whenever a role opens that may suit your qualifications and experience — you do not need to reapply each time.
This means your data stays with us for the period set out in section 11, and its use is not limited to the specific role you may have applied for. You can ask us to delete your data from the database at any time (section 13).
8. Putting you forward to employers
By submitting your application, you consent to THUNDER putting you forward to its employer clients in the tourism and hospitality sector within the Arab Republic of Egypt.
What we share, and when:
1. At the first stage we send the employer a professional summary we prepare from your details, covering qualification, experience, field of study, governorate and language level — without your full name, without your contact details, and without your CV file.
2. If the employer expresses interest in the summary, we then send your CV and contact details so that interview arrangements can proceed.
3. Your stated expected salary stays inside THUNDER and is used only to match you to suitable roles. We do not share it with the employer unless you expressly agree.
Notification and right to object: we email you when you are put forward, naming the employer and the role. You may object within the period stated in that email, in which case we stop the referral and do not send your CV to that employer. Objecting does not affect the retention of your profile or your consideration for other roles.
Your relationship with the employer after referral: if an employer contacts you directly or hires you, their processing of your data is governed by their own policies, and THUNDER is not responsible for it.
9. Who has access to your data
### 9.1 Within THUNDER
Access is limited to staff whose work requires it, on a need-to-know basis.
### 9.2 Our employer clients
As set out in section 8, and subject to their undertaking to use candidate data only to assess candidates for the role concerned, not to share it with third parties, and not to retain it beyond that purpose.
### 9.3 Technical service providers (processors)
| Provider | Role | Processing location |
|---|---|---|
| Supabase | Database and authentication | Frankfurt, Germany |
| Cloudflare R2 | CV file storage | European Union |
| Cloudflare Workers | Website hosting | Outside Egypt |
| Cloudflare Turnstile | Protecting forms against automated submissions | Outside Egypt |
| Resend | Sending email | Outside Egypt |
| Sentry | Technical error monitoring, with personal data scrubbing | European Union |
These providers process data on our behalf and solely to operate the service; they may not use it for their own purposes.
### 9.4 Other parties
We may disclose data where required to comply with a legal obligation, or to respond to a request from a competent judicial or administrative authority.
We do not sell, rent or trade your personal data.
10. Sensitive data inside CVs
Our forms ask for the minimum data needed for recruitment. However, many CVs circulating in Egypt include information we never asked for, such as religion, marital status, health status, national ID number, or a personal photograph.
Our commitments on this:
- We do not request this data, and no field in any of our forms is designed to capture it.
- We do not use it to assess any candidate or in any decision to put them forward or set them aside, and we build no classification or differentiation on it.
- We advise you not to include it in your CV. Leaving it out will not harm your prospects with us in any way.
- The professional summary we send to employers at the first referral stage (section 8) is built only from the fields we asked for, so this information does not reach the employer at that stage.
- Where we notice it, we treat it as unrequested data and seek to delete or redact it.
11. Retention periods
| Data | Retention period | What happens afterwards |
|---|---|---|
| Candidate data and CV | Two years from the date of last interaction with us | The CV and identifying data are deleted; an anonymised statistical counter is kept that does not allow anyone to be identified |
| Data of a candidate placed through us | Three years from the placement date | Identifying data is deleted; a placement record is kept as needed to evidence the service provided to the employer |
| Company representative data | Three years from last dealing | Deletion or anonymisation |
| General enquiry messages | One year | Deletion |
| Error monitoring logs (Sentry) | 30 days | Automatic deletion |
| Technical server logs | 90 days | Automatic deletion |
"Last interaction" means the last time you submitted an application, updated your details, contacted us, or engaged with a message we sent you.
Backups: we take daily backups of our databases for service continuity and disaster recovery. Your data may remain within those backups for a short period after deletion from our live systems, until they are rotated out in the ordinary cycle. Backups are not used for any other purpose, and deleted data is not restored from them for reuse.
12. Processing outside the Arab Republic of Egypt
We are being direct with you: the entire technical infrastructure of this website sits outside Egypt. The database and account data are stored on servers in Frankfurt, Germany; CV files are stored on servers within the European Union; and the remaining services listed in section 9 are likewise located outside Egypt. This means your personal data is transferred out of the country and processed there.
We selected providers that process data in jurisdictions subject to recognised data protection frameworks, each bound by contractual controls on data security, confidentiality, and restriction of use to operating the service.
Your consent to this transfer forms part of the consent you give when submitting your application, and is stated expressly in the consent notice shown beneath the application form. If you do not want your data processed outside Egypt, please do not submit an application through this site.
Clients outside Egypt: all the employers we work with are within the Arab Republic of Egypt, and we do not put candidates forward to employers abroad. If that changes, we will update this policy and obtain your consent before any referral outside Egypt.
13. Your rights and how to exercise them
As a data subject you have the following rights:
- To be informed whether we hold your data, what it is, and why.
- Access — to obtain a copy of your personal data held by us.
- Rectification — to have inaccurate data corrected or incomplete data completed.
- Erasure — to request deletion of your data from our systems.
- Objection — to object to the processing of your data, or to being put forward to a particular employer.
- Withdrawal of consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.
- Complaint — to lodge a complaint with the competent supervisory authority for personal data protection in the Arab Republic of Egypt.
How to exercise your rights: send your request from the email address you gave us to privacy@thundergroupeg.com, stating which right you wish to exercise. We may ask you to verify your identity before acting, to protect your data from unauthorised access.
Response time: we undertake to respond within 30 days of receiving a complete request. Where a request is complex or where several requests are made, we may need additional time, and we will tell you and explain why before the original period ends.
Free of charge: exercising your rights costs you nothing.
14. Minors
Our services are directed at people aged eighteen or over. We do not accept applications from anyone below that age through the site and do not knowingly collect their data. If we become aware that we have received data from someone under eighteen, we delete it and do not put them forward to any employer. If you are a parent or guardian and believe a minor has submitted data to us, write to privacy@thundergroupeg.com.
15. No fees for candidates
THUNDER charges candidates nothing, in any form, at any stage. No application fee, no registration fee, no charge for training, paperwork or interviews, and no percentage of salary after placement. Our candidate services are entirely free; our income comes from the employers who engage us.
Fraud warning: if anyone asks you for money in THUNDER's name, they do not represent us. Report it to us immediately at info@thundergroupeg.com.
16. Cookies and similar technologies
Our site uses no marketing or advertising tracking tools. There is no Google Analytics, no Meta Pixel and no similar tool on the site; we build no interest profiles about visitors and share no browsing data with advertisers.
The technologies in use are limited to what is needed to run and protect the site:
| Technology | Purpose |
|---|---|
| Supabase authentication | Keeping you signed in and holding session state |
| Cloudflare Turnstile | Verifying that a form is submitted by a person, not a bot |
| Sentry | Technical error monitoring, with personal data scrubbing |
You can set your browser to refuse cookies, noting that refusing necessary cookies may break functions such as sign-in or form submission.
If we add any measurement or marketing tool in future, we will not enable it before updating this policy and providing a prior consent mechanism.
17. Contact channels
We communicate with you by email and telephone, and via WhatsApp, as our site carries a WhatsApp contact button. If you choose that channel, your message passes through the WhatsApp service and is subject to its own terms and privacy policy. We do not use WhatsApp to send marketing messages.
18. New job alerts
The application form includes an optional, unticked box consenting to receive alerts about new roles. Ticking it is not a condition of applying or of being put forward.
You can unsubscribe at any time using the unsubscribe link in every message, or by writing to privacy@thundergroupeg.com. Unsubscribing does not stop operational messages about your application or referrals.
19. Automated decision-making
We do not use any automated system or artificial intelligence to read CVs or to screen or rank candidates. Every assessment is made by a member of our team. If we introduce any automated screening tool in future, we will update this policy and notify candidates before it goes live.
20. Data security
We take technical and organisational measures to protect your data, including: encryption of the connection to the site, restricting data access to staff who need it, protecting forms against automated submission, scrubbing personal data from error monitoring logs, taking daily backups, and relying on established infrastructure providers.
That said, no method of electronic transmission or storage is absolutely secure, and we cannot guarantee the security of your data absolutely. If an incident occurs affecting the security of your personal data in a way likely to cause you harm, we take the steps needed to contain it and notify the relevant authorities and affected data subjects as required by law.
21. External links
Our site may contain links to external websites, including ones provided by candidates themselves such as LinkedIn profiles. We do not control those sites and are not responsible for their privacy practices.
22. Changes to this policy
We may update this policy whenever our practices or regulatory requirements change. The updated version is published on this page with a new version number and effective date. Where a change is material and affects your data, we will notify you by email.
23. Contact
| Purpose | |
|---|---|
| Data protection requests and complaints | privacy@thundergroupeg.com |
| General enquiries | info@thundergroupeg.com |
| Candidate and recruitment matters | careers@thundergroupeg.com |
| Human resources | hr@thundergroupeg.com |
| General contact | contact@thundergroupeg.com |
All data protection requests should be sent to privacy@thundergroupeg.com and are handled by our responsible officer within the period set out in section 13.