1. Introduction

Royal HR is the employee application of the human resources management system provided by Royal Tech to subscribing employers. Employee accounts are created and managed exclusively by the employer's HR department; the app contains no self-registration. This policy describes the data processed by the app and the purposes of processing.

2. Data Collected by the App

• Employment data: name, employee number, department, payroll and leave records, entered by the employer.
• Location: read only at the moment of check-in or check-out, to verify the employee is within the employer's approved work zone. No background location tracking takes place at any time.
• Verification photo: a selfie captured at check-in/check-out, used exclusively by the employer's HR department to verify attendance identity.
• Device identifier: used to link the account to the employee's device and prevent attendance fraud.
• Push token (FCM): a technical token used to deliver system notifications to the device.

The app collects no other data, including contacts, messages, or browsing history.

3. Purposes of Processing

• Recording and verifying attendance.
• Displaying the employee's payroll, leave, and request information.
• Delivering system notifications (approvals, announcements, and similar).

The app contains no advertising, and data is not used for any marketing or analytics purpose outside the operation of the system.

4. Data Ownership and Sharing

The data belongs to the employee's employer as the data controller and is processed on its behalf. Data is not sold and is not shared with any third party. Access is limited to authorized staff at the employer under role-based permissions.

5. Data Retention

Data is retained for the duration of the employment relationship and in accordance with the employer's policies and applicable record-keeping requirements. Upon termination of employment, removal or archival of data is managed by the employer.

6. Data Security

• All communications are encrypted over HTTPS.
• Access to data is restricted by role-based permissions.
• Verification photos are protected and served only via signed links to authorized personnel.

7. Account Deletion and Employee Rights

As accounts are provisioned by the employer, account deactivation, deletion, and data-correction requests are handled by the employer's HR department, which is the party authorized to respond to employee requests regarding their data.

8. Changes to This Policy

If a material change is made to this policy, the "Last updated" date above will be revised and the amended version will be published at this URL.

9. Contact

For questions regarding data, please contact the HR department at your employer. General inquiries: Royal Tech — hr.royal-tech.iq