Privacy policy

This policy explains how Sahl handles the personal data it processes as a controller, that is, the data for which Sahl itself decides the purposes and means of processing. This is the data of visitors to our website, of people who sign up for a trial or a subscription, of people who write to us, and of the billing and contact persons at our customers.

In this processing we comply with the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H and its amendments, its Implementing Regulations, and the regulations and rules issued under it, together called "the Law" in this policy. Terms in this policy have the meanings given to them in the Law. The Arabic text of this policy is the original and prevails over the English.

1. Who we are

The Sahl service is provided by [the company's legal name], an entity registered in the Kingdom of Saudi Arabia under commercial registration No. [the commercial registration number], with its national address at [the national address]. Wherever this policy says "Sahl", "we" or "us", it means [the company's legal name].

Sahl is a cloud HR service provided to companies over the internet. Sahl is the controller of the data described in this policy.

To contact us about anything related to personal data:

• Email: [the email address]
• Phone and WhatsApp: [the phone number]
• National address: [the national address]

2. Scope of this policy

This policy applies to the personal data we collect through:

1. Sahl's public website and its pages.
2. The sign up form for the free trial or a subscription.
3. The contact form.
4. The payment and invoice pages.
5. Your correspondence with us by email, phone or WhatsApp.

This policy does not apply to the data inside each customer's site. That data is subject to its own rules, set out in section 3. Nor does it apply to other parties' processing of your data under their own policies, such as the payment provider when you enter your card details in its form.

3. Data of our customers' employees and candidates

Each Sahl customer gets its own separate site and its own separate database. No customer's data is shared with another customer's database. In its site, the customer enters the data of its employees, former employees, job candidates, employees' family members and its own users.

For this data, the customer, that is, the employing company, is the controller. The customer decides what data is collected, for what purpose, how long it is kept, and which of its staff can see it. Sahl is a processor that processes this data on the customer's behalf and only on its instructions. This processing is governed by the Data processing agreement between Sahl and the customer, not by this policy.

As a result:

1. If you are an employee of one of our customers or a candidate for a job with one, and you have a question or a request about your data, please go first to your employer, because it is responsible for answering it.
2. If a request about this data reaches us, we pass it to the customer concerned and help the customer answer it with our export and correction tools.
3. Sahl does not use this data for its own purposes, does not sell it, and does not share it with another customer.

4. The data we collect and where it comes from

We collect the following categories of personal data:

1. Sign up data: company name, commercial registration number, country, number of employees, and the contact person's name, email and mobile number.
2. Contact form data: name, company name, email, phone number and the text of the message.
3. Billing and payment data: invoices, payments and their dates, the last four digits of the card, and the token Moyasar issues to represent the card. Sahl never sees or stores the full card number, because the card is entered in Moyasar's own form. For payment by bank transfer, we record the transfer details needed to prove it.
4. Correspondence and support data: what you write to us by email or WhatsApp, and our replies.
5. Technical data: data the server records automatically when the site is visited, such as the IP address, the time of the request and the browser type.
6. Cookies: the language cookie and session cookies only, as set out in section 6.

We count the active employees in each customer's site every day in order to issue its invoice. This count is a total number and contains no personal data.

We obtain this data from the following sources:

1. From you directly, when you fill in our forms or write to us.
2. From your company, when it names you as a contact or billing person.
3. From Moyasar when a payment is completed, limited to the result of the transaction, the token and the last four digits of the card.
4. From your browser automatically, limited to the technical data and the cookies described.

We do not buy personal data, and we do not collect it from social networks or public sources. We do not ask for any sensitive data through the website, and we ask you not to include any in your messages to us.

5. Purposes of processing and legal basis

We process the data for the following purposes, each with a legal basis permitted by the Law:

Where we rely on legitimate interest, we weigh it against your rights and interests, and we never rely on it to process sensitive data. You may object to this processing by writing to us, and we will consider your objection under the Law.

We send you marketing messages only with your consent. You may withdraw your consent at any time by writing to us or by using the link in the message. Withdrawal does not affect the lawfulness of processing carried out before it.

We do not use data for a purpose that is incompatible with the purpose for which it was collected. If we need a new purpose, we will inform you before the processing and ask for your consent where the Law requires it.

6. Cookies

Cookies are small files stored by the browser. The Sahl website uses only two kinds:

1. The language cookie: remembers your choice between Arabic and English so the site is shown in it when you return.
2. Session cookies: keep you signed in while you use the account and payment pages, and protect forms against forged requests. They end when the session ends or when you sign out.

Both kinds are necessary for the site to work. They are not used to track you or to build a profile of you.

We use no cookies for advertising or tracking. We use no website analytics service. The site's fonts are served by the site itself, so your browser does not connect to another party's servers to load them.

You can delete or block cookies in your browser settings. If you block session cookies, you will not be able to sign in or pay. When you pay by card, Moyasar's form is shown, and it may use its own cookies for payment and fraud prevention under its own policy.

7. Disclosure and sharing of data

We do not sell, rent or trade personal data, and we do not share it for advertising. We disclose it only to the following, and only as far as necessary:

1. Moyasar: to process subscription payments by card. Moyasar receives the card details from you directly in its form, and operates in Saudi Arabia.
2. The hosting provider: Frappe Technologies through its Frappe Cloud service, on servers in Oracle's data centre in Jeddah. It processes the data only to run the site, its database and its backups.
3. Competent judicial and government authorities: when a law or a court decision requires us to disclose, and only as far as required.

These parties process the data we provide to them only for the purpose for which it was provided.

8. Where data is stored and transfers outside the Kingdom

We store the data described in this policy on servers in Jeddah, Saudi Arabia, in Oracle Cloud's Jeddah region on which the Frappe Cloud service runs. Backups are also kept in the Kingdom.

We do not transfer this data outside the Kingdom. The exceptions are the channels you choose when you contact us:

1. If you write to us on WhatsApp, your message passes through the WhatsApp service of Meta, is subject to its terms, and may be processed outside the Kingdom. If you do not want this, please write to us by email.
2. If you write to us from an email account provided by a provider outside the Kingdom, your message passes through that provider's servers.

If we ever need to transfer data outside the Kingdom, we will do so only in accordance with the Law and the Regulation on Personal Data Transfer outside the Kingdom, and after updating this policy.

9. How long we keep data

We keep data no longer than needed for the purpose for which it was collected, or for the period the Law requires. In detail:

1. Unconfirmed sign ups: if a sign up is not confirmed, its data is deleted after 7 days.
2. Customer and contact person data: kept for the term of the subscription, then for the period needed to close the account and settle what relates to it.
3. Billing records: invoices and payments are kept for the period required by the commercial, accounting and tax laws of the Kingdom.
4. Contact form messages: kept in Sahl's customer management system built on ERPNext, as leads, for as long as they are needed to follow up your inquiry and any business relationship that results from it. You may ask us to delete them at any time.
5. Technical data: kept for a limited period, as far as needed to protect the site.

When a retention period ends, we destroy the data or make it impossible to link to you, unless the Law requires us to keep it longer.

10. Data security

We take appropriate organisational and technical measures to protect data against unauthorised access, alteration, disclosure and loss. These include:

1. Encrypted connections on every page of the site using HTTPS.
2. Passwords stored hashed, in a form that cannot be read.
3. Secret keys stored encrypted and never shown again after they are entered.
4. Access limited to the Sahl staff who need it, who are bound by confidentiality.
5. Automated daily backups kept in the Kingdom.
6. Card data left with Moyasar and never stored by us.

No electronic system is absolutely secure. If a personal data breach affects your data, we will take the steps the Law requires, including notifying the Saudi Data and Artificial Intelligence Authority (SDAIA) and notifying you where required. For more details, see the Security page.

11. Your rights

As a data subject, the Law gives you the following rights:

1. The right to be informed: to know the legal basis and purpose for collecting your data, which this policy sets out.
2. The right of access: to see your data that we hold, and to obtain a copy of it in a clear and readable format.
3. The right to correction: to ask for your data to be corrected, completed or updated.
4. The right to destruction: to ask for your data to be destroyed when it is no longer needed, unless the Law requires us to keep it.
5. The right to withdraw consent: to withdraw your consent at any time where consent is the basis for the processing.

These rights may be subject to limits set out in the Law, such as our duty to keep billing records for the legal period. If we cannot carry out your request in full or in part, we will tell you why.

12. How to exercise your rights

To exercise any of your rights, write to us at [the email address], stating the right you are exercising and the data it relates to. Your request is handled as follows:

1. We may ask you for proof of identity before acting on the request, to protect your data from requests made by someone else.
2. We answer your request within 30 days of receiving it complete.
3. We charge nothing for the request.
4. If we refuse the request in full or in part, we tell you why.

If your request concerns your data as an employee or candidate of one of our customers, please send it to your employer, as set out in section 3.

13. Complaints to the Saudi Data and Artificial Intelligence Authority

If you believe that our processing of your data breaches the Law, you have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), following the procedures the Authority sets. We welcome hearing from you first so we can address your concern, but this is not a condition for filing a complaint.

14. Children

Sahl is a service for companies and is not directed at children. We do not knowingly collect any data through the website from a person under 18. If we learn that we have collected a child's data by mistake, we destroy it.

The data of employees' family members, including children, that a customer enters in its site is customer data, governed by section 3 and the Data processing agreement.

15. Changes to this policy

We may update this policy when our services or the law change. The date of the latest update is shown at the top of this page. If a change is material, we will notify customers by email before it takes effect and publish the updated policy on this page. We recommend that you review this page from time to time.

16. Contact us

For any question about this policy or your personal data, contact [the company's legal name]:

• Email: [the email address]
• Phone and WhatsApp: [the phone number]
• National address: [the national address]

We answer messages from Sunday to Thursday, 9:00 to 17:00 Riyadh time, except official holidays in Saudi Arabia. Requests to exercise your rights are subject to the answer period in section 12. For the terms of the service, see the Terms and conditions page.

This English text is a translation. The Arabic text prevails. العربية