Privacy Policy

1. Controller and contact details

The data controller for this application is Arak Alnukhba Aljadida, Kingdom of Saudi Arabia. Privacy-related questions, requests, or complaints may be sent to: info@arakalnukhba.com.sa.

2. Scope of this policy

This policy applies to personal data processed through the Arak Time Attendance mobile application and related attendance systems, including mobile activation, device binding, account authentication, check-in, check-out, attendance history, audit records, and location-based attendance verification.

3. Legal basis and processing purposes

We process personal data for lawful, legitimate, operational, administrative, contractual, security, audit, and compliance purposes, including attendance management, workforce administration, prevention of misuse, verification of authorized work locations, and compliance with applicable laws and internal policies in the Kingdom of Saudi Arabia.

4. Personal data we may process

The application may process the following categories of personal data:

• Employee or user identification information, such as name, employee number, company, project, and attendance account details.
• Mobile attendance activation status, one-time activation code status, and device binding information.
• Check-in, check-out, attendance status, attendance history, and related timestamps.
• Location data submitted during attendance actions, where location verification is required.
• GPS accuracy, fake-location indicators, device integrity signals, and technical validation data used to prevent misuse.
• Device, session, access token, refresh token, and security event information required for authentication and protection.
• Administrative and audit records required to operate, review, secure, or troubleshoot the service.

5. Location data

The application may request and process location data only when the user performs a check-in, check-out, or attendance-related action that requires location verification. Location data is used to verify whether the attendance action occurred within an approved site, branch, project, or assigned attendance area.

The application is not designed or intended for continuous live tracking. It does not aim to monitor the user's location outside attendance-related actions, unless a future feature is clearly disclosed and lawfully enabled.

6. Biometrics and device authentication

The application may allow the user to unlock the app using device-level biometric authentication, such as fingerprint or face unlock, where supported by the device. Biometric templates or biometric identifiers are handled by the device operating system. Arak Time Attendance does not collect, receive, transmit, or store biometric templates.

The application may also use a mobile password, device binding, access tokens, refresh tokens, and session controls to protect the account.

7. How we use personal data

We use personal data to:

• Activate and bind an authorized mobile device to the employee or approved user.
• Authenticate the user and protect the account from unauthorized access.
• Verify check-in and check-out requests.
• Confirm attendance actions within approved locations when required.
• Prevent account sharing, duplicate device use, fake GPS usage, tampering, abuse, or suspicious activity.
• Provide attendance history, reports, audit logs, technical support, and administrative review.
• Comply with internal policies, contractual obligations, legal requirements, audit requirements, and dispute resolution needs.

8. User responsibilities

Users are responsible for:

• Using the application only for authorized work-related purposes.
• Keeping their mobile device, password, activation code, and access credentials secure.
• Not sharing their account, device, activation code, password, or attendance access with any other person.
• Not attempting to manipulate location data, GPS settings, device identity, application behavior, network traffic, or attendance records.
• Promptly reporting lost devices, unauthorized access, incorrect attendance records, security concerns, or privacy concerns.
• Maintaining accurate device permissions and settings required for attendance verification.

9. Data sharing and authorized access

We do not sell personal data. Personal data may be accessed or disclosed only where necessary for attendance administration, workforce management, payroll or project review, security monitoring, technical support, audit, legal compliance, dispute handling, or system operation.

Access may be provided to authorized administrators, managers, technical support personnel, auditors, legal or compliance personnel, or approved service providers, subject to appropriate authorization and need-to-know controls.

10. Service providers and infrastructure

We may use hosting, connectivity, security, cloud, messaging, analytics, logging, or infrastructure providers to deliver, protect, monitor, or maintain the application and related systems. Such providers may process limited technical or operational data only as necessary to provide their services and support the security and availability of the application.

11. Data retention

Personal data may be retained for as long as necessary for attendance management, workforce administration, payroll or project records, legal compliance, audit, security monitoring, dispute resolution, and legitimate business needs.

Data will not be retained longer than necessary for the purposes described in this policy unless a longer retention period is required or permitted by applicable laws, contracts, audit requirements, legal claims, or internal policies.

12. Data subject rights

Subject to applicable laws and verification procedures, individuals may have the right to be informed about the legal basis and purpose of processing, request access to their personal data, request correction of inaccurate or incomplete data, request destruction of data where legally applicable, and obtain information about how their personal data is processed.

Requests may be submitted through the company administrator or by email at info@arakalnukhba.com.sa. We may verify the identity, authority, and eligibility of the requester before responding. Some requests may be limited, delayed, or rejected where permitted by law, necessary for legal obligations, audit requirements, security, dispute resolution, or the protection of rights.

13. Accuracy, GPS limitations, and attendance review

Attendance and location results may be affected by GPS accuracy, device settings, operating system restrictions, battery optimization, network availability, location permissions, environmental conditions, or user behavior.

The company may review, verify, correct, reject, audit, or investigate attendance records according to internal policies, contractual obligations, and applicable laws. Application records may be used as supporting evidence for attendance administration, but they may also be reviewed with other operational information where appropriate.

14. Security measures

We apply reasonable technical and organizational measures to protect personal data and application access, including authentication, device binding, access controls, secure communications, administrative permissions, logging, monitoring, session controls, and device revocation where required.

No electronic system is completely risk-free. Users must follow company security instructions and must not attempt to bypass, disable, reverse engineer, interfere with, or misuse the application or related systems.

15. Data transfer outside the Kingdom

Personal data is intended to be processed through company-approved systems. If personal data is transferred, accessed, hosted, or processed outside the Kingdom of Saudi Arabia, this will be handled in accordance with applicable legal requirements, approved safeguards, operational necessity, and data minimization principles.

16. Children

The application is not intended for children and must be used only by authorized employees, contractors, representatives, or approved users.

17. Changes to this policy

We may update this Privacy Policy when application features, legal requirements, operational requirements, security controls, or business needs change. The updated version will be published on this page with a revised update date.

18. Limitation of operational responsibility

To the extent permitted by applicable law, Arak Alnukhba Aljadida is not responsible for attendance errors or service interruptions caused by user misuse, inaccurate device settings, disabled permissions, unsupported devices, poor network coverage, GPS limitations, operating system restrictions, unauthorized modifications, fake-location tools, or circumstances outside the company's reasonable control.

Nothing in this policy limits rights or obligations that cannot be limited under applicable law.

19. Contact and complaints

For privacy questions, data subject requests, or complaints, please contact:
Arak Alnukhba Aljadida
Kingdom of Saudi Arabia
Email: info@arakalnukhba.com.sa