1.    Who Are we?

Saudi Manpower Solutions Company (SMASCO) is a registered entity under the Saudi Ministry of Commerce and holds trademarks in line with regulatory requirements. SMASCO specializes in providing comprehensive workforce solutions across various sectors, including domestic labour, corporate staffing, and project-based manpower services. The company operates under the licensing and oversight of the Ministry of Human Resources and Social Development.

SMASCO’s core tasks include recruitment, mobilization, training, and management of local and international manpower. It offers services to both individual customers and corporate clients. Its target group spans households, small and medium enterprises, and large-scale organizations operating within the Kingdom of Saudi Arabia.

License or Commercial Register: 1010331000

2.    Date of Last Update

The Privacy Policy was last updated on 15/07/2025.

3.    Contact Information

This Privacy Policy is issued by Saudi Manpower Solutions Company (SMASCO), the Controller of personal data processing activities.

Contact Information:

  • Phone: +966 920010133
  • Website: www.smasco.com
  • Head Office: 6527 Olaya Street, Al Ghadeer District, P.O. Box 91279, Riyadh 13311, Kingdom of Saudi Arabia.

If you have any questions or concerns regarding the processing of your personal data, or if you wish to exercise any of your rights under the Personal Data Protection Law, you may contact our Personal Data Protection Officer (DPO) at:

The DPO is available to provide further information about how your personal data is handled and to assist with any related inquiries.

 

4.    The Data We Collect

Raha collects personal data either directly from the Data Subject or indirectly through system usage. The categories of data collected include:

Category

Description

Source

Mandatory/Optional

Customer Data

Name, mobile number, email address

Provided directly by user during account creation

Mandatory

Worker Data

Name, ID number, availability, shift and booking history

Collected internally and through operational systems

Mandatory

Operational Data

Trip schedules, booking statuses, and resource assignment

Generated through usage of the platform

Mandatory

System Data

Login records, feedback, booking timestamps, and approximate location

Collected through application logs and monitoring tools

Mandatory

Location Data

Approximate location during booking and service execution

System-generated via device/location permissions

Optional (depending on user/device settings)

Third-Party Data

No data is collected from third parties unless legally required or with user consent

N/A

N/A

 

5.    How Do We Collect the Data?      

5.1.Methods of Data Collection

Raha collects personal data through the following methods:

Method

Type of Data Collected

Collection Type

Account registration form (e-form)

Name, mobile number, email address

Direct

Booking and service workflows

Trip schedules, resource assignment, booking statuses

Direct

Worker onboarding and management

Worker name, ID number, availability, shift and booking history

Direct

System-generated logs

Login activity, feedback, timestamps, approximate location

Indirect

Device-based location detection

Approximate location during service use

Indirect

 

5.2.The purpose of Collection and Processing
Personal data is collected and processed strictly to support Raha’s business operations, including:

  • Facilitating on-demand and live-in domestic labor bookings
  • Worker assignment, scheduling, and performance tracking
  • Customer support, notifications, and service updates
  • Internal analysis, reporting, and quality assurance
  • Compliance with regulatory, legal, and operational obligations

5.3.Legal Basis for Processing

The processing of personal data is conducted on one or more of the following legal bases as defined under the PDPL:

  • Consent: When required, e.g., for enabling device location services
  • Contractual Necessity: To provide services that you have requested by registering and making bookings
  • Legitimate Interest: For service improvement, fraud prevention, and performance monitoring
  • Legal Obligation: For compliance with labor, tax, and audit regulations applicable in the Kingdom of Saudi Arabia

Raha does not rely on publicly available sources, nor does it collect personally identifiable data unless directly required for service provision. Any analytics conducted on anonymized data is performed in compliance with Article (9) of the PDPL Implementing Regulation.

5.4.Data Minimization and Integrity

Raha ensures that the personal data collected is:

  • Limited to the minimum necessary to fulfill the stated purposes
  • Relevant, accurate, and not excessive
  • Collected using clear and direct methods free from deception or manipulation

 

5.5.Consent Conditions

Consent is only requested when necessary. Consent is never used as a precondition for accessing basic services unless the data is essential to deliver that service.

6.    Mechanism and Purpose of Personal Data Processing

Raha processes personal data to support its core domestic labour services through structured and secure data handling across each stage of the data lifecycle: collection, storage, usage, sharing, and destruction. The following table outlines the processing objectives and operations at each stage:

Lifecycle Stage

General Objective

Specific Operations

Data Involved

Collection

Enable service delivery

– User registration

– Booking requests

– Worker onboarding

Account data, worker data, operational data

Storage

Secure data retention for operations and compliance

– Storing customer data within the bounds of the Kingdom with RBAC and encryption

– Worker and trip records in secured databases

All collected data

Usage

Provide services and improve quality

– Booking and scheduling

– Customer notifications

– KPI reporting

– Feedback review

Operational data, system data

Sharing

Legal and customer-authorized data sharing

– Sharing data only with regulatory authorities if required by law

– No third-party sharing without explicit consent

Customer and worker data

Destruction

Compliant data disposal

– Data deletion after defined retention periods.

– Secure deletion methods

All data categories, depending on retention rules

 

All processing activities are carried out under strict access controls, operational monitoring, and based on legitimate, contractual, or legal bases as outlined previously.

7.    Disclosure of Personal Data to Third Parties

Raha does not disclose personal data to any external parties outside the Kingdom of Saudi Arabia. All data processing and storage are performed on infrastructure located within the Kingdom.

Disclosure Inside the Kingdom:

Personal data may be disclosed to the following entities within Saudi Arabia, but only when legally required or with explicit consent from you:

Entity

Description

Purpose of Disclosure

Disclosure Frequency

Governmental Authorities

Regulatory or judicial bodies (e.g., Ministry of Human Resources, tax authorities)

Legal compliance and audit obligations

Occasional (as required)

 

Raha does not engage in third-party data sharing for marketing, advertising, or profiling purposes.

The company ensures that any disclosure complies with applicable PDPL requirements, and all disclosures are logged and subject to access control.

8.    Your Rights

Under the Saudi Personal Data Protection Law (PDPL), Data Subjects using the Raha platform are entitled to the following rights concerning their personal data:

Right

Description

Right to Be Informed

You have the right to be informed of the legal basis, purpose, and method of collecting your personal data. Raha commits to processing your data only for the purposes described in this Privacy Policy.

Right to Access

You may request access to your personal data held by Raha. Where technically feasible, you can request a copy of your data using one of the contact methods mentioned in this Privacy Policy.

Right to Receive Data

Upon request, you can receive a copy of your personal data in a readable, structured, and commonly used format, or as a printed hard copy if needed.

Right to Rectify

You can request correction, completion, or updating of inaccurate or outdated personal data.

Right to Erasure

You may request deletion of your personal data if it is no longer necessary for the purposes for which it was collected, unless retention is legally required.

Right to Withdraw Consent

Where your data is processed based on consent, you may withdraw that consent at any time. Withdrawal will not affect any prior lawful processing.

Right to Lodge a Complaint

If you believe your rights under the PDPL have been violated, you have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

 

Exercising Your Rights

To exercise any of the above rights, you may contact us via one of the following communication channels:

Raha will acknowledge your request within 5 business days and will respond within a maximum of 30 calendar days, unless a legal obligation or complexity requires an extension.

In the event where an extension is needed, Raha’s team will contact you to inform you of the delay and the reasons why the extension is needed.

9.    Complaints and Objections

Raha is committed to upholding your rights under the Saudi Personal Data Protection Law (PDPL). If you believe that your rights have not been respected, for example, if you were unable to exercise your rights within the legally required period or if you object to the processing of your personal data, you have the right to file a formal complaint.

How to File a Complaint or Objection

You can submit your complaint or objection through one of the following channels:

Responsible Department

All complaints are received and processed by SMASCO’s Data Protection Office.

  • Department: Data Protection Office
  • Email: [email protected]
  • Working Hours: Sunday to Thursday, 9:00 AM to 5:00 PM KSA time

Complaint Handling Timeline

  • Acknowledgment: Within 5 business days of receipt
  • Investigation and Resolution: Within 30 calendar days from the date of acknowledgment
  • Notification of Outcome: You will be notified of the result via your preferred contact method

If you are not satisfied with the resolution provided by SMASCO, you may escalate your complaint to the Competent Authority:

  • Supervisory Authority: Saudi Data and Artificial Intelligence Authority (SDAIA)
  • Website: https://sdaia.gov.sa
  • National Data Governance Platform “DGP” Website: https://dgp.sdaia.gov.sa

10.       Privacy Policy Availability, Notification, and Updates

Raha is committed to ensuring transparency in how personal data is collected and processed. To that end, this Privacy Policy is:

Notification and Awareness

Raha uses the following channels to notify users about this Privacy Policy and any updates:

  • In-app notifications Marketing department will send push notification to the customers
  • Email or SMS alerts Marketing department will send push notification to the customers
  • On-screen privacy notices Marketing department will send push notification to the customers
  • Live chat and call center agents Marketing department will send push notification to the customers

Policy Review and Updates

This Privacy Policy is reviewed periodically by SMASCO’s Data Protection Office to ensure alignment with:

  • Saudi Personal Data Protection Law (PDPL)
  • Internal policies and changes in operations
  • Regulatory updates or supervisory authority guidance

All updates are documented in a version control log, and the effective date of the latest version is 15/07/2025.