Privacy policy
Last updated: 15 October 2026
1. Who we are
WorkAlto provides HR, leave, attendance and WPS payroll software for companies in the United Arab Emirates. This policy explains how we handle personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other applicable law.
For account, billing and website data we decide how the data is used (we are the controller). For the employee data that our customers enter into their workspaces, the customer is the controller and we process that data on their instructions (we are the processor).
2. Data we collect
Account data: your name, email address, password (stored only as a hash), two-factor settings, language and display preferences.
Workspace data entered by our customers: employee records, contracts and salaries, bank details, identity documents and their expiry dates, leave, attendance and location at clock-in, and payroll results.
Website and demo requests: the details you send us, such as your name, work email, company, phone and message.
Technical data: device and browser information, IP address, and logs and error reports that keep the service secure and working.
3. How we use data
We use personal data to provide and secure the service, to create and manage accounts, to send service emails (such as invitations, alerts and sign-in links), to answer demo requests and support questions, to bill customers, and to meet legal obligations.
We rely on the performance of our contract with you or your employer, our legitimate interest in running and improving a secure service, compliance with legal obligations, and your consent where the law requires it. We do not sell personal data.
4. Employee data in customer workspaces
Each customer controls the data in its workspace and decides who can see it. We process it only to provide the service, keep it separate from other customers' data, and do not use it for our own purposes.
Employees who want to access, correct or delete their data should contact their employer first; we will help our customers respond to such requests.
5. Sharing and service providers
We use trusted providers to run the service, including database and file hosting, application hosting, email delivery, error monitoring, product analytics and bot protection. They may only use the data to provide their service to us.
Some providers process data outside the UAE. Where this happens we rely on the transfer grounds and safeguards the PDPL allows, such as adequate protection in the destination country or contractual safeguards.
We disclose data to authorities only when the law requires it.
6. Security
Data is encrypted in transit. Bank account numbers (IBAN), passport, Emirates ID and labour card numbers are additionally encrypted by the application. Access is limited by role, payroll access requires two-factor authentication, and changes to HR data are recorded in an audit log.
Files are kept in private storage and opened only through short-lived links. If a personal data breach affects you, we will notify you and the competent authority as the law requires.
7. Retention
We keep account and workspace data while the customer's subscription is active. After it ends we delete or anonymise it within a reasonable period, unless the law requires us to keep it longer (for example, financial records). Demo requests are kept for up to 24 months.
8. Your rights
Subject to the PDPL, you can ask to access your personal data, correct it, erase it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing.
To use these rights, contact us at the address below. You may also complain to the UAE Data Office.
9. Cookies
We use essential cookies to keep you signed in and to remember your language and theme. We use privacy-friendly analytics to understand how the product is used. You can block cookies in your browser, but signing in will not work without the essential ones.
10. Changes to this policy
We may update this policy. We will post the new version here with its date and tell customers about important changes.
11. Contact
Questions or requests about personal data: hello@workalto.com.