Privacy Policy

Effective Date: 25 June 2026
Last Updated: 25 June 2026

IBTEKAR HOUSE COMPANY (“IBTEKAR HOUSE,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how information is collected, used, stored, disclosed, and protected when you use the IBTEKAR HOUSE Employee Self-Service and Human Resources Management application, associated web portal, and related services collectively referred to as the “Service.”

The Service is intended for employees, managers, human resources personnel, administrators, and other authorized users of organizations that use the IBTEKAR HOUSE HRM and Employee Self-Service solution.

By accessing or using the Service, you acknowledge the practices described in this Privacy Policy.

1. Who Controls Your Personal Data

IBTEKAR HOUSE provides the technical platform used to operate the Service.

In many cases, the organization that employs you or has provided your account determines why and how your employment-related personal data is processed. That organization may therefore act as the primary data controller, while IBTEKAR HOUSE processes information on its behalf as a technology and service provider.

Questions relating to your employment records, attendance, salary, leave, loans, approvals, or other HR information should normally be directed first to your employer or HR department.

You may also contact IBTEKAR HOUSE using the contact details provided at the end of this Privacy Policy.

2. Information We Collect

The information collected depends on the features enabled by your organization and your assigned user role.

2.1 Account and Identity Information

We may process:

• Employee number or internal employee ID
• First name, middle name, and last name
• Username and business email address
• Mobile or contact number
• Profile photograph
• Department, section, location, and job title
• Employment status and employment-related information
• Manager name, manager ID, and reporting relationship
• User role, access rights, and permissions
• Authentication and session information

Most employee accounts are created or provided by the employer or its authorized administrator. Users generally do not create independent public accounts through the application.

2.2 Attendance and Working-Time Information

When attendance functionality is enabled, we may process:

• Check-in date and time
• Check-out date and time
• Working duration
• Break start and end times
• Attendance status
• Attendance method
• Work location
• Time zone
• Attendance history
• Related approval or correction information

2.3 Location Information

When your organization enables location-based attendance, the application may request access to your device location when you perform an attendance action such as check-in or check-out.

Location information may be used to:

• Determine whether you are within an authorized work-location radius
• Validate attendance transactions
• Prevent unauthorized or inaccurate attendance submissions
• Record the location associated with an attendance action
• Support attendance review and dispute resolution

The application is not intended to continuously monitor your location. Location is accessed only when required for an enabled, user-initiated attendance function, subject to the permissions and technical configuration of your device.

You may deny location access through your device settings. However, location-dependent attendance functions may then be unavailable.

2.4 Human Resources and Employment Information

Depending on the modules enabled by your organization, we may process:

• Employee profile information
• Department and job information
• Employment status
• Work schedule and working-hours policy
• Leave balances and leave requests
• Leave dates, types, reasons, and approval status
• Loan requests and loan-related information
• Approved loan amounts, repayment periods, installments, and balances
• Employee requests, forms, notes, and supporting information
• Manager approvals and rejection reasons
• Payroll type
• Salary information and salary-line details
• Active-loan summaries
• Team and reporting-line information
• Other employment-related records entered by the employer or authorized users

The application does not independently determine employment, payroll, leave, or loan decisions. These decisions are made by the relevant employer and its authorized personnel.

2.5 Photographs, Camera, and Files

The Service may allow an authorized user to upload or update an employee profile photograph.

Where enabled, the application may request access to:

• The device camera
• The photo library
• Selected files or documents

These permissions are used only when the user chooses to capture or upload permitted content. The application does not access unrelated photographs or files without user action and permission.

2.6 Requests and Communications

We may process information submitted through:

• Leave requests
• Loan requests
• General employee request forms
• Approval or rejection actions
• Notes and comments
• Support inquiries
• Feedback or error reports
• Emails or communications sent to us

Users should avoid entering unnecessary sensitive personal information in free-text fields.

2.7 Device and Technical Information

When you use the Service, certain technical information may be processed automatically, including:

• Device type and operating system
• Application version
• Browser type for the web portal
• Internet Protocol address
• Login date and time
• Authentication and session events
• Error logs and diagnostic information
• Security and access logs
• API request and response status information

This information is used to operate, secure, troubleshoot, and improve the Service.

3. How We Use Personal Data

We may use personal data to:

• Authenticate users and maintain secure sessions
• Provide access based on employee, manager, HR, or administrator roles
• Display employee profiles and employment information
• Record and manage attendance
• Validate location-based check-in and check-out
• Calculate or display working hours and attendance summaries
• Submit, review, approve, reject, or cancel employee requests
• Display leave, loan, salary, and payroll-related information
• Support manager and HR workflows
• Display team-member information to authorized managers
• Synchronize information with the employer’s authorized business systems
• Provide technical support and respond to inquiries
• Detect fraud, misuse, unauthorized access, or security incidents
• Maintain audit, activity, and operational records
• Comply with contractual, employment, accounting, tax, regulatory, and legal obligations
• Protect the rights, systems, and property of IBTEKAR HOUSE, its customers, and users
• Improve the reliability, performance, and usability of the Service

We do not use employee personal data for third-party advertising, behavioural advertising, or cross-app advertising tracking.

4. Legal Basis for Processing

Depending on the applicable law and circumstances, personal data may be processed on one or more of the following bases:

• Performance of an employment or service-related arrangement
• Performance of a contract with the customer organization
• Compliance with legal or regulatory obligations
• The legitimate interests of the employer or IBTEKAR HOUSE in operating and securing the Service
• Consent, where consent is legally required
• Protection of legal rights and prevention of fraud or misuse
• Other lawful grounds permitted under applicable data-protection law

Where processing is performed on behalf of your employer, the employer is responsible for determining the appropriate legal basis and providing any required employee notices.

5. How Personal Data Is Shared

Personal data may be disclosed only where reasonably necessary to operate the Service or comply with legal obligations.

It may be shared with:

5.1 Your Employer

Information may be available to authorized representatives of your employer, including:

• Human resources personnel
• Payroll personnel
• Managers and supervisors
• System administrators
• Finance personnel, where relevant
• Other personnel authorized according to their business role

Access is intended to be restricted according to assigned permissions.

5.2 Technology and Service Providers

We may use authorized service providers to provide:

• Cloud hosting
• Database and application infrastructure
• Authentication and security
• Email or notification delivery
• Technical support
• Backup, monitoring, and diagnostic services
• Business-system integration

Such providers may process information only as necessary to provide their contracted services and are expected to apply appropriate confidentiality and security safeguards.

5.3 Legal and Regulatory Disclosure

Information may be disclosed where reasonably necessary to:

• Comply with applicable laws, regulations, court orders, or lawful government requests
• Protect the rights and safety of users, customers, IBTEKAR HOUSE, or others
• Investigate fraud, misuse, security incidents, or unlawful activity
• Establish, exercise, or defend legal claims

5.4 Corporate Transactions

If IBTEKAR HOUSE undergoes a merger, acquisition, reorganization, or transfer of business assets, relevant information may be transferred subject to applicable legal protections.

We do not sell employee personal data.

6. International Data Transfers

The Service may use cloud infrastructure or technical service providers that process or store information in locations outside the country in which the user is located.

Where personal data is transferred across borders, IBTEKAR HOUSE and the relevant customer organization will take reasonable steps to ensure that the transfer is performed in accordance with applicable data-protection laws and appropriate contractual, organizational, and technical safeguards.

7. Data Retention

Personal data is retained only for as long as reasonably necessary for:

• Employment and HR administration
• Attendance, payroll, leave, loan, and request management
• The duration of the customer’s use of the Service
• Contractual and operational requirements
• Legal, tax, accounting, audit, and regulatory obligations
• Security investigations and dispute resolution
• Establishing, exercising, or defending legal claims

Retention periods may be determined by the employer, applicable laws, and the type of record involved.

When information is no longer required, it may be deleted, anonymized, or securely archived in accordance with applicable requirements.

8. Data Security

We use reasonable administrative, technical, and organizational measures intended to protect personal data, including where appropriate:

• User authentication
• Role-based access controls
• Secure communication channels
• Restricted administrative access
• Session and access management
• Security and activity logging
• System monitoring
• Backup and recovery measures
• Employee and service-provider confidentiality requirements

No system or method of electronic transmission is completely secure. We therefore cannot guarantee absolute security, but we work to reduce the risk of unauthorized access, loss, misuse, alteration, or disclosure.

Users are responsible for:

• Keeping passwords and verification codes confidential
• Not sharing accounts with unauthorized persons
• Using secure devices and networks
• Signing out of shared devices
• Reporting suspected unauthorized access promptly

9. User Rights and Privacy Choices

Subject to applicable law, you may have the right to:

• Be informed about the processing of your personal data
• Request access to your personal data
• Request correction of inaccurate or incomplete information
• Request deletion or destruction of information where legally permitted
• Request restriction of certain processing
• Object to certain uses of your information
• Withdraw consent where processing is based on consent
• Request a copy of certain personal data
• Submit a complaint to the relevant organization or regulatory authority

Because employment records are generally controlled by your employer, requests concerning employee records should first be submitted to your employer’s HR or privacy contact.

Some information may not be deleted immediately where retention is required by employment, payroll, tax, accounting, regulatory, contractual, security, or legal obligations.

10. Account Deactivation and Deletion Requests

Accounts are normally created and managed by the user’s employer.

To request account deactivation or deletion:

1. Contact your employer’s HR department or authorized system administrator; or
2. Email IBTEKAR HOUSE at info@ibtekarhouse.com.

Please include:

• Your full name
• Employee number, where applicable
• Employer or organization name
• The email address associated with the account
• A clear description of your request

We may need to verify your identity before processing a request.

Where IBTEKAR HOUSE processes data only on behalf of your employer, we may forward the request to the employer for authorization and handling.

Deletion requests remain subject to legal and legitimate retention requirements.

11. Device Permissions

The application may request the following device permissions depending on enabled features:

Location

Used for authorized location-based attendance and work-location validation.

Camera

Used when a user chooses to capture a permitted profile image or supporting image.

Photos or Media

Used when a user chooses to select and upload an image or permitted file.

Notifications

Used to provide relevant service, request, approval, attendance, or account notifications where implemented and enabled.

Users may manage permissions through their device settings. Disabling a permission may limit related functionality.

12. Automated Decision-Making

The Service may automatically perform calculations or validations, such as:

• Determining whether an attendance action is within an authorized radius
• Calculating working duration
• Displaying balances, totals, or request statuses
• Applying configured role and permission rules

The Service is not intended to make independent final decisions regarding employment, termination, salary, disciplinary action, leave approval, or loan approval. Such decisions remain the responsibility of the employer and its authorized representatives.

13. Children’s Privacy

The Service is a workplace and business application and is not designed for children.

We do not knowingly provide the Service directly to children or knowingly collect children’s personal data for consumer purposes.

14. Third-Party Links and Services

The Service may contain links to external websites or services that are not controlled by IBTEKAR HOUSE.

We are not responsible for the privacy practices, security, or content of third-party services. Users should review the privacy policies of those services separately.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to the Service
• New features or integrations
• Changes to data-processing practices
• Legal or regulatory requirements
• Security or operational improvements

The updated version will be posted on this page with a revised “Last Updated” date.

Where required, users or customer organizations may also be notified through the application, email, or another appropriate channel.

16. Contact Us

For questions, privacy requests, complaints, or concerns regarding this Privacy Policy or the Service, contact:

IBTEKAR HOUSE COMPANY
Building No. 7884, Othman Ibn Afaan Branch Road
Al Taawun District
Riyadh 12478
Kingdom of Saudi Arabia

Email: info@ibtekarhouse.com
Website: https://ibtekarhouse.com

When contacting us about an employee record, please identify your employer and provide sufficient information for us to locate and verify the relevant account.

17. Saudi Arabia Data Protection

Where the Saudi Personal Data Protection Law applies, personal data will be processed in accordance with applicable requirements of the Kingdom of Saudi Arabia, including principles relating to lawful processing, transparency, purpose limitation, data minimization, accuracy, security, retention, and data-subject rights.

Users may also have the right to raise concerns with the competent data-protection authority in the Kingdom of Saudi Arabia, subject to the procedures and conditions established by applicable law.