Privacy notice

XEED Digital Solutions (“XEED”, “we”) provides enterprise software to employers. Where your employer uses a XEED product, your employer is the data controller and XEED acts as their processor — we process personal data on their documented instructions, not for our own purposes.

This distinction matters for your rights: requests about your data go to your employer in the first instance, and we support them in answering.

The categories below are what the platform handles today:

• Identity and employment records — name, employee code, department, position, shift, contract dates and the supervisory hierarchy.
• Attendance events — timestamps, GPS coordinates at punch, geofence entry and exit, and the site or project the punch was anchored to.
• Device and integrity signals — device identifier, operating-system integrity checks, mock-location detection and time-source (NTP) validation.
• Biometric templates — facial verification data used solely to confirm that the person punching is the enrolled employee.
• Payroll and disciplinary records — hours, overtime bands, leave balances, deductions and any disciplinary process raised under the Labour Law.
• Support and contact data — details submitted through this website, and correspondence with our team.

These are the most sensitive categories we handle, so they are treated separately:

• Facial verification confirms identity at the moment of a punch. It is an identity check, not surveillance, and is not used to infer emotion, health or demographics.
• Location is captured at punch events and, where the employer enables presence monitoring, during shifts. It is not collected outside working periods.
• Neither category is sold, shared for advertising, or used to train models for third parties.

Processing is performed on the employer’s instructions: to record attendance, calculate working time and overtime, operate the approval and disciplinary workflows required by the Saudi Labour Law, detect fraudulent or spoofed punches, and produce records employers are legally obliged to keep.

Data is hosted on Amazon Web Services in the Asia Pacific (Mumbai) region, which is outside the Kingdom of Saudi Arabia. Any sub-processor is engaged under written terms no less protective than this notice, and a current list is available to customers on request.

Records are retained while the employer’s account is active, and thereafter for the period their own statutory obligations require — labour and tax records in the Kingdom typically carry multi-year retention duties. On termination, data is returned or deleted on the employer’s instruction, subject to those obligations.

• Encryption in transit and at rest, with credentials and gateway tokens encrypted at the field level.
• Tenant isolation enforced in the application and again at the database with row-level security.
• Role-based access control, with a full audit trail on every approval, override and correction.
• Personal data scrubbed from error reporting and operational logs.

Subject to the Personal Data Protection Law, individuals may request access to their personal data, correction of inaccuracies, deletion where no overriding obligation applies, and information about how their data is processed.

Where your employer is the controller, raise the request with them — they can action it directly in the platform. If you cannot reach them, contact us and we will help route it.

Privacy enquiries: privacy@xeedds.com