Privacy policy

1. Who we are

Wurxa (“Wurxa”, “we”, “us”, “our”) is a software service operated by WebWurx, based in Dubai, United Arab Emirates. We provide attendance, leave, document, payroll-preparation and related HR tools to businesses (“Customers”). This policy applies to wurxa.com, app.wurxa.com, and the Wurxa apps and APIs (together, the “Service”).

2. The two roles we play

For data about our Customers’ own staff that a Customer uploads or generates in the Service (for example employee records, attendance punches, leave requests and documents), the Customer is the data controller and Wurxa is the data processor acting on the Customer’s instructions.

For data we collect directly, such as the account details of the person who signs up, billing information, and website analytics, Wurxa is the data controller.

3. Information we collect

Account & contact data

Name, work email, phone number, company name, role, and login credentials of the people who register and administer a workspace.

Customer workforce data

Information our Customers enter or import about their employees, for example names, job titles, salaries, attendance and shift records, leave balances, and uploaded documents such as visas or contracts. Customers decide what to store.

Biometric & device data

Wurxa connects to biometric attendance devices (e.g. ZKTeco) that a Customer already operates. Raw biometric templates (fingerprint/face data) stay on the Customer’s device; Wurxa receives only the resulting punch events (an identifier plus a timestamp), not the biometric template itself.

Billing data

Subscription plan, billing cycle, and transaction records. Card payments are processed by our payment provider, Paddle, who acts as merchant of record. We do not store full card numbers.

Usage & technical data

Log data such as IP address, browser type, pages viewed, and timestamps, plus privacy-friendly, cookieless analytics used to understand aggregate site usage. Our website analytics are first-party: page views are recorded on our own servers, no cookie is set, and your IP address is used only to derive a daily-rotating, irreversible visitor identifier and is not stored. We also use Google Analytics on our marketing site.

4. How we use information

• To provide, operate, secure and improve the Service.
• To authenticate users and protect against fraud and abuse.
• To process subscriptions, billing and renewals.
• To provide support and respond to enquiries.
• To send essential service messages (e.g. security, billing, important changes).
• To comply with legal obligations.

We do not sell personal data, and we do not use Customer workforce data for advertising.

5. Legal bases

Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) or other applicable law requires a legal basis, we rely on: performance of a contract; our legitimate interests in running and securing the Service; consent where required; and compliance with legal obligations. Customers are responsible for having a lawful basis and any necessary employee notices or consents for the workforce data they process through Wurxa.

6. Sharing & sub-processors

We share data only as needed to run the Service:

• Hosting & infrastructure providers that store and serve the Service.
• Paddle, our payment provider and merchant of record, for billing.
• Google Analytics for aggregate website usage statistics on our marketing site. Our own first-party analytics involve no third party at all.
• Professional advisers and authorities where required by law.

We do not otherwise disclose personal data to third parties without instruction or legal requirement.

7. International transfers

Where data is transferred outside the UAE, we take steps to ensure an appropriate level of protection consistent with applicable law.

8. Data retention

We keep account and billing data for as long as a workspace is active and as required for legal, tax and accounting purposes. Customer workforce data is retained while the Customer’s subscription is active and is deleted or returned after termination in line with the Customer’s instructions and our Terms, subject to legal retention requirements.

9. Security

We protect data with encryption in transit and at rest, access controls, and operational safeguards. Biometric templates remain on Customer devices. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss or misuse.

10. Your rights

Subject to applicable law, individuals may request access to, correction of, or deletion of their personal data, and may object to or restrict certain processing. If your data was entered by an employer using Wurxa, please contact that employer (the controller) first; we will support them in responding. For data we control directly, contact hello@wurxa.com.

11. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notice within the Service.

13. Contact

Questions or requests: hello@wurxa.com · WebWurx, Dubai, United Arab Emirates · webwurx.tech.