العربية

Privacy policy

How the KonHR app (كُن) and the KonHR platform handle the personal data of the employees who use them, and how our website, konhr.com, handles what visitors send us.

Last updated

Contents
  1. Who we are
  2. What the app collects, and why
  3. Location, precisely
  4. Our website, konhr.com
  5. What we never do
  6. Who else handles data
  7. Where data is stored
  8. How long we keep data
  9. Security
  10. Your rights
  11. Children
  12. Cookies and storage on your phone
  13. Changes to this policy
  14. Contact

1Who we are

KonHR (“KonHR”, “we”) provides the KonHR human-resources platform and the KonHR mobile app, called كُن in Arabic, to companies. Your employer uses KonHR to keep its employee records, run attendance and payroll, and handle requests such as leave.

  • Your employer is the controller of your employee records: it decides what to record about you and why.
  • KonHR is the processor of those records: we store and process them on your employer’s behalf, only on its instructions and under our agreement with it.
  • KonHR is the controller only for what we decide ourselves: running and securing the service, your sign-in account, our own messages to you (for example, a reply to a support email), and what you send us through our website (section 4).

The company behind KonHR is KonHR, Amman, Jordan. You can reach us at privacy@konhr.com.

2What the app collects, and why

  • Your account

    What
    Your name and work email address; your password, stored only as a one-way (scrypt) hash that nobody can read back; whether two-step sign-in is on.
    From
    Your employer, who creates the account; the password from you.
    Why
    To sign you in, send you sign-in codes and password-reset links, and tell you about decisions on your requests.

  • The HR records your employer keeps

    What
    For example: job title, branch and manager; contract; salary, payslips and payouts; leave balances and requests; attendance and shifts; documents; appraisals, surveys and tasks; announcements, acknowledgements and poll answers.
    From
    Your employer, and what you enter in the app (requests, answers, documents you choose to upload).
    Why
    To provide the HR service to your employer and to you.

  • Location — only for employees who check in from their phone

    What
    Your phone’s latitude and longitude at the moment you check in or out.
    From
    Your phone, with your permission.
    Why
    To confirm that you are inside your workplace’s area when you punch. Details in section 3.

  • Notification token

    What
    An identifier that Apple or Google gives the app on your phone so it can receive notifications.
    From
    Your phone, when you allow notifications.
    Why
    To send you notifications, such as a decision on your leave request.

  • Language and app settings

    What
    Your phone’s language or the language you choose in the app, and which notifications you switched on.
    From
    Your phone and you.
    Why
    To show the app, emails and notifications in your language, and to send only the notices you want.

  • Technical records

    What
    IP address, app or browser version, and the time of each request, in our server logs.
    From
    Your phone or browser, automatically.
    Why
    To keep the service secure, stop abuse (for example, repeated wrong passwords) and fix faults.

The app does not read your contacts, photos, camera, microphone, health data or browsing history. A file reaches us only when you choose to upload it.

3Location, precisely

  • Only for “mobile punch” employees. If your employer did not set you up to check in from your phone, the app never asks for your location.
  • Asked at the moment you need it. The app asks for permission the first time you tap the fingerprint to check in. You may refuse; you then cannot check in from the phone, and your HR team can tell you the other way to record attendance.
  • Read once per punch. When you check in or out, the app reads your location once and sends it with the punch. We compare it with your workplace’s area (a point and a radius your employer set) and store the coordinates, the workplace matched, and whether you were inside, as part of that punch.
  • A check on your phone, not a report. If you have already allowed location, the Home screen may read it once while you are looking at it, to show whether you are inside the area. That reading stays on your phone and is not sent to us.
  • Never in the background. The app does not track you, record a route, or read your location when it is closed or on any other screen.

Who can see the location stored with a punch: you, and the HR staff and managers your employer allows to review attendance. You can withdraw the permission at any time in your phone’s settings.

4Our website, konhr.com

This section covers our public website, konhr.com. For what you send us there, KonHR is the controller.

  • Demo and contact requests

    What
    Your name, work email and company; the phone number, company size, topic and message, if you fill them in; the page language; and your IP address and browser version when you send the form.
    Why
    To answer your request and, if you ask for one, arrange a demo. The IP address and browser version help us spot abuse.
    How long
    Up to 12 months after our last exchange, unless your company becomes a customer.

  • Newsletter

    What
    Your email address, the page language, when you subscribed, and your IP address.
    Why
    To send you the newsletter you asked for, and nothing else.
    How long
    Until you unsubscribe; we then delete your address within 30 days. To unsubscribe at any time, write to privacy@konhr.com.

We keep both on our server in Frankfurt (section 7) and pass them to our team by email through Resend (section 6). We give them to no one else and add them to no advertising tool.

To keep out spam, the forms use a hidden field and a check on how long the form took to fill in, not a CAPTCHA, so nothing extra is collected. Your IP address is also held in the server’s memory for about 10 minutes to limit repeated sending.

Cookies. The website sets one cookie, NEXT_LOCALE, and only when you use the language switch: it remembers Arabic or English for a year. There is no analytics, advertising or tracking code and no third-party script, and the fonts come from our own server.

5What we never do

No advertising. No tracking across apps or websites. No third-party analytics or advertising code in the app. We never sell or rent personal data, and we never use your records for anything other than providing the service to your employer and to you.

6Who else handles data

A few service providers help us run KonHR. Each handles data only to provide its service to us, under an agreement that protects it:

  • DigitalOcean hosts our servers and database in Frankfurt, Germany (EU).
  • Resend delivers the platform’s emails (sign-in codes, password resets, notices) and passes the website’s form requests to our team. It sees your email address and the email’s content. If your employer has connected its own email server, its emails go through that server instead.
  • Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver notifications to your phone. They receive the notification token and the notification’s text.

We disclose personal data to public authorities only when the law requires it, and we tell your employer unless the law forbids us to.

7Where data is stored

On DigitalOcean servers and a managed database in Frankfurt, Germany, in the European Union. All connections — between your phone and us, and between our servers and the database — are encrypted. If you are in Jordan or elsewhere outside the EU, your data is therefore transferred to the EU, a jurisdiction with a high level of data protection; the transfer is covered by our agreement with your employer.

8How long we keep data

  • HR records, including the location stored with a punch: for as long as your employer keeps them in KonHR. Employers often have to keep payroll, tax and social-security records for several years by law.
  • When your employer leaves KonHR: its data stays available to it for export for 90 days after the account is closed, then we delete it permanently.
  • Backups: deleted data can remain in our backups for up to 90 days, after which those backups are overwritten.
  • Notification tokens: deleted when you sign out, when your account is deleted, or when Apple or Google tell us the token is no longer valid.
  • Website requests and newsletter: as set out in section 4.
  • Server logs: kept for up to 30 days.
  • Support emails: kept for up to 12 months after the conversation ends.

9Security

  • Encrypted connections (HTTPS/TLS) everywhere.
  • Passwords stored only as scrypt hashes; optional two-step sign-in with a code sent by email that expires after 10 minutes.
  • Your session is kept in a cookie that page scripts cannot read, and limits on repeated attempts slow down password guessing.
  • Each company’s data is kept in its own separate part of the database; one company cannot see another’s.
  • The database accepts connections only from our own servers. Access by KonHR staff is limited to running and supporting the service.
  • Backups every day, with copies held separately so data can be restored after a fault.

No system is perfectly secure. If a breach affects personal data, we tell your employer without undue delay, so that you and the authorities can be informed as the law requires.

10Your rights

Under Jordan’s Personal Data Protection Law No. 24 of 2023 and, where it applies to you, the EU General Data Protection Regulation (GDPR), you have the right to:

  • know what data is held about you, why, and who receives it;
  • get a copy of it, including in a format you can take elsewhere;
  • have it corrected or completed;
  • have it deleted when there is no legal reason to keep it;
  • restrict or object to its processing;
  • withdraw your consent where we rely on it — for location and notifications, by switching them off in your phone’s settings;
  • complain to a data-protection authority: in Jordan, the authority set up under the Personal Data Protection Law; in the EU, the authority where you live or work.

How to use them. Your employer controls your HR records, so your HR team is usually the fastest route: they can see, correct and export your data in KonHR. You can also write to privacy@konhr.com from the email address on your account. We answer requests about your account ourselves, pass requests about your HR records to your employer and help it answer, and reply within 30 days. To delete your account, see Delete your account.

11Children

KonHR is a workplace tool for employees, invited by their employer. It is not meant for children, and we do not knowingly collect data from anyone under 16. Where the law allows a minor to be employed, the employer is responsible for that employee’s record.

12Cookies and storage on your phone

One essential cookie keeps you signed in. The app also keeps, on your phone, your language choice and a copy of your Home screen so it can open without a connection. There are no advertising or analytics cookies. Signing out removes the session; deleting the app removes the rest. The website’s one cookie is described in section 4.

13Changes to this policy

When we change this policy we update the date at the top. For a material change we tell users in the app or by email before it takes effect.

14Contact

Privacy questions and requests: privacy@konhr.com
Help with the app: support@konhr.com or the support page
Post: KonHR, Amman, Jordan