Data Processing Agreement

Last updated: March 2026

Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between Mosyr ("Processor") and the subscribing organization ("Controller") for the use of the Mosyr HRMS platform. This DPA governs the processing of personal data by Mosyr on behalf of the Controller, in compliance with the Saudi Personal Data Protection Law (PDPL).

Definitions

"Personal Data" means any data relating to an identified or identifiable natural person. "Processing" means any operation performed on personal data, including collection, storage, modification, retrieval, use, disclosure, or deletion. "Data Subject" means the individual to whom the personal data relates. "Controller" refers to the subscribing organization that determines the purposes and means of processing. "Processor" refers to Mosyr, which processes data on behalf of the Controller.

Categories of Data Processed

Mosyr processes the following categories of personal data on behalf of the Controller:

  • Employee identity data: names, ID numbers, dates of birth, nationalities, photographs
  • Employment data: job titles, departments, contract details, salary information
  • Financial data: bank details, IBAN, GOSI contributions, payroll records
  • Attendance and leave data: clock-in/out times, leave balances, absence records
  • System access data: user credentials, login history, audit logs

Legal Basis for Processing

Data processing is conducted based on: the contractual necessity to provide the HRMS service, the Controller's legitimate interest in managing their workforce, compliance with Saudi labor laws and regulations (including GOSI and WPS requirements), and where applicable, the consent of the data subject.

Data Retention

Personal data is retained for the duration of the subscription agreement plus a 30-day grace period for data export. After this period, data is permanently deleted unless retention is required by Saudi law (such as payroll records required to be kept for a minimum period). The Controller may request early deletion of specific data at any time, subject to legal retention requirements.

Cross-Border Data Transfers

Mosyr primarily stores and processes data within the Kingdom of Saudi Arabia. In the event that data transfer outside the Kingdom is necessary for service operation, Mosyr will ensure compliance with PDPL requirements for cross-border transfers, including obtaining necessary approvals and implementing adequate safeguards.

Security Measures

Mosyr implements the following technical and organizational security measures:

  • Encryption: TLS 1.3 for data in transit, AES-256 encryption for data at rest
  • Access control: role-based access control (RBAC), multi-factor authentication, and principle of least privilege
  • Infrastructure: secured cloud infrastructure with firewall protection, intrusion detection, and DDoS mitigation
  • Monitoring: continuous security monitoring, regular vulnerability assessments, and penetration testing

Data Breach Notification

In the event of a personal data breach, Mosyr will notify the Controller without undue delay and in no case later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

Sub-processors

Mosyr may engage sub-processors to assist in providing the Service. We maintain a list of current sub-processors and will notify the Controller before adding or replacing sub-processors. All sub-processors are bound by data processing terms no less protective than those in this DPA.

Data Subject Rights

Mosyr will assist the Controller in fulfilling data subject requests under the PDPL, including requests for access, rectification, erasure, and data portability. Mosyr will respond to the Controller's instructions regarding such requests within a reasonable timeframe.

Contact

For questions about this Data Processing Agreement, please contact us at: [email protected]