ZYAThis Privacy Policy explains how ZYA Innovations (referred to as “ZYA”, “we”, “us” or “our”) collects, uses, stores, shares and protects Personal Data in connection with the ZYA website and ZYA products and services that link to this Privacy Policy.
ZYA is a software and AI-driven innovation company based in Saudi Arabia. Our products and services include software platforms, business applications, AI systems and related digital services.
Certain ZYA products, including ZYA Talent, may process Personal Data on behalf of businesses and other organizations that use those products. In those circumstances, the relevant customer organization may determine the purposes and means of processing Personal Data, while ZYA acts as a service provider or processor on its behalf.
This Privacy Policy should be read together with any product-specific notices, customer agreements, employment policies, consents or instructions that may apply.
1. Scope
This Privacy Policy applies to:
- the ZYA website at www.zyaa.ai;
- website contact, enquiry, demo-request and waitlist services;
- ZYA Talent mobile applications for Apple iOS and Google Android;
- ZYA Talent web applications;
- other ZYA products or services that expressly link to this Privacy Policy; and
- related authentication, notification, support, hosting and application services.
Certain ZYA products may be governed by additional product-specific privacy notices, terms or customer agreements.
This Privacy Policy does not govern independent websites, applications or services operated by third parties.
2. Definitions
Account means a user identity used to authenticate to and access a ZYA product or service.
Customer Organization means an employer, company or other organization that subscribes to, administers or uses a ZYA product or service.
Country refers to Saudi Arabia.
Device means a computer, mobile phone, tablet or other device used to access a ZYA service.
Personal Data means information relating to an identified or identifiable individual.
Service means the ZYA website and ZYA products, applications and related services covered by this Privacy Policy.
Service Provider means a third party that processes data or provides infrastructure or technology services in connection with a ZYA service.
Usage Data means technical, diagnostic, security and interaction information generated through use of a ZYA service.
User or You means a website visitor, employee, manager, administrator, authorized representative or other person accessing or using a ZYA service.
Website means the ZYA website available at www.zyaa.ai.
3. Website Visitors, Enquiries and Demo Requests
When You interact with the ZYA website, We may collect Personal Data that You voluntarily provide.
This may include:
- name;
- work email address;
- telephone number;
- company or organization;
- product or service of interest;
- enquiry type;
- information included in a message or enquiry;
- demo-request information;
- partnership enquiries;
- marketing or product-update preferences; and
- other information You choose to provide.
The Website may also record information associated with the submission, including the page from which an enquiry was submitted, referring page or website, campaign or UTM information where available, submission time and technical or security information used to operate and protect the Website.
We use this information to respond to enquiries, arrange product demonstrations, discuss potential commercial relationships, provide requested information, manage sales and business-development communications, operate the Website and protect against spam, abuse and security threats.
Submitting an enquiry does not create a customer relationship or obligate ZYA to provide any product or service.
4. Product Waitlists and Product Updates
Where ZYA provides a waitlist or product-update registration, such as the ZYA Suite waitlist, We may collect Your email address and information associated with the registration, including source or campaign information where available.
We use this information to manage the waitlist and, where appropriate and permitted, communicate information about the relevant product, availability, launch or related updates.
Where consent is relied upon for optional marketing communications, You may withdraw that consent or unsubscribe from those communications.
Operational communications relating to a request You have made may be treated separately from optional marketing communications.
5. Roles and Responsibilities for Workforce Data
ZYA Talent is designed to help Customer Organizations manage employment and workforce processes.
Customer Organizations generally determine which employee records are entered into ZYA Talent, why those records are processed, who may access them, how long they must be retained and which employment or legal obligations apply.
Depending on the circumstances and applicable law, the Customer Organization may act as the controller or other responsible party for workforce Personal Data, while ZYA acts as a service provider or processor on its behalf.
ZYA may also process limited Personal Data for its own purposes where appropriate, including account security, service operation, fraud prevention, support and legal compliance.
Users should direct questions, correction requests, objections and requests concerning employment records controlled by their employer to the relevant Customer Organization in the first instance. ZYA will support Customer Organizations with valid requests where required by contract or applicable law.
6. Personal Data Processed Through ZYA Talent
Account and Identity Information
This may include name, work email address, user identifier, login and authentication information, account status, company or tenant association, role and access permissions.
Employee and Organizational Information
This may include employee number or identifier, job title, position, department, division, business unit, branch or work location, manager, employment status, employment dates and other workforce profile information supplied by the Customer Organization.
Contact and Profile Information
This may include work email address, telephone number and other contact or profile information made available by the Customer Organization or User.
Banking Information
Where enabled by the Customer Organization, ZYA Talent may process employment-related banking information such as bank name, account number, International Bank Account Number (IBAN) or similar banking information supplied by the Customer Organization or User.
ZYA Talent does not use this banking information to process consumer purchases or payments through the mobile application. Such information may be maintained as part of an employee's administrative employment record.
Attendance and Working-Time Information
This may include clock-in and clock-out events, break events, schedules, shifts, attendance status, lateness or variance information, attendance correction requests, approvals and related audit records.
Location Information
ZYA Talent may process approximate or precise Device location, including latitude, longitude, location accuracy and related information, when required for attendance functions such as clock-in, clock-out and work-location or geofence verification.
ZYA Talent is designed to use location in connection with active attendance functions and does not require continuous background location tracking for its standard attendance functionality.
Leave and Absence Information
This may include leave types, leave requests, dates, balances, entitlements, adjustments, approvals, supporting information and absence records.
Schedule Information
This may include work schedules, assigned shifts, schedule changes, requests and approvals.
Performance and Development Information
This may include KPIs, objectives, ratings, review information, manager feedback, development activities, review-cycle information and related performance records.
Requests, Approvals and Workflow Records
This may include requests submitted through ZYA Talent, request status, comments, approver actions, timestamps and audit information.
Documents, Photographs and Attachments
Users or Customer Organizations may choose to upload documents, files, photographs, images or other attachments in connection with supported ZYA Talent workflows.
This may include employee documents, certificates, supporting documentation, profile images or other employment-related content.
The content of uploaded files may contain Personal Data depending on the information provided by the User or Customer Organization.
Device, Technical and Security Information
This may include Device type, operating system, application version, IP address, network information, application or technical identifiers, diagnostic events, security events, timestamps and similar technical information needed to operate, protect and secure the Service.
Push Notification Information
ZYA Talent may process push-notification registration tokens and related technical information necessary to deliver notifications to a User's Device.
Support Communications
We may process information supplied when You contact ZYA for technical support, privacy enquiries or other Service-related communications.
7. Biometric Authentication
ZYA Talent may support biometric authentication through Device and operating-system security features, including Apple Face ID, Apple Touch ID, Android fingerprint authentication or other supported native biometric authentication mechanisms.
When the Device's native biometric authentication mechanism is used, ZYA Talent does not receive or store the underlying fingerprint image, facial image, biometric template or other underlying biometric measurement used by the Device to authenticate the User.
The Device or operating system performs the biometric comparison and returns an authentication result to the application.
ZYA may process limited security information necessary to enable or record the authentication workflow.
8. How We Use Personal Data
Depending on the Service and context, We may use Personal Data to:
- operate, maintain and secure ZYA websites, products and services;
- respond to enquiries and communications;
- arrange product demonstrations;
- manage prospective and existing business relationships;
- administer product waitlists and requested product updates;
- authenticate Users;
- enforce roles, permissions and Customer Organization or tenant access boundaries;
- provide employee, manager and HR workflows configured by Customer Organizations;
- maintain employee contact, profile and administrative employment records;
- maintain employment-related banking information where configured by the Customer Organization;
- administer attendance, schedules, leave, performance, requests and approvals;
- verify attendance location or geofence requirements when a User initiates a location-dependent attendance function;
- manage documents, photographs and other attachments uploaded through supported workflows;
- deliver operational notifications and Service communications;
- maintain audit trails;
- prevent spam, fraud, abuse or unauthorized use;
- investigate errors and security events;
- provide technical support;
- diagnose problems and improve reliability and performance;
- comply with contractual and legal obligations;
- respond to lawful requests;
- establish, exercise or defend legal claims; and
- protect the rights, security and property of ZYA, Customer Organizations and Users.
9. Legal Bases and Authorization
The legal basis or other lawful authorization for processing Personal Data depends on the circumstances, the Service, the relationship between the parties and applicable law.
Processing may, as applicable, be necessary to:
- perform or take steps in connection with a contract;
- provide a Service or respond to a request;
- comply with legal, regulatory or employment obligations;
- pursue legitimate operational, commercial or security purposes where permitted;
- protect legal rights and information systems; or
- act on valid consent where consent is the appropriate basis.
Customer Organizations are responsible for ensuring they have appropriate authority and a lawful basis for workforce Personal Data they instruct ZYA to process.
10. Location Data and Permissions
ZYA Talent may request foreground location permission when location is necessary for an attendance feature.
For example, the Service may compare a User's Device location with the coordinates or permitted radius of an assigned work location.
Location records associated with attendance may be linked to the relevant User and retained as part of the Customer Organization's attendance and audit records.
Users may deny or revoke location permissions through their Device settings. If location permission is denied, location-dependent attendance functions may be unavailable or may require an alternative process determined by the Customer Organization.
ZYA Talent does not require continuous background location permission for its standard attendance functionality.
11. Push Notifications
ZYA Talent may use push notifications for operational messages such as workflow updates, reminders, approvals or other Service communications.
Technical registration tokens and related information may be processed to route notifications to the appropriate Device.
Push-notification delivery may rely on platform and technology providers, including Apple Push Notification service (APNs), Google and Firebase services, as applicable to the User's Device and configuration of the Service.
Users can manage notification permissions through Device settings, although disabling notifications may prevent timely receipt of Service messages.
12. Website Technologies, Analytics and Cookies
The Website may process technical information necessary to deliver, secure and maintain the Website. Depending on the technologies enabled, this may include browser or Device information, IP address, pages visited, referring information, session information and technical or security events.
The Website may also process source, referral and campaign information, including UTM parameters, where available, in connection with website enquiries or registrations.
Where cookies or similar technologies are implemented, they may be used for necessary website operation, security, preferences, analytics or other disclosed purposes.
Users can control browser cookies through their browser settings, although blocking technologies necessary for operation may affect Website functionality.
ZYA does not use employee Personal Data collected through ZYA Talent for cross-app or cross-website advertising tracking.
13. Sharing and Service Providers
ZYA does not sell employee Personal Data.
ZYA does not use employee Personal Data collected through ZYA Talent for third-party advertising or for tracking Users across applications or websites owned by other companies.
Depending on the Service, Personal Data may be processed by or made available to:
- the relevant Customer Organization and its authorized Users;
- Supabase and related cloud infrastructure, for database, authentication, storage, backend and application services;
- Resend, for transactional email delivery associated with Website enquiries and registrations;
- Google Workspace and related Google services, for business email and communications;
- Apple services, for iOS platform functionality, Device security and push-notification delivery where applicable;
- Google and Firebase services, for Android platform functionality, push-notification delivery, mapping, location presentation and related technical services where enabled; and
- hosting, security, monitoring, support and other technology providers necessary to operate ZYA services.
Personal Data may also be disclosed:
- where required by applicable law, court order or lawful governmental request;
- to investigate fraud, abuse or security incidents;
- to establish, exercise or defend legal rights;
- in connection with a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction; or
- with the relevant person's authorization.
Service Providers are expected to process information only for authorized purposes and subject to appropriate contractual, organizational and security controls.
14. International and Cross-Border Processing
ZYA operates from Saudi Arabia, but some technology providers or infrastructure used to deliver ZYA services may process or store data in other jurisdictions.
Where Personal Data is transferred across borders, ZYA and/or the relevant Customer Organization will apply appropriate contractual, organizational and legal safeguards as required by applicable law, including requirements applicable to international transfers of Personal Data.
15. Data Security
ZYA uses technical and organizational safeguards designed to protect Personal Data against unauthorized access, loss, misuse, alteration or disclosure.
Depending on the Service, these measures may include:
- authenticated access;
- role-based permissions;
- tenant isolation;
- row-level access controls;
- restricted database privileges;
- encrypted network communications;
- private storage controls;
- secure credential and secret management;
- access and audit logging; and
- security monitoring and anti-abuse controls.
No electronic system can be guaranteed to be completely secure. Users and Customer Organizations are also responsible for protecting their credentials and Devices.
16. Data Retention and Deletion
Website Enquiries and Registrations
Personal Data submitted through the Website may be retained for as long as reasonably necessary to respond to the request, manage the resulting business relationship, maintain appropriate business records, administer requested communications, protect against abuse, resolve disputes and satisfy legal or regulatory requirements.
Waitlist information may be retained while the relevant registration remains active or while reasonably necessary for the purpose for which it was submitted, subject to applicable law and any valid withdrawal, objection or deletion rights.
ZYA Talent
ZYA Talent is a business-to-business workforce management platform provided to employers and other Customer Organizations.
User accounts are created, provisioned and managed by the relevant Customer Organization. ZYA Talent does not provide individual employees with a direct public account-registration process.
Personal Data processed through ZYA Talent is retained for the duration of the Customer Organization's use of the Service and for one year following termination of the Customer Organization's contract with ZYA, unless a longer retention period is required by applicable law, contractual obligations, regulatory requirements, legal proceedings, security requirements or the lawful instructions of the Customer Organization.
Because employee accounts and employment records are created and managed by the Customer Organization, individual Users cannot independently delete their ZYA Talent account or require ZYA to delete employment records controlled by their employer.
Users who have questions or concerns regarding employment Personal Data should contact their employer or Customer Organization in the first instance.
Users may also contact ZYA using the details provided in Section 24.
Where ZYA receives a request concerning Personal Data controlled by a Customer Organization, ZYA may refer the request to that organization and will assist with valid requests in accordance with applicable law and contractual obligations.
Uninstalling the ZYA Talent application from a Device does not delete the User's account or employment records.
17. Individual Privacy Rights
Subject to applicable law and any limitations applicable to particular records, individuals may have rights concerning their Personal Data, including rights to:
- be informed about processing of their Personal Data;
- access Personal Data concerning them;
- request correction of inaccurate or incomplete Personal Data;
- request deletion or destruction where applicable and legally permitted;
- obtain a copy of certain Personal Data where applicable;
- withdraw consent where processing is based on consent; and
- raise a complaint with the appropriate authority.
Because ZYA Talent is used by employers, requests concerning employment records may need to be handled by the relevant Customer Organization.
ZYA will reasonably cooperate with verified requests and Customer Organization instructions as required by applicable law.
18. Saudi Arabia and Applicable Data Protection Law
ZYA operates from Saudi Arabia and seeks to handle Personal Data in accordance with applicable Saudi data-protection requirements, including the Personal Data Protection Law and its implementing framework, where applicable.
Customer Organizations remain responsible for their own compliance obligations as controllers or other responsible parties for employee and workforce information.
19. Marketing Communications
Where You choose to receive optional product, company or marketing communications from ZYA, We may use the contact information You provide for those purposes in accordance with applicable law.
You may withdraw consent or unsubscribe from optional marketing communications using the method provided in the communication or by contacting ZYA.
Withdrawal from optional marketing communications does not prevent ZYA from sending operational, transactional, security or other non-marketing communications where appropriate.
20. Children's Privacy
ZYA's business software and services are not directed to children for personal or consumer use.
ZYA Talent is a workforce-management service. Customer Organizations are responsible for ensuring that any use involving younger workers is lawful and subject to appropriate employment, consent and privacy requirements.
21. Third-Party Links and Services
ZYA services may contain links to or integrate with third-party websites, applications or services.
Third parties may have their own privacy notices and terms. ZYA is not responsible for independent third-party processing outside ZYA's control.
22. Business Transfers and Legal Disclosures
Information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, subject to appropriate confidentiality and legal protections.
ZYA may also disclose information where reasonably necessary to comply with applicable law, respond to lawful requests, enforce agreements, investigate wrongdoing, protect security or defend legal rights.
23. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in ZYA products or services, Website functionality, business practices, Service Providers, legal requirements, platform requirements or security practices.
The revised Privacy Policy will state its effective or last-updated date.
Where required by applicable law, We will provide additional notice of material changes.
24. Contact Us
For privacy questions, requests or concerns relating to ZYA or a ZYA product or service, You can contact Us:
Company: ZYA Innovations
Website: www.zyaa.ai
Email: info@zyaa.ai
Country: Saudi Arabia