1. Who we are
Rakeez Solutions ("Rakeez", "we", "us") is a software company based in Riyadh, Kingdom of Saudi Arabia. We build and operate Rakeez HR, a human-resources platform for employers in the Kingdom.
For any privacy question, request or complaint, contact us at it@rakeezsolutions.sa or +966 53 649 9916.
2. What this policy covers
This policy applies to the Rakeez HR product as a whole:
- The Rakeez HR mobile application for Android (package identifier sa.rakeezsolutions.hr)
- The Rakeez HR web portal used by administrators and HR managers
- The backend services and databases that both of the above rely on
It does not cover other Rakeez products, or any third-party website or service we link to. Those have their own policies.
3. Employer as controller, Rakeez as processor
Rakeez HR is sold to employers, not to individual employees. If you are an employee using the app, your employer decides what data is entered about you, who inside the organisation may see it, and how long it is kept. Under Saudi Arabia's Personal Data Protection Law (PDPL), your employer is the data controller and Rakeez is the data processor acting on their documented instructions.
In practice this means: if you want your record corrected or deleted, the fastest route is your own HR department. We will help, but for employee records we act on the employer's instruction. Where we decide things ourselves — such as how we secure the platform — we are a controller and this policy applies directly.
4. Personal data we process
Most of this data is entered by your employer's HR or admin users during onboarding, not by you. Some of it you can view and update yourself in the app.
Identity and demographics
- First and last name, in both English and Arabic
- Date of birth, gender, marital status, nationality, and whether you are a Saudi national
- Profile photograph (optional, uploaded by you or by HR)
Government identifiers and documents
- National ID number, Iqama number and its expiry date, passport number and its expiry date, GOSI number
- Uploaded copies of identity documents: National ID, Iqama, passport, driving licence, work permit and employment contract
Contact details
- Work and personal email address, phone number
- Home address, city and country
- Emergency contact name and phone number — please note this is another person's data, which your employer collects from you
Employment record
- Employee number, department, position, subsidiary, work location and schedule
- Hire date, contract type, contract start and end dates, employment status and last working day
Financial and payroll data
- Bank name and IBAN
- Basic salary, allowances, deductions, GOSI contributions and currency
- Payslips and end-of-service (EOSB) settlement calculations
Attendance and location
- Check-in and check-out timestamps and the source of each punch
- GPS coordinates captured at the moment you check in or out — see section 6 for exactly how this works
- Distance from your assigned work location, worked minutes, late, early-out and overtime minutes
- Corrections made by HR, including the free-text reason they give
Leave and health-related data
- Leave requests with dates, type and a free-text reason you write
- Supporting documents where a leave type requires one — for sick leave this normally means a medical certificate
- Leave balances, and the number of sick days recorded on a payslip
- Because sick leave and maternity leave reveal information about health, we treat this as sensitive data and restrict who can see it
Account and security data
- Email address, username, role, and your password stored only as a bcrypt hash — never in readable form
- Session tokens, which are stored only as hashes on our servers
- Single-use QR login tokens issued by your HR team
Company assets
- Company equipment assigned to you, with assignment and return dates, condition notes and photographs of the item
5. What we deliberately do not collect
This list is as important as the one above, so we want to be specific. The Rakeez HR mobile app contains:
- No analytics or usage-tracking SDK of any kind
- No crash-reporting or diagnostics SDK
- No advertising, no advertising identifier, no ad networks
- No access to your contacts, call log or SMS messages
- No microphone or audio recording
- No biometric authentication and no biometric data
- No push-notification service — the app does not register for or receive push notifications
- No background location tracking — the app cannot see where you are when it is closed
- No social or third-party login
- No selfie, face-recognition or liveness check
Our servers also do not store your IP address, device identifier or browser user-agent against your activity.
6. Device permissions and why we ask
The Android app requests only the permissions listed below. You can refuse or later revoke any of them in your device settings.
| Permission | Why we ask | If you refuse |
|---|---|---|
| Camera | To scan the QR code that signs you in without a password, and to scan company-asset QR codes. You can also use it to take a profile photo. | You sign in with email and password instead. Nothing else is affected. |
| Location (precise and approximate) | To record where you were when you checked in or out, so your employer can verify attendance against your assigned work location. | Check-in still works. Your punch is simply recorded without coordinates. |
| Photos and media | To let you pick an existing image as your profile picture or as an asset photo. | You can still use the camera, or skip the photo entirely. |
| Storage (Android 12 and below) | To save payslip PDFs and attendance reports you choose to download. | You can share the file to another app instead of saving it. |
| Internet and network state | To communicate with our servers. The app does not work offline. | The app cannot function. |
7. How location actually works
Location is the most sensitive permission the app asks for, so here is precisely what the code does.
The app reads your location at exactly two moments: when you tap check-in, and when you tap check-out. It takes a single reading at that instant and sends the latitude and longitude with that attendance record. It does not keep a copy on your device.
The app never requests background-location permission and never registers a background location task or geofence monitor. When the app is closed or in the background, it cannot access your location at all — this is enforced by Android, not just by our code.
If you deny location permission, check-in still succeeds. The record is simply saved without coordinates. Your employer may separately require coordinates as a matter of policy, and if you are outside the radius they configured for your work location, the check-in may be rejected — but that is your employer's rule, not a technical requirement of the app.
8. How we use this data
We process personal data only to operate the service your employer has subscribed to:
- Authenticating you and keeping your session secure
- Maintaining the employee record, org structure and documents
- Recording attendance and calculating worked, late and overtime time
- Managing leave requests, approvals and balances
- Calculating payroll, GOSI contributions, payslips and end-of-service entitlements
- Producing the wage files employers submit to banks and to the Saudi WPS/Mudad platform
- Tracking custody of company assets
- Alerting HR before identity documents expire
- Keeping the platform secure and diagnosing faults
We do not sell personal data. We do not use it to build advertising profiles. We do not use it to train machine-learning models.
10. Where data is stored
We want to be straightforward about this rather than vague.
Uploaded files are stored in Microsoft Azure Blob Storage in the Bahrain region, within the Gulf.
The primary database, the cache and the application servers run on Railway's managed cloud infrastructure, which is located outside the Kingdom of Saudi Arabia.
This means personal data described in this policy is transferred and processed outside the Kingdom. We rely on contractual protections with these providers, encryption in transit and at rest, and access controls to keep the data protected to the standard the PDPL requires. If your employer needs data residency inside the Kingdom for regulatory reasons, contact us before onboarding and we will discuss options.
11. How we protect it
The measures below are implemented in the product today, not aspirations:
- All traffic is encrypted in transit over HTTPS/TLS
- Passwords are hashed with bcrypt and are never stored or transmitted in readable form
- Access tokens expire after 15 minutes; refresh tokens are stored only as SHA-256 hashes, are single-use, and rotate on every refresh
- On mobile, tokens are held in the Android Keystore or iOS Keychain — never in plain device storage — and are wiped on sign-out along with all cached data
- QR login tokens are hashed, expire in 30 minutes, can be used only once, and cannot be issued for administrator accounts
- Uploaded files sit in per-organisation private containers and are reachable only through signed links that expire in 15 minutes
- Access is role-based: employees see their own record, HR and administrators see what their role permits
- Sensitive actions — payroll approval, attendance corrections, wage-file generation, QR issuance, document uploads — record who performed them and when
No system is perfectly secure. If we become aware of a personal-data breach we will notify the affected employer and the competent authority as required by the PDPL.
12. How long we keep it
Your employer decides how long employee records are kept, and Saudi labour and tax rules require some records to be retained for years after employment ends.
Two categories are deliberately permanent by design: issued payslips and finalised attendance records are stored as immutable snapshots so that later changes to salary structures or policies can never silently alter a payroll run that has already been issued. This is a correctness and audit requirement.
We should be transparent about a current limitation: the platform does not yet apply an automated retention schedule that purges old records after a fixed period. Deletion today happens when an employer requests it. We are working on scheduled retention and will update this policy when it ships.
13. Your rights
Under the PDPL you have the right to be informed about how your data is used, to access it, to request that inaccurate data be corrected, to request deletion where there is no lawful reason to keep it, and to object to certain processing.
Because your employer is the controller of your employee record, please start with your HR department — they can act immediately inside the product. If you cannot reach them, or you are unhappy with the outcome, write to us at it@rakeezsolutions.sa and we will help. You also have the right to complain to the competent supervisory authority in the Kingdom.
14. Requesting deletion of your data
The app does not currently offer a self-service delete button, so here is the process:
- Email it@rakeezsolutions.sa from the address on your account, with the subject "Data deletion request", and tell us your employer's name
- We acknowledge within 5 business days and verify your identity
- Because employee records belong to your employer, we ask them to confirm the request and tell us what they are legally required to retain
- We complete the deletion and confirm to you within 30 days
- Records that Saudi law requires the employer to keep — issued payslips, end-of-service settlements and statutory payroll records — are retained for the required period and then deleted
If you only want your account deactivated so you can no longer sign in, your HR team can do that immediately.
15. Children
Rakeez HR is a workplace tool intended for employed adults. It is not directed at children and we do not knowingly create accounts for anyone under 18. If you believe a minor's data has been entered, contact us and we will remove it.
16. Changes to this policy
If we change how we handle personal data — a new sub-processor, a new category of data, a change in where data is stored — we will update this page and move the date at the top. For material changes we will also notify subscribing employers directly so they can inform their staff.
17. Contact us
Rakeez Solutions, Riyadh, Kingdom of Saudi Arabia.
Email: it@rakeezsolutions.sa · Phone: +966 53 649 9916
We aim to respond to every privacy enquiry within 5 business days.