Privacy policy

Introduction

This Privacy Policy describes how Daw Alfada (ضوء الفضاء; “we”, “us”, or “the platform operator”) handles personal data in connection with TIMO, the multi-tenant HR platform available at https://timo.daw-alfada.com and related web and mobile clients.

The platform is used by many independent customer organisations (employers and hiring entities). Users of the platform are not all employees of Daw Alfada, and job postings on public careers pages belong to the company that published them—not automatically to Daw Alfada.

This page is the general privacy policy for the platform. It explains practices in plain language. It is not a certification of legal compliance (for example GDPR or ISO) and does not create absolute security guarantees. Contractual roles between Daw Alfada and each customer organisation are governed by their agreements and applicable law; this policy does not invent or confirm legal classifications that have not been verified.

Roles: platform operator, customer company, and users

Please read the following roles carefully:

Daw Alfada (ضوء الفضاء): the organisation that operates and provides TIMO, the multi-tenant HR platform (hosting, product features, and platform administration).
Customer company (subscriber / tenant): the employer or hiring organisation that uses the platform to manage its own employees and/or job applicants. Each company has its own workspace identified by tenant and company context in the product.
User: a person who interacts with the platform—such as an employee of a customer company, a job applicant to a customer company, or an authorised company administrator—depending on the context.

Responsibilities of each party

In day-to-day operation of the product:

The customer company decides which employee, attendance, payroll, and recruitment data are entered or collected for its own workforce and hiring processes, and configures which features are enabled in its workspace.
Daw Alfada provides the software and infrastructure that process that data so the customer company can use the service, and may process limited account, technical, and operational data needed to run, support, and secure the platform.
Employment and recruitment records shown in a company’s workspace relate to that company. They are not described here as records of Daw Alfada as the employer, unless a specific relationship with Daw Alfada actually applies to you.

Categories of data processed through the platform

Depending on how a customer company and its users use the product, the platform may process the following categories. We only describe categories the product actually supports; unused fields or libraries are not treated as evidence of collection.

Account and identity: sign-in credentials, name, work email, role or permissions, and profile information for users of a company workspace.
Employee HR records: employment and organisational data maintained by the customer company (for example department, job title, leave, loans, contracts, attachments, and related modules enabled for that company).
Recruitment and applications: information submitted on that company’s public careers or apply forms, which may include full name, email, mobile number, address, date of birth, CV/resume file, profile photo, optional LinkedIn profile URL, portfolio links, certificates, and free-text answers configured by that company.
Attendance and workplace presence: check-in and check-out records, including location coordinates when geolocation-based check-in or attendance zones are used, and camera/face images when face enrollment or web check-in features are enabled by that company.
Communications inside the product: notifications, announcements, complaints, and similar messages through features the company has enabled.
Technical and session data: authentication tokens and preferences in the browser (localStorage / sessionStorage), language and theme preferences, and PWA cache for app shell assets. We do not operate a third-party marketing analytics pixel on the public site as of this policy’s date.

How data is used

Personal data processed through the platform is used to:

Provide HR, attendance, payroll-related, recruitment, and related features that the relevant customer company has enabled.
Authenticate users, maintain sessions, and protect accounts and the service.
Process job applications and support that company’s hiring workflows when careers features are used.
Operate optional AI-assisted features inside the product when enabled for a company (based on data already in that company’s workspace).
Communicate service-related messages (for example notifications configured in the product).
Improve reliability, diagnose faults, and secure the platform.

Sharing and service integrations

We do not sell personal data. Data may be shared only as needed to operate the product or as required by law, including:

Within the relevant customer company’s organisation: authorised users of that company’s workspace (according to roles and permissions configured by that company).
Infrastructure and email delivery providers used to host the application, store files, or send transactional email configured for the service.
Maps providers: when attendance zones or map features are used, map display may rely on Google Maps services configured for the deployment.
Face processing components: when face enrollment or verification is enabled, face images are processed through the product’s face gateway components for those features.
Public careers sharing: a company’s job pages may expose Open Graph metadata so that links shared on social networks can show a title, description, and preview image. That is link previews, not an import of social-network private data.

Today, LinkedIn-related behaviour in the product is limited to: optional LinkedIn profile URLs that applicants may provide; optional LinkedIn page links a customer company may configure for its own careers branding; recording “LinkedIn” as an application source when selected; and Open Graph previews when someone shares that company’s careers link.

A planned optional integration would allow an authorised administrator of a customer company to authorise the product to publish job posts to that company’s own LinkedIn Page (the page linked to the company that owns the job)—not to Daw Alfada’s LinkedIn Page by default. Those posts would include a link to apply inside the platform. This publishing integration is not currently implemented; when available, it will be optional and only active after that company enables and authorises it.

If and when enabled for a company, the product would store the connection data needed to publish on that company’s behalf (such as LinkedIn Page identifiers, access tokens issued by LinkedIn for that authorisation, and identifiers of published posts). Exact fields will match the implemented authorisation flow at go-live.

Applications submitted through the apply link open inside our system for the relevant company. We do not claim to import LinkedIn personal profiles, LinkedIn messages, LinkedIn contacts, or LinkedIn Easy Apply applications unless a future feature is built and this policy is updated.

Disconnect or token-deletion behaviour will be described here only after it exists in the product.

Storage and security

Personal data is stored in the systems used to operate the platform (application databases, file storage for uploads such as CVs and photos, and related services).

The product is multi-tenant: customer companies use separate workspaces and access controls in the application. This policy does not claim complete physical or logical isolation of all data, or specific certifications or encryption standards, beyond access controls, authentication, and operational practices that are intended to reduce unauthorised access.

No method of transmission or storage is completely secure; we do not claim absolute security.

Retention and deletion

Retention periods are not fixed in this policy. How long data is kept may differ by customer company, by purpose (for example employment versus recruitment), by feature configuration, and by applicable legal or contractual requirements.

Customer companies may display their own recruitment privacy notice on careers pages. That notice is controlled by the company and may differ from this platform policy.

Employee and operational records are retained while the relevant company’s workspace needs them for HR operations, and thereafter according to that organisation’s instructions and applicable requirements.

Daw Alfada does not promise to delete a customer company’s data solely because someone emails the platform operator. Deletion or correction requests are handled after appropriate identity and authority checks, and may need involvement of the customer company that controls the records, subject to applicable obligations.

Access, correction, and deletion requests

You may request access to, correction of, or deletion of personal data that concerns you, subject to applicable law and to the relationship involved:

Employment and recruitment data held for a customer company: contact that company first, using the contact details shown on its careers page or other channels it makes available. That company controls those records in its workspace.
Platform privacy questions (about this policy or how the platform is operated): email [email protected]. This address is for contacting the platform operator (Daw Alfada). It is not the HR inbox for every customer company.
If you cannot reach the relevant company, you may contact the platform operator at the same address for help routing your request where appropriate. We may need to verify identity and authority, and we may need to involve the customer organisation. We do not guarantee immediate deletion of another company’s records without those checks.
Some requests may be limited where retention is required by law, needed for security, or where disclosing data would affect the rights of others.

Cookies, local storage, and analytics

Sign-in sessions rely primarily on tokens stored in browser localStorage or sessionStorage (including a “Remember me” choice), not on a dedicated third-party advertising cookie stack.

The product may also store language, theme, and similar UI preferences locally, and may use a service worker / PWA cache for application assets.

Embedded media, when used, may load from providers such as YouTube’s privacy-enhanced domain. We do not currently run Google Analytics, Mixpanel, Hotjar, or similar third-party product-analytics scripts on the public site.

Browser cookies may still appear for essential hosting, security, or third-party embeds depending on your browser and the features you use.

Contact and policy updates

For privacy questions about the platform operated by Daw Alfada (ضوء الفضاء), contact: [email protected].

For questions about a specific employer’s hiring or employment data, use that company’s published contact channels (for example the contact email on its public careers page when provided).

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of the service after an update means you should review the revised policy.

Public URL of this platform policy: https://timo.daw-alfada.com/privacy-policy

Product

TIMO

Language