Privacy policy
This page explains the personal data we collect when you visit hrfirst.co or send us a request, why we collect it, who can see it, and how you can exercise your rights over it.
"The Law" means Saudi Arabia's Personal Data Protection Law, and "the Regulations" means its Implementing Regulations.
Last updated:
Who we are
- HRFirst is the trade name of the registered establishment مؤسسة عثمان عبدالله نياز, unified national number 7054278929, based in Al Rawdah, Saud Al Faisal Street, Jeddah.
- Our work: we handle employee affairs for businesses that have no HR team, from files, leave and payroll to government platforms.
- For anything about your data, email info@hrfirst.co.
- Our personal data protection officer is the owner of the establishment, who receives your messages at the same address.
Who this policy covers
- This policy covers visitors to hrfirst.co, anyone who sends us a request through the website form or our TikTok ad form, anyone who messages us on WhatsApp or by email, and anyone representing a business that works with us.
- This policy does not cover our clients' employees. We process their data on behalf of, and on the instructions of, the business that employs them, and that business explains to its employees how their data is processed.
The data we collect
- From the website request form: your name, mobile number, the approximate number of employees in your business, and the services you need. For a meeting request we also ask for a suitable day and time and your preferred way to be contacted. All of these fields are required, because we cannot reply to a request without them.
- With each request we also store the page language and where your visit came from, meaning the platform or link that brought you and the first page you opened, so we know which of our channels bring in requests.
- After you send a request, WhatsApp opens with a message containing its details. We only receive that message if you send it yourself.
- From our TikTok ad form: when you fill in the form inside TikTok, TikTok collects your answers on our behalf and passes them to us. These are your name, mobile number, business name, and your answers to the form's multiple-choice questions.
- From WhatsApp and email: your number or email address, the name shown on your account, and the content of what you send us.
- From browsing the website, unless you stop measurement: cookie identifiers (small files your browser stores on your device), your device and browser type, the pages you visit, where you came from, your approximate city, the contact buttons you tap, and your steps in the request form from opening it to sending it.
- From our hosting provider: Lovable measures visits to the website for every visitor and shows us the totals. It sets a temporary 30-minute cookie for this and records the page, your browser type and language, your approximate country based on your device's time zone, and the site you came from. This measurement runs on the hosting side, and the "Stop measuring my visits" button does not stop it.
- Lovable also keeps technical logs to run and protect the website. Their content and retention follow Lovable's terms.
- From running the website: we record page errors and pages that load slowly, with the browser type and page address, so we can fix them. No cookie is used for this.
- We never ask for health data, ID numbers or bank account details on the website. Please do not send them through the form or WhatsApp.
Why we collect it, and on what basis
- To reply to your request and prepare a quote for your business: the basis is your consent when you send the request from the website or the TikTok form (Article 5 of the Law).
- To sign and carry out the contract with your business and issue invoices: the basis is performing the agreement and our duty to keep commercial books (Article 6, paragraph 2 of the Law).
- To measure and improve website visits: the basis is our legitimate interest in running and improving the website (Article 6, paragraph 4 of the Law). You can stop this measurement at any time with the "Stop measuring my visits" button on this page, or by blocking cookies in your browser settings.
- To send marketing content or offers to your phone or email: we only send these with your separate consent, and every message includes an easy way to stop them (Article 25 of the Law and Article 29 of the Regulations).
- To run the website, protect it from misuse and fix faults: the basis is legitimate interest, and protecting network and information security is an example named in Article 16, paragraph 2 of the Regulations.
- We do not sell your data, and we make no fully automated decisions about you.
Processing your data outside the Kingdom
- Some of the parties above process data outside Saudi Arabia: Lovable, OpenAI through the AI tool, Google, Meta through WhatsApp, and TikTok. We tell you this because Article 13 of the Law requires it.
- We limit what leaves the Kingdom to the minimum needed for the purpose (Article 29, paragraph 2, item (c) of the Law).
How long we keep data
- Contact requests, including TikTok form requests, and conversations with people who did not become clients: 12 months from the last contact, then we destroy them.
- Detailed Google Analytics data: according to the tool's setting, at most 14 months. After that only overall totals remain, which do not point to any individual.
- Our website's own visit log, with its error and slow-page reports: we keep it as long as it is needed to improve the website, and review that need at least once a year.
- Visit measurement and technical logs kept by Lovable: according to Lovable's terms.
- Client representatives' data in contracts and invoices: at least ten years, because Article 8 of the Commercial Books Law requires books, correspondence and documents to be kept for that period.
- Destruction covers every copy, including backups, subject to what any law requires (Article 8, paragraph 2, item (c) of the Regulations).
How we protect your data
- Only the people who need your request to reply to it can see it.
- Only accounts approved by our team can open the website's request inbox, and the server checks each account's permission before showing any request.
- We follow recognised cybersecurity best practices (Article 23, paragraph 2 of the Regulations).
Your rights
- To know how we process your data. This policy is part of that.
- To ask to see the data we hold about you, and to get a copy in a clear format.
- To ask us to correct, complete or update your data.
- To ask us to destroy your data once we no longer need it, unless a law requires us to keep it.
- To withdraw your consent at any time, without affecting anything done before.
- Legal basis: Article 4 and Article 5, paragraph 2 of the Law.
- How to ask: email info@hrfirst.co. We verify your identity before acting and reply within 30 days. If we need longer, we tell you why before that period ends, and the extension is no more than 30 days (Article 3, paragraph 1, items (a) and (c) of the Regulations).
- Visit measurement: you can stop it whenever you like with the button below, or by blocking cookies in your browser settings, and turn it back on with the same button.
Visit measurement is on in this browser.
Complaints
- If you are not satisfied with our reply, you may complain to the Saudi Data and AI Authority (SDAIA) as the competent authority (Article 34 of the Law), through the National Data Governance Platform: https://dgp.sdaia.gov.sa
Children
- Our website is meant for businesses, and we do not knowingly collect data from anyone under 18.
Changes to this policy
- We may update this policy. We show the date of the last update at the top and keep a record of changes.
Last updated: