Compliance with the Personal Data Protection Law
This English text is a translation provided for convenience. The Arabic text is the binding version; if the two differ, the Arabic text prevails. النص العربي
Last updated: 29 October 2026
Uddah HR processes personal data in accordance with the Personal Data Protection Law issued by Royal Decree (M/19) dated 9/2/1443H and its amendments, its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom, and the guidance of the Saudi Data and AI Authority (SDAIA). This page summarises what we actually do; the binding texts are the privacy policy and the data processing terms.
We don't keep it when you use the calculators, forms, payroll audit, penalties and termination tools: it is processed on the spot and deleted. We keep it only if you turn on the optional "Employee vault", where it is encrypted before it is stored.
The platform, its database and backups are hosted inside the Kingdom, and vault data is not transferred outside it.
Vault data, payroll files and the inputs of the penalties and termination tools are never sent to it. Only the text of your question is sent, after ID, IBAN, mobile and email numbers are masked.
Download your data and request account deletion directly from the portal; we answer other requests within 30 days.
Who is responsible for what?
| Data | Our role | What it means |
|---|---|---|
| Your account, company and subscription data | Controller | We set the purposes of processing, comply with them, and answer your requests directly. |
| Your employees' data in the "Employee vault" (if you turn it on) | Processor on your behalf | Your establishment is the controller. We process it on your instructions and for the vault's purposes only, and help you respond to your employees' requests. |
| Employee data you enter in forms and tools outside the vault | On-the-spot processing | Used to create the document or result and deleted immediately; we keep no copy of the document. |
| E-signature and employee requests through the link | Processor on your behalf | We keep the document sent for signature encrypted until it is signed or for 14 days, and request data encrypted for 90 days, then delete them and keep only the signature evidence. |
How we apply the Law's principles
| Principle | What we do |
|---|---|
| Purpose and legal basis | Every processing activity has a purpose and legal basis stated in the privacy policy (performance of the agreement, a legal obligation, legitimate interest, or your consent). We make no fully automated decisions about you with legal effect. |
| Data minimisation | We don't ask for sensitive data and don't keep employee data outside the vault. In letters to third parties we don't store the ID number itself, only an encrypted fingerprint sufficient for verification. |
| Transparency | A privacy policy setting out the data, its sources, purposes, recipients and retention periods, and an "Employee privacy notice" form to inform your employees. |
| Storage limitation | Automatic deletion when periods end: usage logs after two years, assistant conversations after 30 days, the employee vault 180 days after the subscription ends, and payrolls and records after 5 years. |
| Accuracy | You correct your data and your employees' data directly in the portal and the vault. |
| Security | Technical and organisational measures set out below, with every access to vault data logged. |
Data subjects' rights and how to exercise them
| Right | How |
|---|---|
| To be informed | The privacy policy, and the "Employee privacy notice" form for your employees. |
| Access and a copy | "Account and subscription → Download my data", and exporting the vault to Excel. |
| Correction | Directly from "Company profile" and the vault. |
| Destruction | "Account and subscription → Request account deletion", or deleting an employee or the whole vault. Data we must keep by law, such as payment records and invoices, is excepted. |
| Withdrawing consent | Stop marketing emails and WhatsApp alerts at any time. |
| Your employees' requests | They submit them to your establishment as the controller, and we help you carry them out with the vault tools. |
We answer requests within 30 days of receipt and may ask for proof of identity first. Submit your request from the contact page by choosing "Personal data request", or at support@uddahhr.com.
Transfers outside the Kingdom
The platform, its database and backups are hosted inside the Kingdom. Only the minimum needed to provide the service is transferred abroad, including:
- Your email address and the content of account emails, to the email delivery provider (Zoho ZeptoMail, United States), with no data about your employees.
- Site traffic in transit through the Cloudflare network provided by our hosting provider Kinsta, and technical access logs (IP address and page URL) at Kinsta in the United States.
- Browsing data to Google Analytics, only with your consent and without your name, email or company data.
- The text of AI assistant questions and similar text, after identifiers, your employees' names and health conditions are masked, to Google Gemini, under a paid plan in which the text is not used to train models.
Transfers follow the Regulation on Personal Data Transfer outside the Kingdom, with the appropriate safeguards it sets out and after a risk assessment. Employee vault data is not stored outside the Kingdom. Full details are in the privacy policy.
Data security
- An encrypted connection (HTTPS) between the browser and the platform.
- Passwords stored hashed and unrecoverable, sign-in with a passkey, an email code to confirm sign-in from a new device (or at every sign-in, for those who choose it), a pause on sign-in after repeated wrong attempts, and a limit on simultaneous sessions.
- Vault data encrypted before it is stored, with a key kept outside the database; the vault opens only after signing in to the account (password, plus a code sent to the account's email for any new device), and the platform locks after an hour without use.
- Permissions for each member of your team, and an "Access log" showing you every view or change of vault data.
- Our team sees vault data only at your written request for support or under a legal obligation, and is bound by confidentiality.
- Certificate numbers, notes and file names encrypted in the certificate register, and site administrators confirm sign-in with an email code.
- Regular backups, and protection against attacks and automated bots.
Data breaches
- We notify the Saudi Data and AI Authority within 72 hours of becoming aware of any incident affecting data we control that may harm the people concerned, and notify those affected without undue delay.
- If an incident affects your employee vault data, we inform you within 24 hours so that you, as the controller, can notify the Authority in time, and we cooperate with you in doing so.
What remains with your establishment
As the employer and the controller of your employees' data, make sure that:
- You have a legal basis for processing your employees' data and inform them of it. Use the "Employee privacy notice" form.
- You don't enter sensitive or unnecessary data, and don't write employee names in questions to the AI assistant.
- You keep the files you download (payrolls, PDF reports, Excel files) safe and share them only with those who need them.
- You assess for yourself whether your establishment must register in the national register of controllers or appoint a data protection officer under the Authority's rules.
Contact about personal data
Controller: شركة تولى أوبيريكس (شركة شخص واحد ذات مسؤولية محدودة), Unified national number 7055189745. Email: support@uddahhr.com. You may also file a complaint with the Saudi Data and AI Authority.
This statement describes our measures and does not imply approval or certification by any authority. In case of any difference, the privacy policy and the data processing terms apply, and the Arabic text prevails.