Dawam · دوام — Privacy Policy

Version 2.0 — effective 6 September 2026 · النسخة العربية أدناه

Who is who

Dawam is an employee app made and owned by EHC (Ebraheem Hashem), hashem.sa. The app connects to your employer's own Odoo HR server, which your employer chooses and controls. Your employer is the data controller. EHC develops the app and does not receive your data unless your employer has asked EHC to operate its server.

What the app collects

1. Identity. Your name, job, department and work site from your employer's HR records. You type your national ID or Iqama number once to register.
2. One location fix per punch. When you press Punch In or Punch Out the app reads your location once and sends the coordinates, accuracy and the distance to your work site to your employer's server. Nothing is read in the background.
3. Device integrity flags. Whether the location is simulated, the phone is rooted or jailbroken, or the app runs on an emulator — as yes/no flags only.
4. A live photo, only when your employer enables it and only on unusual punches (outside the work site, under an exemption, or an approved remote punch). The photo is taken with the in-app camera at that moment and cannot be chosen from your gallery. It is sent to your employer's server with a time and location stamp.
5. Device details. Device ID, model, OS version, app version and a push-notification token.
6. What you do in the app. Requests you submit (leave, permission hours, letters, loans, complaints, corrections, profile updates) and the moment you accepted your employer's privacy notice.

What the app does not do

• No background location, no continuous tracking.
• Face ID / Touch ID never leave your phone; the app only receives a "confirmed" flag from the operating system.
• No advertising, no analytics SDKs, no data sale.

Where the data goes

Only to the server address you entered when you connected the app — your employer's system. The app stores a login token, cached copies of your own payslips, balances and requests, and queued punches on the phone, protected by the phone's secure storage; "Reset connection" in the app deletes all of it.

Retention

Set by your employer in their server. The default configuration deletes punch coordinates and photos after 12 months; attendance times and pay records are kept as labour and tax rules require.

Your rights

You may ask your employer's HR to access, correct or delete your data and to explain how it is used. Saudi residents may also complain to the Saudi Data & AI Authority (SDAIA). Requests that concern the app itself can be sent to EHC.

Contact

EHC — ebraheem@hashem.sa · www.hashem.sa