Privacy

Nerve Media is a creative marketing agency based in Beirut, Lebanon, working with clients across Lebanon and remotely across the region.

This policy covers nervemedia.agency: the homepage, the careers page and these policy pages. It does not cover a WhatsApp conversation, which Meta carries under its own policy, or a client's own website that we built or run.

To ask what we hold, to correct it, or to have it deleted, message us on WhatsApp on +961 76 087 895. Say it is a data request and it goes to the right person.

Everything on that form is voluntary, and every field is visible before you fill it in:

• Your full name.
• A personal email address. We ask for a personal one rather than a university or a current employer's, deliberately.
• A WhatsApp number. It is how we reply, because that is how the agency works.
• Your major and current year, so we know where you are in your studies.
• The areas you want, picked from the list.
• Two short written answers, in your own words.
• Your CV, as a file. Whatever is in it is now with us, so send the version you are happy for a stranger to read.

It is written into our database and it appears in an internal list that only the people hiring can open, behind a password.

Your CV is kept in a private file store beside that record, never at a public address, so there is no link to it that could be guessed or shared. It is read by opening the application from the internal list.

We do not pass an application to another agency, a recruiter or a client. We do not use it to build a mailing list, and applying does not sign you up to anything.

For as long as the role is open, and then for up to twelve months afterwards, because the second best applicant for one role is often the first for the next one.

Ask us to delete it sooner and we will, without asking why. Message us on WhatsApp with the name you applied under.

If you are hired, the application becomes part of your employment file and is kept under whatever the law requires of an employer.

An enquiry about a project reaches us on WhatsApp. What we keep is the conversation, a name, a company and whatever brief you send.

During an engagement we hold what the work needs: brand material, access to the accounts you ask us to run, and the performance figures those accounts report. Access is given by you and can be taken back by you at any moment.

We do not sell client data, and we do not use one client's material for another's work.

Three things, and none of them is used to tell who you are:

• Ordinary server logs, kept by the host that serves the page.
• Our own visitor count. The first time a page opens in your browser it tells the site once, and the site adds one to that day's number of visitors. No cookie is set, and the message itself names neither the page nor where you came from. Your browser does attach the page's address to the request, as it does to every request it makes; the site reads it only to check that the request came from its own pages, and does not store it. To count each browser once a day, the site keeps a scrambled code made from your network address and your browser's name, which cannot be turned back into either, is different every day and is deleted after two days; for a minute at a time it also counts requests per address, under the same kind of code, to turn away floods. What stays is how many people came each day. The page then leaves a small mark in your browser so you are not counted twice, and with Do Not Track switched on it sends nothing at all.
• Cloudflare Web Analytics, where it is switched on. It is cookieless: it counts page views and sets nothing on your device, and it cannot follow you to another site.

That is the whole list. No Google Analytics, no Meta pixel, no TikTok pixel, no session recorder, and no advertising tag of any kind on this site.

Applications, CVs and the daily visitor numbers sit in a Cloudflare database and file store, in an account only we can sign in to. Cloudflare is our processor: it stores what we put there and does not use it for anything of its own.

The site itself is static files served from a content delivery network, so a page may be cached on a server outside Lebanon. There is nothing personal in those files.

You can ask us at any time to:

• tell you what we hold about you and send you a copy,
• correct anything wrong in it,
• delete it,
• stop using it for something you object to.

Lebanon's Law 81 of 2018 on electronic transactions and personal data gives you these rights here, and the GDPR gives you the same ones if you are applying from Europe. Asking costs nothing.

The site is served over HTTPS. The server refuses anything that does not look like a real application, which is what stops the form being used to write anything else, and the internal list is behind a password held by the people hiring.

The admin screens ship as encrypted code rather than as readable pages, so what an applicant list looks like is not published alongside the site.

If something goes wrong with data we hold about you, we will tell the people affected rather than hope nobody notices.

This site is aimed at people old enough to work. We do not knowingly collect anything from a child, and an application that turns out to be from one is deleted.

If this policy changes the date at the top changes with it, and the version number in the footer tells you which build of the site you are reading.