1. Roles of Tawajud and the Establishment

The Establishment is responsible for lawfully collecting and using its employees' data and for notifying them accordingly. Tawajud's responsibility is limited to processing the data under the Establishment's instructions, unless those instructions are manifestly unlawful.

Tawajud acts as controller for data relating to account creation, billing, security, support, and compliance for its Service. Each party remains responsible for its own legal obligations.

3. Sources of Data

We obtain data from the user; from the Establishment when it creates and manages an employee profile; from the device when a function requiring location is used; or from payment, messaging, and notification providers to confirm Service status.

4. Why We Use Data

• To create accounts and operate attendance and human-resources services.
• To provide subscriptions, issue bills, and settle payment transactions.
• To protect accounts, prevent manipulation and fraud, and investigate incidents.
• To send operational notifications, provide support, and improve performance.
• To meet legal requirements and establish or protect rights.

5. Location and Biometrics

Location is requested when an attendance or field-work action requires it, according to the Establishment's settings and the device's permissions. Coordinates, accuracy, distance from the workplace, and mock-location indicators may be recorded.

Face ID and fingerprint verification are processed locally by the device operating system. Tawajud does not receive a biometric template or facial image, only the successful or unsuccessful verification result required to perform the action.

6. Sharing Data

Data may be accessed by the Establishment's administrators according to their permissions, by authorized Tawajud teams to the minimum extent necessary, by service providers, and by public authorities where there is a legal obligation or valid lawful request. Tawajud does not sell personal data.

Tawajud may engage technical service providers to operate the Service and requires them to protect the data and use it only for the specified purposes.

8. Retention and Security

The Establishment must retain independent copies and export what it needs before the subscription ends. Tawajud does not guarantee that data will remain available after the account is closed or the subscription term ends. We retain data for as long as needed to provide the Service, carry out instructions, meet legal obligations, and protect rights, after which we delete or de-identify it when the purpose has ended and retention is no longer required.

We use role-based access controls, logical separation between Establishments, session and device management, audit logs, and appropriate safeguards for sensitive data. Tawajud takes appropriate measures to protect data but does not guarantee that all cyber risks can be prevented.

9. Your Rights

Data subjects have the rights provided by law, including the rights to access their data, obtain a copy, and request its correction or deletion. Requests concerning employee, attendance, or payroll data must be submitted to the employer. Tawajud verifies identity before fulfilling any request for which it is responsible.

10. Notifications and Marketing

We send notifications necessary for accounts, attendance, requests, and security. Marketing messages may be disabled without affecting the core Service. Workers' data is not used for behavioral advertising.

11. Policy Updates

This Policy may be updated when the Service or legal requirements change. The effective date will be displayed, and users will be notified of material changes. The Arabic version shall prevail in the event of any conflict with a translation.