Privacy policy
Effective 12 October 2026
In short
- SIJILL is a business system that companies use to run their work. Each company's records belong to that company; we keep and process them only to run SIJILL for it.
- We do not sell personal data, we do not show advertising, and we use no advertising or analytics trackers.
- Connecting a Google calendar is optional. We use it only to keep your bookings and your calendar in step, and you can disconnect it at any time.
- To ask about your data, or to use your rights, write to privacy@sijill.net. We answer within 30 days.
1. Who we are
SIJILL (sijill.net) is operated by شركة الاعمال الإبداعية التجارية (Doolab Creative Agency), a company registered in the Kingdom of Saudi Arabia, unified national number 7033979621, short national address RUQA2577. In this policy, "we" and "us" mean that company.
For anything about personal data, write to privacy@sijill.net. That address reaches the person responsible for personal data protection at the company.
This policy is written under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations. It is published in Arabic and English; if the two ever differ, the Arabic text prevails.
2. Our two roles
When we decide why and how data is used, we are the controller. That covers the accounts of people who sign in to SIJILL, companies that register a workspace, visitors to sijill.net, and the running and security of the service.
When a company keeps its own records in SIJILL, that company is the controller and we process the data on its behalf. That covers everything a workspace stores: its clients and contacts, deals and invoices, employees, job applicants, survey answers, chat messages, files, and the details of people who book a meeting or answer a survey through the company's own SIJILL pages. We use that data only to provide SIJILL to the company, as it instructs, and never for purposes of our own.
If you are a client, employee, applicant or guest of a company that uses SIJILL, that company decides what is kept about you and why, and your requests about it go to that company first. If you write to us instead, we pass your request to the company and help it answer.
3. What we collect, and how
When you sign in: your name, email address and profile picture, received from Google or Microsoft when you choose to sign in with them. SIJILL asks those providers for your basic profile only (name, email, picture) and nothing else.
When you register a workspace: the company's name and the workspace address, your name and email, the modules you choose, and a one-way hash of the IP address the registration came from, kept to stop abuse.
While you use SIJILL: what you and your colleagues enter. Depending on the modules a company uses, this can include contact details of clients and suppliers; employee records such as job title, contact details, date of birth, nationality, national ID or iqama number and pay; job applications and CVs; leave, expense, timesheet and performance records; messages and comments; and files you upload.
When someone books a meeting or answers a survey through a company's public SIJILL page: the name, email, and any phone number, company or answers they give.
If you connect a Google calendar: see section 6, which covers this on its own.
Technical data: our hosting provider records requests to the service (such as IP address, time and the page asked for) to keep it running and secure. SIJILL itself uses only the cookies needed for it to work (section 9).
We collect personal data directly from you, from your company when it adds you to its workspace, or from Google or Microsoft when you sign in with them. Where a field on a form is optional, the form says so; required fields are needed for that part of SIJILL to work.
4. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing SIJILL to your company and to you: accounts, sign-in, the modules your company uses, and support | Performing our agreement with your company, and its instructions for its own records |
| Sending the emails SIJILL sends on a company's behalf, such as meeting confirmations, survey invitations and interview invitations | Our agreement with the company that sends them |
| Keeping the service secure: preventing abuse, investigating faults, and protecting accounts | Our legitimate interest in a secure service; never applied to sensitive data |
| Keeping records the law requires, such as invoices and tax records | Legal obligation |
| Connecting your Google calendar | Your consent, which you can withdraw at any time by disconnecting |
We do not use personal data for advertising, we do not sell it, and we do not use it to make automated decisions that have legal or similarly significant effects on you. If we ever want to use personal data for a new purpose, we will tell you first and, where the law requires, ask for your consent.
6. Google Calendar
Connecting a Google calendar is optional, and is done by each person from Scheduling, Availability in SIJILL. Google asks for your permission on its own screen, separately from signing in. If you do not connect one, scheduling works without it.
What SIJILL accesses: the email address of the Google account you connect, and the events in that account's primary calendar, through Google's "calendar.events.owned" permission, which reaches only calendars you own. SIJILL does not access your other Google data.
What SIJILL does with it:
- Reads when your events start and end, and whether you marked them busy or declined them, so that people cannot book you at times you are already busy.
- Shows your events on your own calendar page in SIJILL, read-only, to you alone. Your colleagues' and managers' views never show them.
- Creates an event in your calendar for each meeting booked with you, with the guest invited and, when the booking link uses it, a Google Meet link; moves or deletes that event when the meeting is moved or cancelled.
What SIJILL keeps: the connected account's email address; the access tokens Google issues, encrypted (AES-256) before they are stored; and, for meetings booked in SIJILL, the identifier and Meet link of the event SIJILL created. SIJILL does not store the titles, descriptions or attendees of your other events: it reads them from Google when a page needs them, and holds busy times in memory for about a minute and a half.
What SIJILL never does with it: sell it; transfer it to anyone except as needed to provide these features, for security, or to comply with the law; use it for advertising, or to build profiles; use it to train artificial intelligence models; or let a person read it, except with your permission, to investigate a security problem, or where the law requires.
SIJILL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting: press Disconnect on the Google Calendar card in Scheduling, Availability. SIJILL asks Google to revoke its access and deletes the stored tokens at once. You can also remove SIJILL from your Google account's permissions. Events SIJILL already created stay in your calendar until you delete them.
7. Where your data is kept
SIJILL's servers and databases are in Frankfurt, Germany, and some of our providers process data in other countries (section 5), so personal data is transferred outside the Kingdom. We transfer only what is needed to provide the service, and only as Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom allow, with the safeguards they require, so that the data keeps a level of protection no less than the Law provides.
8. How long we keep it, and how we protect it
We keep personal data only as long as it is needed for the purpose it was collected for:
- A company's workspace data is kept while the company uses SIJILL. The company can delete records itself, and can ask us to delete its whole workspace. When a company stops using SIJILL, we delete its workspace database and files within 90 days, unless it asks for them sooner or the law requires us to keep something longer.
- A person's account stays while their company keeps them in its workspace. A company can switch an account off; to have it deleted, ask the company, or write to us.
- Google Calendar tokens are deleted the moment you disconnect.
- Records the law requires us to keep, such as invoices, are kept for the period the law sets, then deleted.
When data is deleted, it is destroyed so that it cannot be recovered or used again, including from our providers' systems within their own deletion periods.
How we protect it: every connection to SIJILL is encrypted (HTTPS); each customer workspace has a database of its own; uploaded files are private and reachable only through the records they belong to; Google tokens are encrypted before storage; and access inside a workspace follows the roles the company sets. If a personal data breach happens that could harm you, we will notify the Saudi Data and AI Authority within 72 hours of learning of it, and tell the people affected without undue delay, as the law requires.
10. Your rights
Under the Personal Data Protection Law you have the right:
- to be told how your personal data is collected and used, which this policy does;
- to access your personal data, and to receive a copy of it in a clear, readable format;
- to have personal data that is wrong, incomplete or out of date corrected;
- to have your personal data destroyed when it is no longer needed, unless the law requires it to be kept;
- to withdraw your consent where we rely on it, at any time and as easily as you gave it (for Google Calendar, by disconnecting); withdrawing does not affect what was done before.
To use any of these rights, write to privacy@sijill.net from the email address SIJILL knows you by, or tell us how to confirm it is you. We answer within 30 days. If a request needs more time, we will tell you why before the 30 days are up, and answer within 30 more. For data a company keeps in its workspace, we pass your request to that company and help it answer (section 2).
If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA), the competent authority for personal data protection in the Kingdom.
11. Children
SIJILL is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use personal data in a meaningful way, we tell the people affected before it takes effect, by email or inside SIJILL, and where the law requires, ask for consent again.
Questions are always welcome at privacy@sijill.net.