Privacy Policy
This policy sets out the personal data processed through the Jadwal HR system, the purpose of each type, the legal basis for processing it, how long it is kept, and the rights you hold over it and how to exercise them.
In short: if you are an employee, your employer is the controller of your data and we process it on their behalf. If you asked us for a demo, we are the controller of what you sent us. Data is stored inside the Kingdom of Saudi Arabia. We do not sell your data and we do not use it for advertising. Location is read at the moment you clock in or out, and is never tracked in the background.
Who is the controller and who is the processor
Jadwal is a platform that an employer subscribes to in order to manage their own staff. For that data:
- Your employer (the subscribing business) is the data controller. They decide what data is entered into the system, for what purpose, who may see it, and when it is deleted.
- Jadwal is the processor. We process the data only on your employer's instructions and under the contract we hold with them, and we do not use it for any purpose of our own.
So if you are an employee and you want your data corrected or deleted, the right place to start is your own HR department. You can also write to us directly if you receive no reply, and we will pass your request on to the controller.
There is one exception, and it is set out in full under requesting a demo: if you fill in the demo request form on this website, nobody employs you in relation to us and there is no employer above us. For that information we are the controller ourselves, and we do use it for a purpose of our own — replying to you about Jadwal.
The data we process and why
We do not collect data "just in case". Every field in the table below exists because a specific function of the system requires it.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, employee number, job title, department, branch | Identifying the employee within the system and linking them to attendance, leave and payroll records | Performance of the employment contract |
| National ID number or Iqama number | Formal identification of the employee on payroll runs and official documents | Compliance with labour law and regulatory requirements |
| Mobile number and email address | Creating the account, password recovery, and notifications about requests and approvals | Performance of the employment contract |
| Clock-in and clock-out times and shifts | Calculating working hours, lateness, overtime and the pay due | Performance of the employment contract and compliance with labour law |
| Location at the moment of clocking in or out | Verifying that the clock-in took place inside the approved work location | The employer's legitimate interest in documenting attendance |
| Salary, allowances, deductions, loans and end-of-service benefits | Calculating pay and issuing payroll runs and statutory entitlements | Performance of the employment contract and legal compliance |
| Bank account details (IBAN) | Paying the salary | Performance of the employment contract |
| Leave requests, balances and approval decisions | Managing leave and keeping a record of decisions | Performance of the employment contract and compliance with labour law |
| Uploaded documents (ID, Iqama, certificates, transfer proofs) | Maintaining the employee file and documenting petty cash movements | Legal compliance and legitimate interest |
| Sign-in and change records (the audit trail) | Account security and tracing who changed which record and when | Legitimate interest in the security of the system |
Location data — precisely
We know this is the question employees ask most, so here is the plain answer:
- Location is read only at the moment you press the clock-in or clock-out button. That is the single occasion on which the app asks for your location.
- There is no background tracking. The app does not read your location when it is closed, nor while it is open unless you press the button, nor outside working hours.
- What is stored is the coordinates of that one point and the result of the check (inside the branch geofence, or outside it). No movement route or travel history is built from it.
- You can refuse the location permission in your device settings. If you do, clocking in from the app will not work, and your attendance will need to be recorded another way as decided by your employer.
Where data is stored
All data is stored in the Oracle Cloud data centre in the city of Riyadh, inside the Kingdom of Saudi Arabia (the me-riyadh-1 region), and is not moved outside the Kingdom in normal operation.
A nightly backup is taken and kept in a location separate from the primary server for disaster recovery purposes, under the same protective controls.
Every subscribing business has an isolated database; your data is not stored mixed together with that of other customers.
Third-party service providers
We rely on a small number of technical service providers to run the system. None of them is permitted to use the data for their own purposes:
| Provider | Purpose | What they receive |
|---|---|---|
| Oracle Cloud (Riyadh) | Hosting the servers, databases and file storage | All system data, stored inside the Kingdom |
| Firebase Authentication (Google) | Managing sign-in and passwords | Email address and account identifier only. No payroll data reaches them |
| Firebase Cloud Messaging (Google) | Sending push notifications to the mobile app | The device identifier and the notification text |
| Google Gemini | Reading the data off an uploaded receipt or document automatically, instead of it being typed in by hand | The image of that receipt or document only, and only while your employer has the AI extraction feature switched on. The feature is off unless it is switched on deliberately |
| Sentry | Monitoring and resolving technical errors | Technical data about the error. Fields we can recognise as personal — names, national ID and Iqama numbers, IBANs, salary figures, email addresses and phone numbers — are removed automatically before the report is sent |
The Firebase, Gemini and Sentry services process their data on infrastructure that may sit outside the Kingdom. What reaches them is limited to what is listed above. No payroll data leaves the Kingdom. A document or receipt image leaves it only through the AI extraction feature, only for the moment the reading takes, and only if your employer has switched that feature on — it is off unless they do.
How long data is kept
- During the subscription: data is kept for as long as your employer subscribes to the service and needs it for the purpose it was collected for.
- Payroll and attendance records: your employer keeps these for the period the applicable regulations require, which is normally no less than five years.
- When the subscription ends: your employer is given a full copy of their data within thirty days, after which their data is deleted from our operational systems.
- Backups: these are rotated regularly, and deleted data disappears from them within ninety days at the latest.
- Audit records: kept for a limited period for security purposes and then deleted automatically.
Your rights over your data
The system is designed in line with the principles of the Kingdom's Personal Data Protection Law, under which you hold the following rights:
- The right to be informed about the data collected about you and the purpose of it — this document is part of meeting that.
- The right of access to a copy of your personal data held in the system.
- The right to request correction where your data is inaccurate, incomplete or out of date.
- The right to request destruction of data that is no longer needed, subject to what the regulations require to be retained.
- The right to obtain your data in a machine-readable format.
These rights are not absolute: your employer may be unable to delete a payroll or attendance record they are legally required to keep, even if you ask them to.
How to request a copy of your data, or its deletion
- Write to the HR department at your own employer first; they are the controller of the data and the decision on your request is theirs.
- If you receive no reply within a reasonable period, write to us at info@jadwal.tech stating your employer's name and the nature of your request.
- We verify your identity first to protect your account, then pass the request to the controller and follow it through. We usually respond to requests within thirty days.
If you ask us for a demo
Everything above concerns employees whose employer subscribes to Jadwal. This section is different, and the difference matters: if you fill in the demo request form on this website you are not anybody's employee in relation to us, and there is no controller above us. For this information Jadwal is the data controller, and we use it for a purpose of our own — contacting you about the product.
What we collect
Only what is needed to answer you and to know whether Jadwal suits your business: your name, your company name, your email address, and the number of staff you employ. A phone number and a message are optional, and the form works without them. We also record the time you submitted the form and the network address it came from, to detect automated abuse of a form that is open to the public.
Why, and on what basis
We use it to reply to your enquiry, to arrange a demonstration, and to set up an account if you decide to go ahead. The lawful basis is our legitimate interest in responding to an enquiry you addressed to us. We do not sell it, we do not share it for anybody else's marketing, and we do not add you to a mailing list you did not ask for.
How long we keep it
- The network address and browser identifier: erased after ninety days. They exist only to investigate abuse of the form, and that reason expires long before the rest does.
- Your enquiry, if it does not become a subscription: deleted twelve months after we last spoke to you.
- Your enquiry, if it does become a subscription: kept for as long as your business is a customer, because it is the record of how that relationship began. The network address is still erased at ninety days.
Your rights over it, and how to use them
The rights listed under your rights over your data apply here too, and for this data they are simpler to exercise, because there is no employer in between: write to info@jadwal.tech and ask us for a copy, a correction, or deletion. We will act on it and confirm, normally within thirty days. You do not have to give a reason, and asking us to delete it will not affect any other dealings with us.
Data security
- All connections to the system are fully encrypted over HTTPS.
- Sensitive fields — such as National ID, Iqama and IBAN — are encrypted in the database.
- Permissions are set by role: whoever approves leave does not necessarily see payroll.
- Every create, change or delete is written to an audit trail with the name of whoever performed it and the time.
- Passwords are managed through Firebase Authentication and are never stored by us in readable form.
Children's data
Jadwal is a system for managing employees. It is not directed at children and is not used by them. We do not knowingly collect data about anyone below the statutory working age. If such data is found to have been entered into the system, it is deleted as soon as we are notified.
Cookies on this website
This marketing website uses no tracking cookies and no advertising analytics tools. Fonts are served from our own server rather than a third-party font service, so no outside party receives your IP address when you browse this site. The Jadwal system itself uses only the technical cookies required to keep your sign-in session active.
Browsing this site therefore collects nothing about you. The one way this website receives your personal data is if you choose to send it: the demo request form, which is covered in full under if you ask us for a demo.
Updates to this policy
We may update this policy when the way the system works changes or when regulatory requirements change. The last updated date appears at the top of this page, and we notify subscribing employers of any material change before it takes effect.
Contacting us about privacy
This is a service operated by Jadwal, represented by Fady Saied.
For any question or request relating to this policy:
- Email: info@jadwal.tech
And if you believe your data has not been handled lawfully, you have the right to lodge a complaint with the authority responsible for supervising personal data protection in the Kingdom.