Privacy Policy

Jadwal is an AI-powered workforce-scheduling and attendance platform operated by Transcend (“Transcend”, “we”, “our”, “us”), based in Jeddah, Kingdom of Saudi Arabia. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Jadwal websites, web app, and mobile/PWA employee app (together, the “Service”).

Jadwal is designed primarily for businesses operating in Saudi Arabia, and this Policy is written to be aligned with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. Where a business (the employer) uses Jadwal to manage its workforce, that employer is generally the “controller” of its employees’ personal data and Transcend acts as a “processor” that handles the data on the employer’s instructions.

Account information: when an administrator signs up, we collect names, email address, phone number, company name, role, and a hashed password. We never store passwords in plain text.

Employee & HR data entered by the employer: your employer may add employee profiles containing names, job titles, departments, employee IDs, contact details, wage/contract basics, schedules, leave balances, and similar workforce records. This data is provided and controlled by the employer.

Location data — captured only at clock-in and clock-out: when an employee taps to punch in or out, the app reads the device’s GPS location at that single moment to verify the employee is physically at the assigned branch (geofencing). We do NOT track location continuously, in the background, or between punches. Location is read only while the punch screen is open and the employee performs a punch.

Device & GPS accuracy data: along with each punch location we record the reported GPS accuracy (in metres) and basic technical signals so managers can see whether a punch was reliable, out of the branch zone, or low-accuracy.

Attendance, schedule & leave records: clock-in/out times, lateness, shift assignments, schedules, and leave/permission requests and their approval status.

Usage & log data: technical information generated automatically when you use the Service, such as IP address, browser/device type, pages viewed, actions taken, and timestamps, used for security, troubleshooting, and improving the Service.

We process personal data to provide and operate the Service: creating and securing accounts, generating schedules, recording attendance, and managing leave and permissions.

Geofence verification: location captured at a punch is used solely to confirm branch presence, flag out-of-zone or low-accuracy punches for the employer’s managers, and display where a punch happened on a map. It is not used for any other profiling.

Payroll & attendance support: attendance and lateness records help the employer manage hours, overtime, and compliance with Saudi labour requirements.

Lawful basis under the PDPL: depending on the activity, we rely on the performance of the contract with the employer, the employer’s legitimate business interests in operating its workforce, compliance with legal obligations, and — for the location capture feature — the consent the employee gives at the moment of punching. Employees may decline, but doing so means they cannot use the location-verified punch feature.

An employee’s location-at-punch, attendance times, lateness flags, schedules, and leave records are visible to that employee’s own employer — specifically the company administrators and authorized managers of the business that the employee works for.

Transcend staff do not routinely view this data. Limited, logged access may occur only to provide technical support, investigate security issues, or comply with the law. Employees with questions about how their employer uses this data should contact their employer, who is the controller of that data.

We do not sell personal data. We share data with vetted service providers (sub-processors) who act on our behalf under data-processing agreements — for example cloud hosting, database, map/geocoding, email and notification delivery, and payment processing.

We may disclose data where required by a valid legal request from a competent Saudi authority, to protect the rights and safety of users or the public, or in connection with a corporate transaction, subject to confidentiality protections.

We retain personal data for as long as the employer’s account is active and the data is needed to provide the Service, and afterwards only as long as necessary to meet legal, accounting, or legitimate business requirements (for example, attendance records the employer must keep under Saudi labour rules).

When an account is closed, the employer may export its workforce data within a defined window, after which we delete or irreversibly anonymise it, except where a longer retention period is required by law.

We apply industry-standard safeguards including encryption in transit (TLS), encryption of sensitive data at rest, role-based access controls, and regular security reviews. Access to production data is limited and logged.

No method of transmission or storage is perfectly secure, so while we work hard to protect personal data, we cannot guarantee absolute security.

Subject to the PDPL, you have the right to be informed about how your personal data is processed, to access your data, to request correction of inaccurate data, and to request deletion when the data is no longer needed.

Where processing relies on consent — such as location capture at clock-in/out — you may withdraw that consent at any time; withdrawal does not affect processing already carried out, but may mean you can no longer use the location-verified punch feature.

Because the employer is usually the controller of employee data, requests about employee HR, attendance, or location data should normally be directed to the employer. For data Transcend controls (such as administrator account data), contact us using the details below. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA), the supervisory authority for the PDPL.

We aim to host and process personal data within the Kingdom of Saudi Arabia where reasonably practical. Where data is transferred to or accessed from outside the Kingdom (for example by a cloud sub-processor), we do so only in accordance with the PDPL and its rules on cross-border transfers, and we apply appropriate safeguards to protect the data.

Jadwal is a workplace tool intended for businesses and their adult workforce. It is not directed at children, and we do not knowingly collect personal data from anyone under the legal working age. If you believe a minor’s data has been provided to us in error, please contact us so we can address it.

We may update this Privacy Policy as the Service evolves or as the law changes. When we make material changes we will update the “last updated” date shown on this page and, where appropriate, notify account holders and ask them to re-confirm their acceptance.

For privacy questions or to exercise your data rights with respect to data we control, email privacy@jadwal-sa.com or write to: Transcend, Jeddah, Kingdom of Saudi Arabia. We aim to respond within the timeframes required by the PDPL.