Privacy Policy

AqlHR ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our HR management platform and services.

We comply with the Saudi Arabia Personal Data Protection Law (PDPL) and other applicable data protection regulations. By using AqlHR, you consent to the data practices described in this policy.

تلتزم عقل للموارد البشرية بحماية خصوصيتك وبياناتك الشخصية. توضح سياسة الخصوصية هذه كيفية جمع واستخدام والإفصاح عن معلوماتك وحمايتها عند استخدام منصتنا لإدارة الموارد البشرية.

Personal Information

• Account Information: Name, email address, phone number, company name, job title
• Employee Data: Names, national ID/Iqama numbers, GOSI numbers, salary information, employment history
• Authentication Data: Login credentials, session tokens, access logs
• Communication Data: Messages, support tickets, feedback submissions

Automatically Collected Information

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent, click patterns
• Cookies: Session cookies, preference cookies, analytics cookies

Sensitive Personal Data

We may process sensitive personal data including national identification numbers, health information (for medical leave), and financial information (for payroll). This data is processed only with your explicit consent and in compliance with PDPL requirements.

We use your information for the following purposes:

• Service Delivery: To provide HR management services, process payroll, manage leave requests, and generate compliance reports
• Legal Compliance: To comply with Saudi Labor Law, HRSD regulations, GOSI requirements, and other legal obligations
• Communication: To send service notifications, compliance alerts, and respond to inquiries
• Improvement: To analyze usage patterns and improve our platform features
• Security: To detect and prevent fraud, unauthorized access, and security incidents
• AI Processing: To provide AI-powered HR assistance and document generation

Data Residency

All personal data is stored on servers located within the Kingdom of Saudi Arabia or in jurisdictions that provide adequate data protection as recognized by Saudi authorities. We do not transfer your data outside of approved jurisdictions without your explicit consent.

Security Measures

• Encryption: All data is encrypted at rest using AES-256 and in transit using TLS 1.3
• Access Control: Role-based access control (RBAC) limits data access to authorized personnel
• Audit Logging: All data access and modifications are logged with SHA-256 cryptographic proof
• Regular Audits: We conduct regular security assessments and penetration testing
• Incident Response: We maintain a comprehensive incident response plan

Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Employee records are retained for a minimum of 10 years as required by Saudi Labor Law. You may request deletion of your data subject to legal retention requirements.

Under the Saudi Personal Data Protection Law, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal requirements)
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your data for certain purposes
• Right to Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, please contact our Data Protection Officer at [email protected].

We may share your data with:

• Government Authorities: HRSD, GOSI, Qiwa, Mudad, and other regulatory bodies as required by law
• Service Providers: Cloud hosting, payment processors, and analytics providers who are contractually bound to protect your data
• Your Employer: If you are an employee user, your employer has access to your employment data
• Legal Requirements: When required by law, court order, or to protect our legal rights

We do not sell your personal data to third parties. We do not share your data for marketing purposes without your explicit consent.

We use the following types of cookies:

• Essential Cookies: Required for platform functionality and security
• Preference Cookies: Remember your language and display preferences
• Analytics Cookies: Help us understand how you use our platform

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect platform functionality.