Privacy Policy

1. Scope of this policy

This policy explains how the SmartHR system collects, uses and protects personal data. It complements the Terms and is applied under the Saudi Personal Data Protection Law and its implementing regulation.

2. Roles of the parties

The subscribing company is the controller of its employees’ data, and the provider acts as a processor on its behalf and instructions, never for its own purposes.

3. Data we collect

• Account data: company name, user name, email and mobile; passwords are stored hashed and cannot be recovered.
• Employee data entered by the company: name, national or iqama number, contract and pay details, documents and expiry dates, leave and requests.
• Technical data: IP address, sign-in time and in-system activity log, for security and audit purposes.

4. Purposes of processing

• Operating the service and delivering its features (files, leave, alerts, letters, statutory calculations).
• Protecting accounts and detecting unauthorised use through audit logs.
• Operational notices about the subscription, invoices and material updates.

5. Disclosure to third parties

Data are never sold or shared for marketing. Disclosure is limited to technical service providers required for operation (hosting and payment gateway) under confidentiality agreements, or in response to a lawful request from a competent authority.

6. Data protection

• All traffic is fully encrypted (HTTPS) and passwords are stored with a strong hashing algorithm.
• Each company’s data are isolated, and access is governed by role permissions (owner, HR, department manager, employee).
• Every material action is written to an audit log with the user, time and connection address.
• Regular database backups are taken to protect subscribers against loss.

7. Retention period

Company data are kept while the subscription is active and for 30 days after it ends to allow export, then deleted or anonymised unless the law requires longer retention.

8. Data subject rights

A data subject has the right to be informed, to access, and to request correction or destruction under the law. Such requests go to the subscribing company as controller, and the provider gives the technical support needed to fulfil them.

9. Cookies

The system uses a single essential cookie to keep your session open after sign-in; it is not used for advertising tracking.

10. Policy updates

This policy may be updated; the current version is always published on this page with its version number and effective date.

11. Contact

For any privacy question or to exercise a statutory right, contact us using the details published on the site.