Privacy Policy

1. Scope

This policy applies to personal data we process when you visit our website, create an account, or use the WorkIn platform. Where a customer organization uses WorkIn to manage its own employees, that organization is the controller of its employees’ data and WorkIn acts as a processor on its behalf, under the customer’s instructions and our agreement with them.

2. Data we collect

• Account data — name, work email, password (stored only in hashed form), company, and role.
• Company and HR data — information that a customer chooses to enter, such as employees, departments, documents, leave and requests, payroll inputs, and compliance details (for example, contract or Iqama expiry dates).
• Usage and device data — log data such as actions taken in the app, timestamps, IP address, and browser type, used to operate and secure the service.
• Communications — messages you send us, including demo requests and support enquiries.

We do not knowingly collect more personal data than is needed to provide the service.

3. How we use data

• To provide, maintain, and improve the platform and its features.
• To authenticate users, secure accounts, and prevent abuse.
• To provide customer support and respond to enquiries.
• To send service-related communications (for example, invitations, notifications, and important account notices).
• To meet legal and regulatory obligations.

We do not sell personal data.

4. Legal basis and PDPL

We process personal data on the bases permitted under the PDPL, which may include performance of a contract, our legitimate business interests (balanced against your rights), compliance with a legal obligation, and your consent where required. Where we rely on consent, you may withdraw it at any time.

5. Data protection and security

We apply technical and organizational measures designed to protect personal data, including encryption of data in transit (TLS) and at rest, strict logical separation of each customer’s data (multi-tenant isolation enforced at the database level), role-based access controls, and optional two-factor authentication for accounts. Further detail is available in our Security Overview.

6. Data storage, retention, and transfers

We host the platform with reputable cloud infrastructure providers and retain personal data for as long as needed to provide the service or as required by law. Where personal data is transferred or processed outside the Kingdom of Saudi Arabia, we apply appropriate safeguards consistent with the PDPL’s requirements for cross-border transfers. Customers may request deletion of their data in accordance with their agreement with us and applicable law.

7. Your rights

Subject to the PDPL and applicable law, you may have the right to access your personal data, request correction of inaccurate data, request deletion, object to or restrict certain processing, and withdraw consent. If you are an employee of a customer organization, please direct requests to your employer, who controls that data; we will support them in responding. To exercise your rights with WorkIn directly, contact us using the details below.

8. Your responsibilities

• Provide accurate information and keep your account credentials confidential.
• Only upload or enter personal data you are authorized to process, and inform your own staff as required by law.
• Use the platform lawfully and in line with our Terms of Service.

9. Service availability

We work to keep WorkIn available and reliable, but the service is provided without a guarantee of uninterrupted availability. Planned maintenance and factors outside our reasonable control may affect access. Availability commitments, where offered, are set out in the applicable agreement.

10. Contact

For privacy questions or to exercise your rights, contact our privacy team at privacy@getworkin.net.