Privacy Policy

SawyaaHr is a workplace app. Your company subscribes to the Sawaya HR platform, creates your account, and decides what data goes into it. In data protection terms your employer is the controller of your employment data, and Sawaya HR is the processor acting on their written instructions.

This matters in practice: if you want your records corrected, exported, or erased, your employer decides, and we carry it out. Ask your HR department first. If they do not respond, write to us at privacy@sawayahr.com and we will escalate it with them.

We are a separate controller for a narrow set of data we need to run the service itself — security logs, support correspondence, and billing records with your employer.

Everything below comes either from your employer or from your own use of the app.

Identity and employment data

Your name, employee ID, work email, phone number, job title, department, manager, and work location. We do not ask you for any of this — your employer loads it into the platform when it creates your account.

Attendance records

The date and time of every clock-in and clock-out you record, the hours derived from them, and any unrecorded-attendance request you submit.

Precise location

A single location reading taken at the moment you tap Clock In or Clock Out, used to confirm you are at your assigned work site. Nothing is read while the app is in the background or closed.

Requests and their attachments

Leave, loan, expense, overtime, business trip, flight ticket, HR letter, disbursement, and general requests, together with any photo or document you attach as supporting evidence.

Payroll information

Your payslips and their line items are stored in your employer's payroll records and displayed to you in the app. The app shows them; it does not generate or alter them.

Device and technical data

Device model, operating system version, app version, preferred language, and a push notification token so we can deliver alerts. We also log the IP address a request arrives from, for security purposes.

We do not collect advertising identifiers, contacts, calendars, health data, or browsing history. The app contains no advertising or analytics SDK that tracks you across other companies' apps and websites.

We process this data to perform the contract between Sawaya HR and your employer, to meet your employer's legal obligations as an employer, and — for the camera, photo library, and notification permissions — on the consent you give in the app, which you can withdraw at any time in your device settings.

We never use your data to train machine learning models, and we never make a decision about your employment automatically. Every approval in the app is made by a person.

The app asks for four permissions. Each one is requested at the moment it is needed, with an explanation, and each can be refused or revoked later in your device settings without locking you out of the app.

If you refuse location access, you can still use the app — but a clock-in cannot be verified against your work site, so your employer may require you to submit an unrecorded-attendance request instead.

We do not sell your personal data, and we do not share it for anyone's advertising. It goes to three places only.

Your employer

Your HR administrators and the managers in your approval chain see the data relevant to their role. This is the whole purpose of the platform.

Our service providers

Cloud hosting for the platform, and Apple Push Notification service and Firebase Cloud Messaging for delivering alerts. They process data on our instructions only and may not use it for their own purposes.

Authorities, when the law requires it

If we receive a binding legal order, we disclose only what the order covers, and we tell your employer unless we are legally barred from doing so.

If Sawaya HR is ever acquired or merged, your data may transfer to the acquiring company under the same obligations. Your employer would be told before that happens.

Platform data is hosted on cloud infrastructure in the Kingdom of Saudi Arabia and the European Union. Where data is transferred outside the country it was collected in, we rely on standard contractual clauses with the receiving provider.

Your employer sets how long records are kept, within the limits of labour and tax law — attendance and payroll records typically have a statutory minimum retention period. When your employer instructs us to delete a record, or ends its subscription, we delete the live data within 30 days and purge encrypted backups within 90 days.

Security logs are kept for 12 months. Support correspondence is kept for 24 months.

• All traffic between the app and our servers uses TLS. The app makes no unencrypted requests.
• Data is encrypted at rest on our servers. Your session token is held in the device keychain, not in plain storage.
• Access inside Sawaya HR is role-based and limited to staff who need it, with every access logged.
• Two-step verification is available on every account and can be made mandatory by your employer.
• We test the platform for vulnerabilities and patch dependencies on a regular schedule.

No system is perfectly secure. If a breach affects your data, we notify your employer without undue delay and support them in telling you and the regulator as the law requires.

Depending on where you live — the Saudi Personal Data Protection Law, the GDPR, and comparable laws elsewhere all apply here — you can ask to:

• know what data is held about you and get a copy of it;
• have inaccurate data corrected;
• have data deleted, where no law requires it to be kept;
• object to or restrict certain processing;
• receive your data in a portable, machine-readable format;
• withdraw a consent you gave, such as camera or location access.

Send the request to your HR department, since they control the record. If you prefer to come to us, write to privacy@sawayahr.com. We acknowledge within 5 working days and respond within 30 days. Exercising any of these rights is free, and we will not treat you differently for it.

Your SawyaaHr account is an employment record owned by your employer, so you cannot delete it from inside the app — the same way you cannot delete your own personnel file. Attendance and payroll records also carry a statutory retention period that neither you nor your employer can waive.

To have your account closed and your data erased:

1. Contact your HR department and ask them to deactivate your SawyaaHr account.
2. Your HR administrator deactivates it immediately, which signs you out of every device and ends all access.
3. Once the statutory retention period has passed, your employer instructs us to erase the record, and we complete the erasure within 30 days.

If your employer no longer exists, or will not act, email privacy@sawayahr.com from the address on your account and we will handle the request directly. Deleting the app from your phone removes the local copy of your data but does not close the account.

SawyaaHr is a workplace tool for employed adults. It is not directed at children, and we do not knowingly collect data from anyone under the minimum legal working age in their country. If you believe a child's data has reached us, write to privacy@sawayahr.com and we will remove it.

When we change this policy we update the date at the top of the page. If a change materially affects how your data is handled, we tell your employer in advance and show a notice in the app. Continuing to use SawyaaHr after a change means the updated policy applies.

Questions about this policy, or about data we hold, go to our privacy team. For a problem with the app itself, the support page will get you an answer faster.

You also have the right to complain to your national data protection authority. In Saudi Arabia that is the Saudi Data & AI Authority (SDAIA).