Privacy policy

Last updated: 2026-11-07

This policy explains how BSSM collects, uses and protects personal data, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations.

Who we are

BSSM is a cloud platform for attendance and HR, owned and operated by Saad Information Technology. For any privacy matter, contact support@bssm.sa

Your company's role and ours

• Employee data: the subscribing company is responsible for its employees' data. We process it on the company's behalf and under its instructions, only to run the service.
• Contact form data and company account data: we are responsible for it.

Data we collect

• From the contact form: name, company name, mobile number, email, number of employees, and any additional details you choose to send.
• From subscribing companies: company and employee data they enter into the system, such as employment, payroll, leave and request details.
• From the employee app: check-in times, the phone's location at the moment of check-in only (to verify the employee is at the work location), and device information needed to detect tampering.
• Activity log: sign-ins and important changes inside the system, to protect accounts and review any dispute.

Face verification and biometrics

• Fingerprint or Face ID: verification is done by the phone's own system, and BSSM receives no biometric data from it.
• Face verification: if the company enables it, the face is compared on the employee's phone itself, and we receive only the result (match or no match). Face photos are not stored on or sent to our servers.
• Face verification is enabled only after the employee's explicit consent in the app, which they can withdraw at any time. Employees who do not consent check in with fingerprint or Face ID instead.
• If the result is no match, the check-in is sent to the manager to approve or reject.

How we use data

• Running the service for the company and its employees: attendance, requests, leave and payroll.
• Sending notifications, sign-in messages and account alerts.
• Contacting you about your request or subscription.
• Protecting the service from tampering and misuse.

We do not sell personal data or use it for advertising or marketing.

Sharing data

We share data only with the technical providers needed to run the system: hosting and database, email, and mobile notifications. Each of them is bound to protect the data and not use it for any other purpose. We may also disclose data when required by a competent authority under the law.

Where data is stored

System data is stored with a cloud hosting provider in India. We follow the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, including the standard contractual clauses issued by the Saudi Data and AI Authority (SDAIA) and the required risk assessment.

Protecting data

• Data is encrypted in transit and at rest.
• Each company's data is isolated, and only its authorised staff can see it, according to the permissions it sets.
• Accounts with elevated permissions require two-step verification.

How long we keep data

• Company data is kept for the duration of the subscription.
• When the subscription ends or is cancelled, the company has 60 days to export its data, after which it is permanently deleted.
• Contact form data is kept as long as needed to respond to and follow up on your request.

Your rights

You have the right to know how your data is processed, to access it and get a copy, to ask for it to be corrected or deleted, and to withdraw your consent where processing is based on it. If you work for a subscribing company, please contact your company first, as it is responsible for your data in the system, or write to us and we will help. We respond to requests within 30 days.

Cookies

The BSSM website does not use cookies for tracking or advertising.

Changes to this policy

We may update this policy. We will notify subscribing companies of any material change before it takes effect, and the last updated date appears at the top of this page.

Contact

For any privacy question or request: support@bssm.sa