PrivacyPolicy

1. Who We Are & Scope

The Barez HR platform and website (barez.sa) are operated by Barez, an entity registered in the Kingdom of Saudi Arabia (“Barez”, “we”, “us”). We provide a cloud-based HR system covering employee management, attendance, payroll, recruitment, leave, reporting, and related services (the “Service”).

This policy explains how we collect, use, store, protect, and share personal data, and the rights of data subjects. It is designed to comply with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. (M/19) and its amendments, its Implementing Regulations and the Data Transfer Regulations, and the controls issued by the Saudi Data & AI Authority (SDAIA) as the competent authority.

It applies to visitors of our website, customers (subscribing organizations), and end users of the Service among those organizations’ employees and managers. Using the Service or website constitutes your acknowledgment of this policy.

2. Key Definitions

Wherever they appear in this policy, the following terms have the meanings set out below, consistent with the PDPL:

• “Personal Data”: any data — whatever its source or form — that may lead to identifying an individual specifically, or that makes it possible to identify them directly or indirectly.
• “Sensitive Data”: data revealing racial or tribal origin, religious, intellectual, or political belief, security and criminal data, biometric and genetic data, health and credit data. In our context this includes the facial measurements used for identity verification.
• “Controller”: the entity that determines the purpose and manner of processing personal data.
• “Processor”: the entity that processes personal data for and on behalf of the Controller.
• “Processing”: any operation performed on personal data by any means, such as collection, recording, storage, alteration, use, disclosure, transfer, and destruction.
• “Data Subject”: the individual to whom the personal data relates.

3. Our Role: Controller and Processor

Our legal role depends on the type of data:

• As a Processor: when an organization subscribes and enters its employees’ data, the organization is the Controller that determines the purposes and means of processing, and we process that data on its behalf, per its documented instructions and under a data processing agreement.
• As a Controller: for customer account data, business communications, marketing, and website browsing data, we determine the purposes and means of processing.

In all cases we observe the statutory processing principles: lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and accountability.

4. Data We Collect & Its Sources

Depending on how you use the Service, we may collect:

• Account & contact data: name, email, mobile number, organization name, and job title.
• Employee data entered by the organization: name, national ID / iqama number, nationality, date of birth, contact and emergency details, contract and job data, salaries, allowances and entitlements, and GOSI/payroll data.
• Attendance & location data: clock-in/out and biometric punch records, and geolocation when attendance is verified (geofencing), where enabled by the organization.
• Biometric (sensitive) data: facial measurements used to verify identity at clock-in, where the organization enables this feature. Such data is processed under strict controls and only as needed for verification, and is not used for any other purpose.
• Usage & technical data: IP address, device and browser type, and login/activity logs for security and improvement.

Sources: we collect data directly from you or your organization, automatically as you use the Service, or through integrated systems and devices (such as biometric devices and payment gateways) as needed to operate the Service.

We do not seek to collect more sensitive data than the Service requires. The organization is responsible for the lawfulness of the employee data it enters and for obtaining any required consents.

5. Purposes & Legal Basis

We process data for the following purposes:

• Providing and operating the Service: managing accounts, attendance, payroll, leave, recruitment, and reporting.
• Legal compliance: enabling organizations to meet their obligations under the Labor Law, GOSI, and Wage Protection.
• Security & fraud prevention: protecting accounts and detecting unauthorized use.
• Communication & support: responding to inquiries, providing technical support, and sending operational notifications.
• Improvement & development: analyzing performance and developing features (using aggregated or anonymized data where possible).
• Marketing: sending marketing content with your consent, with the ability to unsubscribe at any time.

Our processing relies on the legal bases set out in the PDPL, including: performance of a contract to which the data subject is a party, a legal obligation imposed on us, consent, and legitimate interest without prejudice to the rights and fundamental freedoms of the data subject.

Sensitive data — including biometric data for facial verification — is processed only on the basis of explicit consent or another basis that expressly permits it, and after applying the necessary safeguards.

6. Automated Decisions & Analytics

We do not make decisions producing a legal effect on you based solely on automated processing without human involvement. The analytics, dashboards, and indicators the Service provides (such as attendance, violations, and entitlement calculations) are assistive tools; actions taken on them remain subject to the organization’s decision and review.

7. Cookies

We use cookies and similar technologies to operate the site, remember your preferences (such as language), and measure performance. Some are essential for the Service, and you can control non-essential ones through your browser settings. Disabling some may affect certain site functions.

8. Sharing & Sub-Processors

We do not sell or trade your personal data. We may share it only within the following limits:

• Service providers (sub-processors): cloud hosting and infrastructure, messaging, and payment providers, under contractual data-protection obligations no lower than the level set in this policy, and only as needed to provide the Service.
• Government and competent authorities: upon a legal request, court order, or obligation imposed by the laws of the Kingdom.
• Mergers or acquisitions: while preserving the same level of protection and notifying as required.

Organization employee data remains owned by the organization, is not shared with other organizations, and full isolation is applied to each customer’s data. A customer may request a list of material sub-processors by contacting us.

9. Cross-Border Transfers

We aim to host and process data within the Kingdom of Saudi Arabia where possible. If any data must be transferred to or accessed from outside the Kingdom, this is done in accordance with the PDPL and the Data Transfer Regulations — including verifying an adequate level of protection, conducting a transfer impact assessment where appropriate, and applying adequate safeguards — and without prejudice to national security or the Kingdom’s vital interests.

10. Data Retention

We retain data for as long as needed to fulfill the processing purposes or to meet legal obligations (such as labor, accounting, and wage-protection laws), whichever is longer. Upon termination of a subscription, the organization may request export of its data; we then delete, destroy, or anonymize it within a reasonable period, unless we are legally required to retain it or it is needed to establish a right in an active claim.

11. Data Security & Breach Notification

We apply technical and organizational controls to protect data, including encryption of sensitive data, role- and department-based access controls, full isolation of each customer’s data, login/activity logging, and security monitoring. While no system is perfectly secure, we continuously strengthen our protections.

In the event of a breach, destruction, or unauthorized access affecting personal data, we take the necessary measures to contain it, notify the Saudi Data & AI Authority within 72 hours of becoming aware of it per the prescribed controls, and notify affected data subjects without undue delay where the incident is likely to cause them harm.

12. Your Rights as a Data Subject

The PDPL grants you the following rights:

• Right to be informed: of the legal basis and purpose of collecting and processing your data.
• Right to access and obtain a copy: to view your data and obtain a copy in a clear, readable format.
• Right to correction: to request correction, updating, or completion of your data.
• Right to destruction: to request destruction of your data when no longer needed, subject to the cases in which the law permits its retention.
• Right to withdraw consent: where processing is based on it, without affecting the lawfulness of processing prior to withdrawal.

If you are an employee of a subscribing organization, these rights are usually exercised through your organization as the controller of your data; you may also contact us and we will route your request appropriately. We respond to requests within the statutory period.

13. Direct Marketing

We send marketing or promotional material only after obtaining your consent where the law requires it. You may withdraw consent and unsubscribe at any time via the opt-out mechanism in each message or by contacting us, after which we will not use your data for this purpose.

14. Data Protection Officer & Complaints

We have designated a contact responsible for personal data protection, whom you may email regarding any inquiry or request relating to this policy at: sales@barez.sa.

If you believe the processing of your data violates the law, you have the right — after contacting us — to lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the competent authority.

15. Children’s Privacy

The Service is intended for use by organizations and their employees, is not directed at children, and we do not knowingly collect their data. If we learn that a minor’s data was collected without a lawful basis, we take the necessary steps to delete it.

16. Governing Language & Changes

We may update this policy from time to time and will post the updated version on this page with a revised “Last updated” date. Your continued use of the Service after posting constitutes acknowledgment of the changes.

This policy is issued in Arabic and English; in case of any discrepancy in interpretation, the Arabic text prevails.

17. Contact Us

For any inquiry or request regarding your privacy or the exercise of your rights, you can email us at sales@barez.sa, and we will respond within the statutory period.