ZYAThis Privacy Policy explains how ZYA Products (referred to as "ZYA", "We", "Us" or "Our") collects, uses, stores, shares and protects Personal Data in connection with the ZYA website and ZYA Talent, Our workforce and human-resources management platform.
ZYA Talent may be accessed through mobile applications, including applications made available for Apple iOS and Google Android devices, web interfaces and related services. ZYA Talent is primarily a business-to-business service used by employers and other organizations ("Customer Organizations"). A Customer Organization may provide, control or require processing of employee and workforce information through ZYA Talent.
Depending on the circumstances and applicable law, the Customer Organization may act as the controller or other responsible party for workforce Personal Data, while ZYA acts as a service provider or processor on its behalf. ZYA may also process limited Personal Data for its own purposes, including account security, service operation, fraud prevention, support and legal compliance.
This Privacy Policy should be read together with any privacy notices, employment policies, consents or instructions provided by the relevant Customer Organization.
1. Scope
This Privacy Policy applies to the ZYA website, ZYA Talent mobile applications, including iOS and Android applications, ZYA Talent web applications, and related authentication, notification, support, hosting and application services that link to this Privacy Policy.
It does not govern independent websites, applications or services operated by third parties.
2. Definitions
Account means a user identity used to authenticate to and access ZYA Talent or another ZYA Service.
Customer Organization means an employer, company or other organization that subscribes to, administers or uses ZYA Talent.
Country refers to Saudi Arabia.
Device means a computer, mobile phone, tablet or other device used to access the Service.
Personal Data means information relating to an identified or identifiable individual.
Service means the ZYA website, ZYA Talent mobile and web applications, and related services covered by this Privacy Policy.
Service Provider means a third party that processes data or provides infrastructure or technology services in connection with the Service.
Usage Data means technical, diagnostic, security and interaction information generated through use of the Service.
User or You means an employee, manager, administrator, authorized representative, website visitor or other person accessing or using the Service.
Website refers to ZYA, accessible from https://www.zyaa.ai.
3. Roles and Responsibilities for Workforce Data
ZYA Talent is designed to help Customer Organizations manage employment and workforce processes. Customer Organizations generally determine which employee records are entered into ZYA Talent, why those records are processed, who may access them, how long they must be retained and which employment or legal obligations apply.
Users should direct questions, correction requests, objections and requests concerning employment records controlled by their employer to the relevant Customer Organization in the first instance. ZYA will support Customer Organizations with valid requests where required by contract or applicable law.
4. Personal Data We May Process
Account and Identity Information
This may include name, work email address, user identifier, login and authentication information, account status, company or tenant association, role and access permissions.
Employee and Organizational Information
This may include employee number or identifier, job title, position, department, division, business unit, branch or work location, manager, employment status, employment dates and other workforce profile information supplied by the Customer Organization.
Contact and Profile Information
This may include work email address, telephone number and other contact or profile information made available by the Customer Organization or User.
Banking Information
Where enabled by the Customer Organization, ZYA Talent may process employment-related banking information such as bank name, account number, International Bank Account Number (IBAN) or similar banking information supplied by the Customer Organization or User.
ZYA Talent does not use this banking information to process consumer purchases or payments through the mobile application. Such information may be maintained as part of an employee's administrative employment record.
Attendance and Working-Time Information
This may include clock-in and clock-out events, break events, schedules, shifts, attendance status, lateness or variance information, attendance correction requests, approvals and related audit records.
Location Information
ZYA Talent may process approximate or precise Device location, including latitude, longitude, location accuracy and related information, when required for attendance functions such as clock-in, clock-out and work-location or geofence verification.
ZYA Talent is designed to use location in connection with active attendance functions and does not require continuous background location tracking.
Leave and Absence Information
This may include leave types, leave requests, dates, balances, entitlements, adjustments, approvals, supporting information and absence records.
Schedule Information
This may include work schedules, assigned shifts, schedule changes, requests and approvals.
Performance and Development Information
This may include KPIs, objectives, ratings, review information, manager feedback, development activities, review-cycle information and related performance records.
Requests, Approvals and Workflow Records
This may include requests submitted through ZYA Talent, request status, comments, approver actions, timestamps and audit information.
Documents, Photographs and Attachments
Users or Customer Organizations may choose to upload documents, files, photographs, images or other attachments in connection with supported ZYA Talent workflows. This may include employee documents, certificates, supporting documentation, profile images or other employment-related content.
The content of uploaded files may contain Personal Data depending on the information provided by the User or Customer Organization.
Device, Technical and Security Information
This may include Device type, operating system, application version, IP address, network information, application or technical identifiers, diagnostic events, security events, timestamps and similar technical information needed to operate, protect and secure the Service.
Push Notification Information
ZYA Talent may process push-notification registration tokens and related technical information necessary to deliver notifications to a User's Device.
Support Communications
We may process information supplied when You contact ZYA for technical support, privacy inquiries or other Service-related communications.
Website and Cookie Information
Where applicable, We may process browser information, IP address, pages visited, session information, preferences and cookie or similar technology data used to operate, secure and improve the Website.
5. Biometric Authentication
ZYA Talent may support biometric authentication through Device and operating-system security features, including Apple Face ID, Apple Touch ID, Android fingerprint authentication or other supported native biometric authentication mechanisms.
When the Device's native biometric authentication mechanism is used, ZYA Talent does not receive or store the underlying fingerprint image, facial image, biometric template or other underlying biometric measurement used by the Device to authenticate the User.
The Device or operating system performs the biometric comparison and returns an authentication result to the application.
ZYA may process limited security information necessary to enable or record the authentication workflow.
6. How We Use Personal Data
We may use Personal Data for purposes including:
- Providing, operating, maintaining and securing ZYA Talent and related services.
- Authenticating Users and enforcing roles, permissions and Customer Organization or tenant access boundaries.
- Providing employee, manager and HR workflows configured by Customer Organizations.
- Maintaining employee contact, profile and administrative employment records.
- Maintaining employment-related banking information where configured by the Customer Organization.
- Recording and administering attendance, schedules, leave, performance, requests and approvals.
- Verifying attendance location or geofence requirements when a User initiates a location-dependent attendance function.
- Managing documents, photographs and other attachments uploaded through supported workflows.
- Delivering operational push notifications and Service communications.
- Maintaining audit trails, investigating errors, preventing misuse and protecting the security and integrity of the Service.
- Providing technical support, diagnosing problems and improving reliability and performance.
- Complying with contracts, legal obligations, lawful requests, dispute requirements and applicable regulatory duties.
- Establishing, exercising or defending legal claims and protecting the rights, safety and property of ZYA, Customer Organizations and Users.
7. Legal Bases and Authorization
The legal basis for processing depends on the context, the relationship between the User and Customer Organization, and applicable law. Processing may be necessary to perform a contract, provide requested services, comply with legal or employment obligations, pursue legitimate operational or security interests, or act on valid consent where consent is the appropriate legal basis.
Customer Organizations are responsible for ensuring they have an appropriate legal basis and authority for workforce Personal Data they instruct ZYA to process.
8. Location Data and Permissions
ZYA Talent may request foreground location permission when location is necessary for an attendance feature. For example, the Service may compare a User's Device location with the coordinates or permitted radius of an assigned work location.
Location records associated with attendance may be linked to the relevant User and retained as part of the Customer Organization's attendance and audit records.
Users may deny or revoke location permissions through their Device settings. If location permission is denied, location-dependent attendance functions may be unavailable or may require an alternative process determined by the Customer Organization.
The ZYA Talent mobile application does not require continuous background location permission for its standard attendance functionality.
9. Push Notifications
ZYA Talent may use push notifications for operational messages such as workflow updates, reminders, approvals or other Service communications. Technical registration tokens and related information may be processed to route notifications to the appropriate Device.
Push notification delivery may rely on platform and technology providers, including Apple Push Notification service (APNs), Google and Firebase services, as applicable to the User's Device and the configuration of the Service.
Users can manage notification permissions through Device settings, although disabling notifications may prevent timely receipt of Service messages.
10. Sharing and Service Providers
ZYA does not sell employee Personal Data.
ZYA does not use employee Personal Data collected through ZYA Talent for third-party advertising or for tracking Users across applications or websites owned by other companies.
Personal Data may be made available to the relevant Customer Organization and its authorized Users according to configured permissions. ZYA may also use Service Providers and infrastructure providers to operate the Service.
These may include:
- Supabase and related cloud infrastructure: database, authentication, storage and backend services used by ZYA Talent.
- Apple services: iOS platform services, push-notification delivery, Device security and other platform functionality where applicable.
- Google and Firebase services: push-notification delivery, Android platform services, mapping and location presentation, and related technical services where enabled.
- Hosting, security and technical Service Providers: infrastructure, monitoring, support, security or operational services necessary to provide ZYA services.
Personal Data may also be disclosed where required by law, court order or lawful governmental request; to investigate fraud, abuse or security incidents; in connection with a corporate transaction; or with the relevant person's authorization.
Service Providers are expected to process data only for authorized purposes and subject to appropriate contractual and security controls.
11. International and Cross-Border Processing
ZYA operates from Saudi Arabia, but some technology providers or infrastructure used to deliver the Service may process or store data in other jurisdictions.
Where Personal Data is transferred across borders, ZYA and/or the relevant Customer Organization will apply appropriate contractual, organizational and legal safeguards as required by applicable law, including requirements applicable to international transfers of Personal Data.
12. Data Security
ZYA uses technical and organizational safeguards designed to protect Personal Data against unauthorized access, loss, misuse, alteration or disclosure.
Measures may include authenticated access, role-based permissions, tenant isolation, encrypted network communications, private storage controls, access logging, secure credential handling and security monitoring.
No electronic system can be guaranteed to be completely secure, and Users and Customer Organizations must also protect their credentials and Devices.
13. Data Retention and Deletion
ZYA Talent is a business-to-business workforce management platform provided to employers and other Customer Organizations. User accounts are created, provisioned and managed by the relevant Customer Organization. ZYA Talent does not provide individual employees with a direct public account-registration process.
Personal Data processed through ZYA Talent is retained for the duration of the Customer Organization's use of the Service and for one year following termination of the Customer Organization's contract with ZYA, unless a longer retention period is required by applicable law, contractual obligations, regulatory requirements, legal proceedings, security requirements, or the lawful instructions of the Customer Organization.
Because employee accounts and employment records are created and managed by the Customer Organization, individual Users cannot independently delete their ZYA Talent account or require ZYA to delete employment records controlled by their employer.
Users who have questions or concerns regarding their Personal Data, or who wish to request access, correction or deletion where applicable, should contact their employer or Customer Organization in the first instance. Users may also contact ZYA at support@zyaa.ai.
Where ZYA receives a request concerning Personal Data controlled by a Customer Organization, ZYA may refer the request to that organization and will assist with valid requests in accordance with applicable law and ZYA's contractual obligations.
Uninstalling the ZYA Talent application from a Device does not delete the User's account or employment records.
14. Individual Privacy Rights
Subject to applicable law and any limitations applicable to employment records, individuals may have rights concerning their Personal Data. These may include rights to:
- Be informed about the processing of their Personal Data.
- Access Personal Data concerning them.
- Request correction of inaccurate or incomplete Personal Data.
- Request deletion or destruction where applicable and legally permitted.
- Obtain a copy of certain Personal Data where applicable.
- Withdraw consent where processing is based on consent.
- Raise a complaint with the appropriate authority.
Because ZYA Talent is used by employers, a request concerning an employment record may need to be handled by the relevant Customer Organization. ZYA will reasonably cooperate with verified requests and Customer Organization instructions as required.
15. Saudi Arabia and Applicable Data Protection Law
ZYA operates from Saudi Arabia and seeks to handle Personal Data in accordance with applicable Saudi data-protection requirements, including the Personal Data Protection Law and its implementing framework where applicable.
Customer Organizations remain responsible for their own compliance obligations as controllers or responsible parties for employee and workforce information.
16. Tracking Technologies and Cookies
The ZYA Website may use necessary session technologies and, where implemented, cookies or similar technologies for authentication, security, preferences, analytics or Service operation.
Users can control browser cookies through their browser settings, although blocking necessary cookies may affect functionality. Mobile application authentication or secure-storage mechanisms may differ from traditional browser cookies.
ZYA Talent does not use employee Personal Data for cross-app or cross-website advertising tracking.
17. Children's Privacy
ZYA Talent is a workforce-management Service and is not directed to children for personal or consumer use.
Customer Organizations are responsible for ensuring that any use involving younger workers is lawful and subject to appropriate employment, consent and privacy requirements.
18. Third-Party Links and Services
The Service may contain links to or integrate with third-party services. Third parties may have their own privacy notices and terms. ZYA is not responsible for independent third-party processing that is outside ZYA's control.
19. Business Transfers and Legal Disclosures
Information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, subject to appropriate confidentiality and legal protections.
ZYA may also disclose information when reasonably necessary to comply with law, respond to lawful requests, enforce agreements, investigate wrongdoing, protect security or defend legal rights.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in ZYA Talent, Our business practices, Service Providers, legal requirements, platform requirements or security practices.
The revised Privacy Policy will state its effective or last-updated date. Where required, We will provide additional notice of material changes.
21. Contact Us
For privacy questions, requests or concerns relating to ZYA or ZYA Talent, You can contact Us:
Service: ZYA Products / ZYA Talent
Website: https://www.zyaa.ai
Email: support@zyaa.ai
Country: Saudi Arabia