1. Who we are
شركة انظمة بنش لتقنية المعلومات (trading as “Bench”) is a Saudi limited liability company with unified national number 7033252953, operating from Riyadh, Kingdom of Saudi Arabia. Our website is https://bench.sa and privacy enquiries may be sent to support@bench.sa.
This policy explains how we handle personal data in line with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended by Royal Decree No. (M/148) dated 5/9/1444H, and its Implementing Regulations (the "PDPL").
2. Scope: two roles
When Bench determines the purposes and means of processing personal information of its website visitors, prospects, account representatives, billing contacts and people seeking support, it is the Controller. This policy explains that processing.
For employment, payroll, recruitment, attendance, leave, performance and similar data that an employer uploads or directs Bench to process, the employer is normally the Controller and Bench is its Processor. Your employer sets the purpose and lawful basis and provides the applicable workplace notice. Direct requests about employer-controlled information to your employer; if you contact Bench, we may verify the request and refer it or assist the employer. We handle requests concerning data we independently control ourselves.
Employer-controlled records may include identifiers and contact details, contracts, salary and bank details, work schedules, attendance and work-location events, leave and medical evidence, recruitment applications, goals and performance reviews, employee requests, assets and dependants’ details. Our processing of those records is limited by employer instructions, the Data Processing Addendum and applicable law.
3. What we collect, why, and on what basis
We collect personal information for specified, legitimate purposes, limited to what is needed. We do not sell identifiable personal data. Genuinely anonymized statistical outputs are not personal data; where lawfully produced under employer instructions, Bench may commercialize those outputs as described in its Terms.
| Data | Examples | Purpose | Legal basis under the PDPL |
|---|---|---|---|
| Account and contact data | Name, work email, phone, job title, employer name | Create and manage accounts, communicate about the Service | Legitimate interests in business-account administration, subject to an assessment; performance of a contract only when the individual is personally a contracting party. |
| Billing data | Billing contact, company VAT number, invoices, payment status | Invoicing, tax compliance, collections | Applicable legal obligations (tax and invoicing) and legitimate interests in payment administration. |
| Usage and device data | Log-ins, features used, IP address, browser, device identifiers | Security, fraud prevention, troubleshooting, improving the Service | Legitimate interests in service security and product troubleshooting; applicable legal duties where relevant. |
| Support data | Messages, call notes, screenshots you send us | Answering support requests | Our legitimate interests in providing support |
| Marketing data | Demo requests, newsletter sign-ups, event attendance | Sending product news and offers | Prior consent where required by PDPL Articles 25–26. |
| Website cookies | See section 8 | Running and measuring the website | Necessity for essential technologies; consent for optional analytics/advertising where required. |
We do not rely on legitimate interests for Sensitive Data. Bench does not request health, biometric or other Sensitive Data from business contacts for its independent marketing or account functions. If a person submits Sensitive Data in a support request, we restrict use to handling the request, take appropriate protective measures and delete or return it when no longer required. Account contact details needed to administer a customer account and legally required billing details are mandatory; optional marketing information and non-essential analytics cookies are not.
Sources include direct submission, employer-appointed administrators, use of Bench websites or applications and integrations enabled by the business customer. We assess legitimate-interest processing in light of necessity and individuals’ rights. Any unrelated secondary use of identifiable personal data requires a lawful basis under PDPL Articles 5, 6 and 10.
Attendance and location. Where an employer enables attendance, NFC, geofencing or location-based verification, Bench processes the data as its Processor, subject to the employer’s configuration, workplace notices and lawful instructions. Device permission is not by itself a substitute for a PDPL lawful basis. The categories, timing and behavior of location collection depend on the enabled feature and device configuration; the employer should provide feature-specific disclosures where legally required.
AI and statistics. Some features may create automated suggestions, flags or summaries. Outputs may be inaccurate; employers must review them before consequential decisions about individuals. Bench will not train general-purpose or cross-customer AI models on identifiable employer-controlled personal data without separate written authorization and an appropriate lawful basis. Where the employer lawfully instructs genuine anonymization of non-sensitive records, Bench may use and commercialize statistical outputs that cannot identify individuals or disclose a customer’s confidential data.
4. Who we share data with
We share personal data only as follows:
We share information with contracted providers for hosting, communication, support, analytics and payment processing as needed for lawful purposes. We identify our material processors, the scope of their services and processing locations in the register available on request through support@bench.sa.
Your employer, for data about your use of its Bench account.
Public authorities, when Saudi law or a binding order requires it, or to protect the rights, safety or property of Bench or others. Where lawful, we tell the affected customer first.
Professional advisers, such as lawyers, auditors and insurers, under confidentiality.
A buyer or successor, if Bench is involved in a merger, acquisition or sale of assets, subject to this policy.
5. Transfers outside Saudi Arabia
International processing. Depending on the provider, personal data may be stored, accessed or supported in Saudi Arabia or in other countries when permitted by PDPL Article 29 and the Regulation on Personal Data Transfer outside the Kingdom. Bench assesses applicable transfer restrictions, safeguards and minimization duties. Details of current material processors and the countries in which they process data are available from support@bench.sa; the employer’s specific contract may impose stricter location conditions. We do not treat acceptance of this Privacy Policy as replacing legally required international-transfer safeguards.
6. Retention and security
Retention. We retain the minimum personal data for the relevant service relationship and for legally required records, then delete or irreversibly anonymize it. Retention periods depend on the purpose, applicable tax and corporate obligations, dispute and legal-hold needs, security requirements and the relevant customer contract. Customer-controlled records follow the export/deletion arrangements in the Data Processing Addendum and applicable law.
| Category | Retention approach |
|---|---|
| Business accounts and contacts | While the account or business relationship exists, then as justified by legitimate account administration or applicable claims. |
| Billing and tax records | For the statutory recordkeeping period that applies to the relevant records. |
| Usage and security logs | Only while reasonably necessary for cybersecurity, investigation, compliance and operational troubleshooting. |
| Support requests | Until the request is closed, plus a limited period for quality assurance, legal obligations or claims. |
| Marketing consent and preferences | Until withdrawal or unsubscribe; a limited suppression record may be retained to respect that choice. |
We preserve information longer only where justified by binding legal obligations or relevant proceedings. Destruction is intended to make personal data unreadable and irretrievable; genuine anonymization must prevent identification directly or indirectly. Backup copies may be removed on their scheduled rotation subject to required safeguards.
Security. We apply technical, organizational and administrative safeguards proportionate to the nature of the data and processing risks, including appropriate access restrictions and personnel confidentiality obligations. No system can guarantee that every cyberattack or data-loss event will be prevented. Our security obligations under Saudi law remain in force.
Breaches. Where Bench is the Controller, it will notify SDAIA and affected individuals when notification is required under PDPL Article 20 and the Implementing Regulations, including the seventy-two (72) hour regulatory window where applicable. Where Bench is a Processor, it will inform and support the employer as required by the Data Processing Addendum.
7. Your rights
Under the PDPL, you have the right to:
Be informed about how and why your data is collected and used, which this policy provides.
Access your personal data and receive a copy in a clear, readable format.
Correct data that is inaccurate, incomplete or out of date. If we correct your data, we tell anyone we disclosed it to.
Request destruction of your data when it is no longer needed, unless the law requires us to keep it or it relates to a pending court case.
Withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.
To exercise rights concerning data controlled by Bench, contact support@bench.sa. We may verify your identity before acting and ordinarily respond within thirty (30) days; where the Implementing Regulations allow, we may extend by up to thirty (30) additional days with advance notice and reasons. Where we refuse a request under a lawful exception, we explain the basis.
If you work for a company using Bench, please contact your employer about your HR records. If you contact us directly, we will assist within our role as Processor.
Complaints. If you are not satisfied with our response, you may complain to the Saudi Data and AI Authority (SDAIA), the competent authority under the PDPL. Nothing in this policy limits your right to contact a public authority.
8. Cookies
Cookies. Bench uses cookies or similar technologies necessary for website or account operations and may use analytics or marketing technologies where enabled. We obtain prior consent when required for optional technologies and offer available mechanisms to modify preferences. Browser-level controls may also restrict cookies. Cookie settings and their exact behavior must correspond to the features implemented on the live website.
9. Marketing
Marketing. We use personal contact details for direct promotional communications only with the prior consent required by PDPL Articles 25–26, using information collected directly from the individual and offering a clear way to unsubscribe. We do not use customers’ employee HR records or Sensitive Data for Bench marketing. Operational and service notices may still be sent when necessary for the subscribed Service.
10. Children
Children and dependants. Bench is a business-oriented service, not directed to children. Employers may upload family or dependant records for lawful HR and benefit administration, which Bench processes only as their Processor. We do not use such records for independent marketing or general-purpose AI training.
11. Changes to this policy
Changes. Bench may update this Privacy Policy to reflect law and actual processing practices and will publish an updated effective date. Where a material change requires notice or a new lawful basis or consent, Bench will follow the relevant legal requirements.
12. Contact us
شركة انظمة بنش لتقنية المعلومات (trading as “Bench”) is a Saudi limited liability company with unified national number 7033252953, operating from Riyadh, Kingdom of Saudi Arabia. Our website is https://bench.sa and privacy enquiries may be sent to support@bench.sa.
Privacy contact: support@bench.sa. This contact route does not itself constitute a representation that a particular employee has been formally appointed as a Data Protection Officer.
Effective date: 12 October 2026