Privacy
What Mawarid holds about its customers' employees, why, and who can see it. Written to be read rather than signed.
Whose data it is, and who handles it
Mawarid is a system an employer uses to run its own staff records. The information in it is the employer's information about their employees: they decide what is collected and why, and we handle it on their behalf and on their instructions.
Waiting on legal review: what each party is called under the Personal Data Protection Law, and the name and address of the responsible entity.
What the system holds
About each employee, as far as the employer enters it:
- Name in Arabic and English, employee number, national or residence identity number, and date of birth.
- How to reach them: mobile and address, and somebody to contact in an emergency.
- A photograph, where one has been added.
- Employment: unit, title, grade, joining date and contract.
- Salary and its components, and bank account and bank name — because payroll is worked out here.
- Attendance, leave, documents, requests, and the decisions made on them.
Location, and when it is not asked for
Location is asked for when attendance is recorded, only for an employee who works at a site, and only to confirm they are at that site at that moment.
Anybody working remotely or in the field is never asked for it — not asked and then ignored, but not asked. No coordinate is stored for them, and not a zero in its place either: the field is left empty. Where somebody lives, recorded every morning, is personal information this system has no use for.
Who sees what
One employer never sees another's information. The separation is built into the foundation: every query is confined to the company the session belongs to, and a query with no company is refused rather than answered with an empty result.
Within one employer, each person sees what their role allows: themselves, their own unit and everything beneath it, or the whole company.
The record that cannot be altered
Every change to an employee's information is recorded: what changed, who changed it, and when. That record cannot be edited or deleted — a rule in the database refuses it, and nobody here can override it.
That is deliberate. A record that can be altered proves nothing, and this is what makes an employee's information reviewable years later.
Waiting on legal review: what the Personal Data Protection Law requires of us in respect of that record when erasure is requested. What the system does is described above exactly; what follows from it in law is an opinion that has not been given, and no answer will be written here before it is.
How long it is kept
Waiting on legal review: how long each kind of record is kept, and the periods the law requires for wage and contract records.
An employee's rights
From the Mawarid app on their own phone, an employee can see their own information, their attendance, leave, payslips and documents, and ask for their personal details to be corrected.
What concerns their employment — their title, their unit, their salary — is not changed by typing. It is changed by a decision somebody with the authority approves, and it is written to the record.
Waiting on legal review: how the data subject's rights are stated as the law sets them out — access, correction, erasure and objection — how they are exercised, and to whom.
Getting in touch
Waiting on legal review: an address to write to, and the name of a data protection officer if one must be appointed.