This policy explains how HRdecide processes personal data, consistent with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its executive regulations.
For employee data entered or imported by a customer organisation, the organisation is the data controller and HRdecide processes that data on its instructions as a processor. For account data of signed-up users, HRdecide acts as controller.
Account data: name, work email, hashed password, role, language. Organisation data: company details entered in Settings. Employee data supplied by the organisation: name, role, service dates, remuneration, leave, warnings, permit and labour-card identifiers, and the decisions, memos, documents and acknowledgements generated from them. Technical data: audit logs of actions in the service (who did what, when) and hashed IP fingerprints on acknowledgements.
We do not intentionally collect special categories of data. Do not enter health, biometric or criminal-record data.
Processing is performed to provide the service under the contract with the organisation (PDPL Art. 4), to keep tamper-evident records the organisation needs to meet its legal obligations, and to secure and improve the service. We do not sell personal data and we do not use it for advertising.
Data is hosted with our infrastructure providers (application hosting and managed database). Hosting may be located outside the UAE; where that is the case, transfers are made under PDPL Arts. 22–23 to jurisdictions or providers offering an adequate level of protection or under appropriate contractual safeguards. The current hosting locations are listed on request.
Data is kept while the organisation's account is active. Signed records are retained as immutable evidence for as long as the organisation keeps its account. On verified deletion requests, the organisation and its data are deleted, subject to legal retention duties.
Subject to the PDPL, data subjects may request access, a copy, rectification, erasure, restriction, or objection to processing (PDPL Arts. 13–18). Employees should address requests to their employer (the controller); we support the employer in answering them. Account holders may contact us directly.
Passwords are stored hashed (bcrypt); API keys are stored hashed; sessions are signed and expire; access is role-restricted and tenant-isolated at the data layer; every write is recorded in an audit log; records carry SHA-256 integrity hashes.
Numbers are never produced by an AI model. If an administrator enables it, one optional feature sends pasted contract text to an AI provider solely to transcribe its fields; the text is not used to train models under our provider agreement. This feature is off unless configured.
Privacy requests: privacy@hrdecide.app.