Privacy Policy
Kafaat – HR and Attendance Management Platform
Effective Date: October 27, 2026
Last Updated: October 27, 2026
1. Introduction
Welcome to Kafaat (“Kafaat,” “we,” “our,” or “us”). Kafaat is a human resources and attendance management platform that enables businesses to manage employee attendance, leave requests, payroll, employee records, and related workforce operations through a dedicated company workspace.
We respect your privacy and are committed to protecting the personal information processed through our website, platform, and mobile applications.
This Privacy Policy explains what information we collect, how we use and protect it, when it may be shared, and what rights and choices may be available to you.
By accessing or using Kafaat, you acknowledge that you have read this Privacy Policy. Where consent is legally required, we will obtain it separately.
2. Scope of This Policy
This Privacy Policy applies to:
- Visitors to the Kafaat website.
- Company administrators who register for or manage a Kafaat workspace.
- Employees and other authorized users whose information is processed through the platform.
- Users of Kafaat's mobile applications and related services.
If your employer uses Kafaat to manage your employee information, your employer may determine why and how certain information is processed. In those circumstances, please contact your employer for information about its employment-related privacy practices.
3. Information We Collect
Depending on how you use Kafaat and which features your company enables, we may collect the following categories of information.
3.1 Account and Company Information
- Company or organization name.
- Administrator's name and business contact details.
- Work email address and phone number, where provided.
- Workspace address and account identifiers.
- Login credentials, stored using appropriate security measures.
- Subscription plan, billing status, and transaction-related information.
3.2 Employee Information
Depending on your employer's configuration and use of the platform, this may include:
- Employee names, identification details, and contact information.
- Employee numbers, job titles, departments, and branch assignments.
- Employment records, contracts, and related documents.
- Salary information, allowances, deductions, and payslips.
- Leave balances, leave requests, holidays, and approval records.
- Performance information, rewards, and other employment-related records entered by authorized users.
3.3 Attendance and Location Information
When attendance features are enabled, the platform may process:
- Check-in and check-out timestamps.
- Attendance records, shift schedules, and working hours.
- GPS location information associated with attendance events, where enabled.
- Selfies or images submitted for attendance verification, where enabled.
- Device and synchronization information needed to support attendance features.
Location and image collection depend on the features enabled by the company and the relevant device permissions. We do not intend to collect precise location continuously unless a specific feature requires it and the relevant processing is properly authorized.
3.4 Technical and Usage Information
We may collect technical information necessary to operate, maintain, and secure the service, such as:
- IP address and browser information.
- Device type, operating system, and application version.
- Login activity, timestamps, and security logs.
- Error reports, performance information, and service usage data.
The exact information collected depends on the service configuration and technical mechanisms in use.
4. How We Use Information
We may use personal information for the following purposes:
- Creating and managing company workspaces and user accounts.
- Authenticating users and controlling access to the platform.
- Recording attendance and calculating working hours.
- Managing leave requests, holidays, and approval workflows.
- Supporting payroll calculations and generating payslips.
- Maintaining employee records and authorized employment documents.
- Processing subscriptions and providing customer support.
- Maintaining platform availability, troubleshooting issues, and improving performance.
- Detecting unauthorized access, preventing fraud, and protecting system security.
- Meeting applicable legal obligations and responding to lawful requests.
We will use personal information only for purposes that are permitted by applicable law and consistent with the relevant relationship and service.
5. Legal Basis for Processing
Where applicable privacy law requires a legal basis, personal information may be processed based on one or more of the following:
- Consent, where required.
- Performance of a contract or provision of requested services.
- Compliance with legal obligations.
- Legitimate interests, where permitted by law and where those interests do not override applicable individual rights.
- Other lawful grounds recognized by the applicable jurisdiction.
The appropriate legal basis depends on the type of information, the purpose of processing, and the parties involved.
6. Company Workspaces and Data Separation
Kafaat is designed to provide each company with a dedicated workspace and a separate database, as described on our website.
Access to employee records should be limited to authorized users according to their assigned roles and permissions. Company administrators are responsible for configuring access appropriately, maintaining the confidentiality of their login credentials, and removing access when it is no longer required.
Data separation is one of our intended security measures; however, no technology or security control can guarantee absolute protection against every possible risk.
7. Sharing and Disclosure of Information
We do not sell personal information as part of our intended service model.
We may disclose or make information available to the following parties when necessary and lawful:
- Your employer: Authorized company administrators and personnel may access information required for HR, attendance, payroll, and employment administration.
- Service providers: Hosting, infrastructure, security, communications, payment processing, and technical support providers may process information on our behalf where applicable.
- Legal and regulatory authorities: Information may be disclosed when required by applicable law, a valid legal process, or a lawful request.
- Business transfers: Information may be transferred as part of a merger, acquisition, restructuring, or sale of relevant business assets, subject to applicable legal requirements.
- With your authorization: Information may be shared with other parties where you have authorized the disclosure or where another lawful basis applies.
Where appropriate, we seek to ensure that service providers are subject to suitable confidentiality, security, and data-protection obligations.
8. Data Storage and International Transfers
Your information is stored and processed using the systems and infrastructure selected for the Kafaat service.
Depending on the service configuration and the location of our service providers, information may be processed or stored in countries other than the country in which you or your employer are located.
Where applicable law requires safeguards for international transfers, we will take the measures required by that law.
For information about the current hosting location or international transfer arrangements, please contact us using the details provided at the end of this policy.
9. Data Retention
We retain personal information only for as long as reasonably necessary to provide the service, fulfill the purposes described in this policy, maintain appropriate business records, resolve disputes, and comply with legal obligations.
Retention periods may differ depending on the type of information and the requirements applicable to the company using Kafaat.
When information is no longer required, it will be deleted, anonymized, or otherwise handled in accordance with applicable law and our established retention procedures.
Companies using Kafaat are responsible for determining appropriate retention periods for employment records under applicable employment and data-protection laws.
10. Data Security
We take reasonable technical and organizational measures intended to protect information against unauthorized access, disclosure, alteration, loss, or destruction.
Depending on the system configuration, security measures may include:
- Separate company databases.
- Role-based access permissions.
- Authentication and account access controls.
- Security monitoring and technical logs.
- Secure infrastructure and appropriate protection of stored information.
- Procedures for responding to security incidents.
No online service, electronic transmission, or storage system is completely secure. Although we work to protect information, we cannot guarantee absolute security.
11. Cookies and Similar Technologies
Our website or platform may use cookies, local storage, or similar technologies where implemented to maintain sessions, remember preferences, support authentication, improve functionality, or understand service performance.
Where required, we will provide appropriate notice and obtain consent before using non-essential cookies or similar technologies.
You can manage cookies through your browser settings. Disabling certain cookies may affect the availability or functionality of some services.
12. Your Privacy Rights
Depending on your location and applicable law, you may have the right to:
- Request access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request deletion of information where legally permitted.
- Request restriction of certain processing activities.
- Object to certain types of processing where the law provides this right.
- Request a copy of information in a portable format, where applicable.
- Withdraw consent where processing is based on consent.
- Submit a complaint to the relevant data-protection authority.
To exercise a right, please contact us using the details below. We may need to verify your identity and clarify the scope of your request before responding.
If your information is held by your employer through its Kafaat workspace, we may refer your request to the employer or coordinate with the employer, depending on the nature of the request and our respective legal responsibilities.
Nothing in this policy limits rights that cannot lawfully be excluded.
13. Children's Privacy
Kafaat is intended for business and workforce management purposes and is not designed as a service for children.
We do not knowingly seek to collect children's personal information unless it is lawfully required for a legitimate employment-related purpose and appropriately authorized. If you believe that personal information has been collected unlawfully, please contact us so that the matter can be reviewed.
14. Third-Party Services and Links
The Kafaat website or platform may contain links to third-party websites or integrate with third-party services. Those services may operate under their own privacy policies and terms.
We are not responsible for the privacy practices of independent third parties. We encourage users to review the applicable policies before submitting personal information to those services.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technical practices, business operations, or applicable legal requirements.
The revised version will be published on this page with an updated “Last Updated” date. Where required by law, we will provide additional notice or obtain consent for material changes.
16. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to raise a concern about the processing of personal information, please contact Kafaat through the official contact channel provided on our website.
Website: https://kafaatk.com/
Privacy contact email: support@kafaatk.com
Legal entity name: Kafaat
We will review privacy-related inquiries and respond in accordance with applicable legal requirements.