Whose data this is
When your company uses Mowazaf, your company decides what employee data goes in and why. Mowazaf holds and processes it so the product can work — running payroll, recording attendance, storing the documents your HR team uploads.
That distinction matters for anything an employee asks you: requests about an employee’s own record are answered by their employer through the product, not by Mowazaf directly.
What the product holds
Whatever your company puts into the modules it uses. In practice that means:
- Employee records — names, contact details, job data, departments and locations.
- Identity and right-to-work documents your HR team uploads, including national ID and passport scans.
- Payroll — salary, allowances, deductions, end-of-service accrual, payslips and the salary files produced for the Wage Protection System.
- Attendance — clock-ins, including geofenced and face-recognition clock-in where you switch it on, shift schedules, timesheets and leave.
- Everything else the modules you enable record: performance and engagement, projects.
- Account data — sign-in records, and the audit trail the product keeps of who changed what.
Where it runs
On Microsoft Azure. The production application runs in Azure’s UAE North region. Push notifications pass through Google’s and Apple’s services, outside the UAE.
That statement is deliberately narrow: it covers the production application, and it is not widened here to cover anything it was not verified against. If your procurement needs a residency statement in a particular form, ask and you will get one in writing.
Who can reach it
Inside your company, access follows role: HR has company-wide HR authority, an Admin administers configuration and sees only their own HR records, a manager sees their team, an employee sees themselves. Every record belongs to exactly one company and every request is scoped to the company of the person making it.
On our side, the platform role used to provision and configure your workspace is excluded from every gate that reads company employee data — the role we use to set your account up cannot read your payroll. The security page sets out how that boundary is enforced.
Mowazaf staff work in your account only for a limited time, to help with onboarding.
This website
This section is about mowazaf.com itself, not the product. The site carries no analytics or advertising trackers. Its content security policy lets a page load content only from the site itself and connect only to the site and to app.mowazaf.com.
- The contact form and the sandbox form each send your name, work email, company, number of employees and country to our leads API at app.mowazaf.com, with your language, the address of the page and any campaign tags in the link you arrived by. That service also records the IP address and browser details of the request.
- If you fill them in, the contact form also sends your phone number and message, and the sandbox form your phone number and job title.
- The chat on every page is an automated assistant. Nothing goes out until you send a message; then your messages, your language and a random session ID go to the same service, which uses a Microsoft Azure OpenAI model to write the reply. If you leave contact details in the chat, they are recorded as a lead together with the recent conversation.
- The web server keeps access logs for up to 14 days. They hold shortened IP addresses, full URLs, browser details and referrers.
Ask for any of this in writing
This page is not a policy, so anything below it that your procurement needs is answered by a person, in writing, within one business day. Name the item and it gets answered — that answer is something you can hold us to, which a page of generated policy text is not.
- Retention periods — how long each kind of record is kept, and what happens at the end.
- The sub-processor register — who else touches the data, for what, and where they are.
- International transfers, and the mechanism relied on.
- The data-processing agreement: whether one is available, what it covers, and who signs it.
- The deletion and export process on request, and how long it takes.
- A named privacy contact and a response commitment.