Privacy policy
Draft: this document is an initial draft that has not yet been reviewed by legal counsel, and it is not in force until approved and published in final form. Text in square brackets must be completed.
Last updated 20 October 2026
This policy explains how [Legal entity name] (“RafiqHR”, “we”) collects, uses and protects personal data when you visit this website, contact us or use our services, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations.
1. Who we are
[Legal entity name], commercial registration number [CR number], registered at [registered address]. For privacy matters: sales@rafiqhr.com.
2. Data we collect on this website
Data you choose to send us, such as your name, work email, company name, number of employees and the content of your message when you contact us.
Limited technical data that servers normally log, such as IP address, browser type and pages visited, for security and operation. This website does not use advertising cookies.
3. Employee data inside the platform
When a company uses the RafiqHR platform, the company is normally the controller of its employees’ data, and we process that data on its behalf, under its instructions and the data processing agreement we sign with it. Employees should direct requests about their data to their employer first.
4. Purposes and legal basis
To answer your enquiries and demo requests, to provide the service under contract, to protect the security of the website and platform, and to meet our legal obligations. We rely on your consent, the performance of a contract, legitimate interest or a legal obligation, as applicable.
5. Sharing
We do not sell personal data. We may share it with service providers acting on our behalf, such as hosting, email and the AI provider a company chooses, under contracts that require them to protect it, or with competent authorities where the law requires.
6. Data transfers
Any cross-border transfer of personal data is made under the conditions and controls of the Personal Data Protection Law and its regulations.
7. Retention
We keep data for as long as needed for the purpose it was collected for, or as long as the law requires, and then delete or anonymise it. [Retention periods per category to be completed].
8. Your rights
Under the law you have the right to be informed about how your data is processed, to access it and obtain a copy, to have it corrected, to have it destroyed when it is no longer needed, and to withdraw consent where consent is the basis for processing. To exercise these rights, email sales@rafiqhr.com. You may also complain to the competent data protection authority in the Kingdom.
9. Security
We apply appropriate technical and organisational controls to protect data, including encryption in transit and at rest and an audit trail.
10. Changes
We may update this policy from time to time and will publish the updated version on this page with the date of the last update.