Introduction
This policy explains what personal data the Nawara Alkasser mobile application (the "App") collects, why it is collected, who it is shared with, how long it is kept and how you can have it deleted.
The App is a private business tool. It is not a consumer product. It is used by authorised sales representatives of Nawara Alkasser for Electric Co., Ltd ("we", "us") to record construction projects, log site visits and customer meetings, and track sales outcomes. An account cannot be created without a manager code issued by us, and every new account is approved by a manager before it can be used.
The data controller is:
Nawara Alkasser for Electric Co., Ltd
شركة نوارة القصر للكهرباء المحدودة
8588 Al Amn Al Aam Street, Al Aziziyah District
Jeddah 23334 – 3480, Kingdom of Saudi Arabia
Short address: JCZA8588
Unified National Number: 7001746424Email: info@nawaraalkasser.sa
Phone / WhatsApp: +966 55 336 4916
Website: nawaraalkasser.sa
What we collect, and why
Everything in the table below is linked to your user account. It is collected for one purpose only — operating the App. None of it is used for advertising, none of it is sold, and none of it is used to track you across other companies' apps or websites.
| Data | When it is collected | Why |
|---|---|---|
| Name | You type it when registering | Identifies you to your manager and on records you create |
| Email address | You type it when registering | Sign-in identifier; account verification and security codes |
| Phone number | You type it when registering | Account identification and contact by your manager |
| Account identifier | Generated by us | Links your records to you inside the system |
| Device identifier | Generated on first launch | Recognises the devices you sign in from, so a sign-in from an unknown device can be challenged |
| Precise location | Only when you tap the location button on the map, or capture a visit location | Records where a building is, and where a site visit took place |
| Photos | Only when you take or choose one | Evidence attached to a project or a site visit |
| Audio recordings | Only when you record a voice note | Voice notes attached to a visit or a call |
| Documents you attach | Only when you choose a file | Supporting documents for a project or outcome |
| Business records you create | As you use the App | Projects, activities, meeting notes, stages and sales outcomes |
| Security logs | Automatically | IP address, device description and timestamp of sign-in attempts and other significant account actions, to detect and investigate unauthorised access |
| Push notification token | If you allow notifications | Delivering notifications to your device |
Device permissions
The App asks for five permissions. None is requested when the App launches. The four below are requested at the moment you first use the feature that needs them; notifications are requested once, after you sign in. Every one is optional and can be refused, or withdrawn later, in iOS Settings → Privacy & Security. Refusing one disables the features that rely on it and nothing else — though note that registering a new project requires at least one photograph, so refusing both camera and photo library access will prevent that particular task.
- Location — to pin the building you are registering and to record where a visit took place. Used only while the App is open. The App does not track your location in the background.
- Camera — to photograph buildings and site visits.
- Photo Library — to attach existing photos to a project.
- Microphone — to record voice notes on a visit or call.
Information about other people
In the course of your work you may record the name, phone number, job title and employer of people you meet — site engineers, contractors, consultants and project owners. This is personal data belonging to them, not to you.
You must only record such details where you have a lawful basis to do so, you must tell the person their details are being recorded in our system, and you must not record anything beyond what is needed for the business relationship. We hold these records as controller and will honour any request we receive from those individuals. Requests should be sent to info@nawaraalkasser.sa.
What we do not do
- We do not track you across other companies' apps or websites.
- We do not sell, rent or trade personal data.
- We do not serve advertising, and there is no advertising network in the App.
- We do not use analytics, crash-reporting or audience-measurement SDKs. The App contains no such component.
- We do not build profiles for marketing, nor make decisions about you by automated means alone.
- We do not access your contacts, calendar, health data, or files other than the ones you explicitly attach.
- We do not record audio or capture location in the background, or at any time you have not initiated.
Who your data is shared with
We share personal data only with the service providers listed below, and only to the extent each needs it to perform its function. Each processes that data on our instructions under a contract, and none of them is permitted to use it for their own purposes.
| Provider | What it receives | Purpose |
|---|---|---|
| Google — Firebase Cloud Messaging | A push notification token and the notification content | Delivering push notifications to your device |
| Google — Maps SDK | Map view coordinates, when you open the map screen | Rendering the map you pick a location on |
| Amazon Web Services (S3, KMS) | Photos, voice notes and documents you attach | Encrypted file storage |
| Hostinger | All application data | Hosting the application server and database |
| Resend (transactional email) | Your email address and the message content | Sending verification codes and account emails |
Inside our organisation, your manager and authorised administrators can see the records you create and your account details, because that is the purpose of the system. We may also disclose data where we are legally required to do so, or to establish or defend a legal claim.
International transfers
Personal data described in this policy is stored and processed outside the Kingdom of Saudi Arabia:
- All application data — your account details, the business records you create and our security logs are held on the application server and database, which are hosted by Hostinger on infrastructure located in France.
- Files you attach — photos, voice notes and documents are stored on Amazon Web Services infrastructure located in the United States. They are encrypted at rest using managed encryption keys, and access is restricted to our application.
- The remaining providers listed above — Google, Resend — process the limited data shown in the table on infrastructure outside the Kingdom.
Data is encrypted in transit to all of these destinations. Each provider acts on our instructions under a contract and is not permitted to use personal data for its own purposes.
Legal basis for processing
We process your personal data under the Personal Data Protection Law of the Kingdom of Saudi Arabia, on these bases:
- Performance of a contract — your employment or engagement with us, and your use of a tool provided for that work. This covers the camera, photo library, microphone and precise location features, which are necessary to carry out the work the App exists for: registering buildings, evidencing site visits and recording voice notes.
- Legitimate interests — operating, securing and improving a business system, and keeping records of commercial activity.
- Consent — for push notifications. This is optional and can be withdrawn at any time in iOS Settings.
- Legal obligation — where we must retain records to comply with applicable law.
How long we keep it
- Your account details — until you delete your account, or until your engagement with us ends.
- Business records you created (projects, activities, outcomes and their attachments) — retained as company commercial records for as long as we need them for the purposes described in this policy, and for any longer period required by applicable Saudi commercial and tax record-keeping law, because they document business activity rather than describe you. After you delete your account these records remain, but they are no longer linked to your name, email or phone number.
- Security and audit logs — retained for the operational life of the system. These records include your account identifier, the IP address and device description of the action, and its timestamp. They are kept to detect and investigate unauthorised access, and are not used for any other purpose.
- Deletion audit record — retained indefinitely. It records that a deletion happened, when, that you requested it yourself, and your account identifier and originating IP address. It does not contain your name, email address or phone number.
Deleting your account
You can delete your account from inside the App at any time, without contacting anyone:
Profile → Delete account — confirm with your password, type the confirmation word, and confirm the final prompt.
Deletion is immediate and cannot be undone. When you delete your account:
- Your name, email address and phone number are permanently overwritten.
- Your password and any second-factor secrets are destroyed; the account can never be signed into again.
- All your devices are unlinked and push notifications stop immediately.
- Your notification settings are erased.
- Your email address and phone number are released, so they can be used to register again.
- Business records you created remain as company records, no longer linked to your identity, as described in Section 6.
- Security and audit logs written before the deletion are not erased. They continue to hold your account identifier, and the IP address and device description recorded at the time of each action. They no longer hold your name, email address or phone number, because those have been overwritten.
You may also email info@nawaraalkasser.sa to request deletion. We will respond within 30 days.
Your rights
You have the right to:
- Be informed of how your personal data is processed — this document.
- Access a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, as described in Section 7.
- Withdraw your consent to push notifications at any time, in iOS Settings. You can also turn off the camera, photo library, microphone and location permissions there, though doing so disables the features that depend on them.
- Receive your personal data in a portable format.
To exercise any of these, email info@nawaraalkasser.sa. We will respond within 30 days. We may need to verify your identity first.
Security
- All traffic between the App and our servers uses HTTPS/TLS encryption.
- Passwords are stored only as salted cryptographic hashes and are never recoverable.
- Authentication tokens are held in the device's secure keychain.
- Uploaded files are encrypted at rest with managed encryption keys.
- Signing in from an unrecognised device requires an additional one-time code sent to your email.
- Repeated failed sign-in attempts temporarily lock the account.
- Access to personal data inside our organisation is limited to staff who need it, and administrative actions are logged.
No system is perfectly secure. If a breach affects your personal data we will notify you and the competent authority as required by law.
Children
The App is a workplace tool for employed sales representatives. It is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your personal data, we will notify you in the App or by email before it takes effect. Continuing to use the App after a change takes effect means you accept the updated policy.
Contact
For any question about this policy or about your personal data:
- Email: info@nawaraalkasser.sa
- Phone / WhatsApp: +966 55 336 4916
- Post: Nawara Alkasser for Electric Co., Ltd, 8588 Al Amn Al Aam Street, Al Aziziyah District, Jeddah 23334 – 3480, Kingdom of Saudi Arabia (short address JCZA8588)