What we collect,why, and when we stop.

General privacy statement

This policy is an integral part of the framework for using the TAC HR platform. It explains how data is collected, processed and protected in line with good technical practice and the regulations in force in the Kingdom of Saudi Arabia.

TAC HR is a human-resources platform covering attendance, requests, leave, payroll, employee files and field-sales work, delivered as a website and a mobile app. The establishment (employer) that uses TAC HR decides which employee data it keeps and why; we process that data to run the service on its behalf, under this policy. An employee’s account in the app is created for them by their establishment.

1Platform owner

TAC HR belongs to Al-Mu’addat E-Marketing Platform (منصة المعدات للتسويق الإلكتروني), part of TAC Group, commercial registration number 7038510140, located at Riyadh - King Abdulaziz District.

Contact: email info@tachr.app, phone +966533311588.

2Data we collect

We collect the data needed to provide the service efficiently, which includes the following depending on the services your establishment enabled:

• Account and employee data: name, mobile number, email, employee number, branch, department and job title.
• Identity data: national ID, residence permit (iqama) or passport number and their expiry dates, nationality, date of birth and marital status, where the establishment records them in the employee file.
• Payroll and insurance data: basic salary, allowances and deductions, the IBAN used for salary transfer, social-insurance (GOSI) details, and payslips.
• Leave and occupational-health data: leave requests of all types (including sick leave and what is attached to it), and medical-insurance and dependants data (names, dates of birth and ID numbers) where the establishment records them.
• Documents and attachments: what the establishment keeps in the employee file or what you upload with your requests and conversations (such as ID copies, contracts, certificates and medical reports), photos you take with the device camera to document field visits, and your profile picture. The app does not access the rest of your device photos.
• Attendance and location at punches: your coordinates at the moment of an attendance punch only, to verify you are within the work-site area. When a punch outside the area is rejected, the location may be converted to a street or place name that your manager can see.
• Notification token: a token specific to your device, used to deliver app notifications to you (approvals, announcements, reminders), with the app language at registration.
• Device identifier and details: device ID, name, model and operating system, used to bind your account to a single device and block sign-in from an unapproved one.
• Device integrity checks at punch time: the app checks on your device for USB debugging, developer options, emulators, mock-location apps and root, and sends the check result (not your list of apps) with the punch to protect attendance records from tampering. We also use Google Play Integrity to confirm the app is genuine and running on a real device.
• Biometric verification (fingerprint or face): if your establishment enables it, verification happens inside your phone’s operating system. We never receive your fingerprint or face image, only the pass/fail result.
• Technical information: sign-in time, connection address (IP), browser or device type, and operational and audit event logs, to improve performance and security and to trace sensitive operations.

3How we use data

Data is used to run the services your establishment enabled, support users, strengthen the security and stability of the system, and produce reports. Your data is not used outside providing and improving the service; we do not use it for advertising and do not build marketing profiles about you.

• Running attendance, requests and leave, payroll, documents and field work.
• Verifying attendance and protecting its records from tampering.
• Sending you work-related notifications.
• Protecting accounts and tracing and reviewing sensitive operations.
• Keeping the service stable and fixing faults.

4Data protection and information security

We apply appropriate technical and organisational measures to protect data from unauthorised access, loss, alteration or disclosure. Your data is encrypted in transit between the app or browser and our servers (HTTPS).

Measures include role-based permissions, logical separation of each establishment’s data from others, and an audit log for sensitive operations.

The customer undertakes to manage its internal users’ permissions in a disciplined way, because data security is a shared responsibility between the provider and the customer.

5Sharing data with third parties

We do not sell your personal data or license it to third parties for marketing, and we share it only where needed to provide the service or where a legal or judicial obligation requires, and to the minimum necessary. Your data is visible to authorised people in your establishment according to their permissions (for example your direct manager and HR).

We rely on technical service providers to operate the platform; they process data only as needed to perform their service: hosting, push notifications (Expo and Google Firebase), Google Play Integrity, OpenStreetMap for converting coordinates to an address, and CARTO for map display.

6Customer and employee rights

You may ask to access, update, correct or delete your data and to enquire how it is processed. The quickest route is your establishment’s manager (HR administrator), who controls employee data from the dashboard.

If that is not possible, email info@tachr.app from the email or mobile number registered on your account and describe your request; we will follow it up with your establishment and carry out our part unless the law requires us to keep the data.

7Data retention

• Raw location points of field representatives are deleted automatically 90 days after they are recorded.
• Other HR data is kept for as long as needed to provide the service while your establishment’s account is active, or as long as applicable regulations require, and the establishment can ask for its deletion.
• The notification token is removed when you sign out or the device is revoked.
• After the contractual relationship ends, data is handled under the approved retention, archiving and deletion policies and legal requirements.

8Cookies and similar technologies

The TAC HR website uses one essential session cookie (tac_session) that keeps you signed in securely, and preference cookies that remember your choices inside the dashboard, such as the columns shown in tables. We do not use third-party analytics or advertising tools.

You can manage your browser’s settings for these technologies, noting that blocking the session cookie prevents sign-in.

9Privacy of sensitive operational data

We treat identity data, salaries, IBANs, sick leave, medical insurance, personal documents and employee locations as sensitive, and access to them is restricted by defined roles and permissions: an employee sees their own data, a manager sees their team, and finance and HR are given only the scope they need.

This approach aims to protect confidentiality, limit unauthorised access, and record changes and sensitive operations in an audit log.

10Updates to this policy

We may update this policy when needed to follow platform development and regulatory requirements, and we will update the date at the top of the page. Material changes to location collection will be shown to you in the app before they take effect.

11Legal obligations in the Kingdom

TAC HR undertakes to process data in accordance with the regulations and controls in force in the Kingdom of Saudi Arabia, including requirements relating to the protection of personal data.

12Contact about privacy

For any question about privacy, data processing or a deletion request, contact us at info@tachr.app or +966533311588; requests are handled seriously, professionally and within a suitable timeframe.