Privacy Policy
GDPR · Saudi PDPL · Applicable Data Protection Laws
Effective Date: 10 April 2026
Last Updated: 10 April 2026
Designed to support compliance with GDPR, Saudi PDPL, and applicable data protection laws.
Marix ERP ("the Platform", "we", "us", or "our") is a cloud-based Enterprise Resource Planning system provided to businesses ("Tenants") for managing their internal operations including HR, payroll, attendance, finance, procurement, sales, and compliance.
This Privacy Policy explains how personal data is collected, processed, stored, and protected when you use the Platform — whether through the web application or the Marix mobile app. It applies to all users of the Platform, including company administrators, managers, and employees.
If you are an end-customer or supplier of a business that uses Marix ERP, that business's own privacy policy governs how your data is handled.
Each business that subscribes to Marix ERP operates as an independent data controller for the data belonging to their employees and operations. Marix ERP acts as a data processor on behalf of those businesses, providing the infrastructure and tools through which that data is managed.
A separate Data Processing Agreement (DPA) governs the processing of personal data between Marix ERP and each Tenant.
Marix ERP may engage sub-processors (such as cloud hosting, email delivery, and storage providers) to support the delivery of the Platform. A list of current sub-processors is available upon request.
No personal data is used to train third-party AI models unless explicitly approved by the Tenant. Marix ERP does not retain or reuse Tenant data submitted to any features beyond the scope of providing the requested functionality.
Lawful Processing by Tenant: Each Tenant is responsible for ensuring that they have a lawful basis for collecting and processing personal data within the Platform, including obtaining any required consents from their employees and complying with applicable local data protection laws.
No Liability for Tenant Misuse: Marix ERP is not responsible for how Tenants use the Platform or process personal data within it, provided such processing is carried out using the tools made available by the Platform. Tenants remain solely responsible for their own compliance obligations as data controllers.
We collect only the minimum data necessary to provide the Platform's functionality.
Where face images are used for attendance verification, such data is processed solely for that purpose and is not used for identification, profiling, or any purpose outside attendance verification.
Where the optional AI chatbot or analytics features are enabled by a Tenant administrator, data is processed to generate operational insights. No personal data is used to train third-party AI models unless explicitly approved by the Tenant. Marix ERP does not retain or reuse Tenant data submitted to AI features beyond the scope of providing the requested functionality. This feature is disclosed to users in the application before activation.
| Purpose | Legal Basis |
|---|---|
| Authenticating your identity and granting role-based access | Legitimate interest / Contract |
| Processing payroll and generating payslips | Contract fulfilment |
| Recording and tracking attendance and leave | Contract / Legal obligation |
| Generating HR reports and compliance documents | Legal obligation |
| Sending transactional notifications (payslips, contract alerts, password resets) | Contract fulfilment |
| Audit logging of user actions for security and accountability | Legitimate interest |
| Detecting and preventing unauthorised access or security incidents | Legitimate interest |
| Geolocation-based attendance verification | Consent / Contract |
| E-signature on employment contracts | Contract / Legal obligation |
| Saudi ZATCA compliance and government reporting | Legal obligation |
Each business tenant operates in a logically isolated database. Data belonging to one tenant is never accessible to another. Platform-level administrators access tenant data solely for the purposes of technical support, security incident response, or as required by law — and only with appropriate access controls.
| Data Type | Retention Period |
|---|---|
| Active employee records | Duration of active account |
| Payroll and financial records | As required by applicable law (typically 5–7 years) |
| Attendance and leave records | Duration of active account |
| Audit logs | 12 months rolling |
| Session data | Until logout or session expiry |
| Uploaded documents | Duration of active account |
| After account termination | Data retained for 90 days then permanently deleted, unless a legal hold applies |
We take the following technical and organisational measures to protect your data:
In the event of a personal data breach, Marix ERP will notify affected Tenants without undue delay and within applicable legal timelines (including the 72-hour requirement under GDPR where applicable). Tenants are responsible for notifying their affected users and relevant supervisory authorities as required by law.
The Marix mobile app requests device location permission only for the purpose of verifying that an employee is within an allowed radius of their designated office location at the time of check-in. Location data:
The Platform may connect to the following third-party services depending on your Tenant's configuration:
| Service | Purpose |
|---|---|
| Email delivery provider | Password resets, payslip delivery, notifications |
| WhatsApp Business API | Inbound message inbox (where enabled) |
| Google Maps | Office location display on HR forms |
| AI provider (e.g. Anthropic) | Optional AI assistant features — disclosed before activation |
| Cloud storage | Document and backup storage |
| ZATCA (Saudi Arabia) | E-invoicing compliance reporting |
Each third-party service is governed by its own privacy policy. A list of current sub-processors is available upon request.
The Platform uses a single session cookie to maintain your authenticated session. No tracking, profiling, or advertising cookies are used. Disabling cookies in your browser will prevent you from logging in.
Marix ERP does not make fully automated decisions that produce legal or significant effects on individuals without human involvement. Features such as payroll calculations, leave approvals, and attendance flagging are tools that support — but do not replace — human decision-making by authorised administrators.
Marix ERP is hosted on secure cloud infrastructure located in the United Kingdom. Where personal data is transferred across borders, appropriate safeguards such as contractual protections, encryption, and access controls are implemented to ensure compliance with applicable data protection laws. Tenants with specific data residency requirements should contact the Platform administrator to discuss available options before use.
Depending on the laws of your jurisdiction, you may have the following rights regarding your personal data:
We aim to respond to all data subject requests within 30 days of receipt, or within such shorter period as required by applicable law. Where a request is complex or involves a high volume of data, we will notify you within the initial 30-day period if an extension is required.
To exercise any of these rights, contact your company's HR administrator or the system administrator of your Tenant account.
Where processing is based on consent — such as location access for mobile attendance or optional AI features — users may withdraw consent at any time without penalty. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, contact your Tenant administrator or adjust the relevant permissions in your device or account settings.
The Platform is intended for use by employed adults. We do not knowingly collect data from persons under the age of 16. If you believe a minor's data has been entered into the system, please contact your Tenant administrator immediately.
We may update this policy to reflect changes in the Platform's features or applicable law. When we do, the version date at the top of this document will be updated, and active users will be prompted to review and accept the revised policy upon their next login.
For privacy-related queries, data subject requests, security concerns, or to request the sub-processor list or a copy of our DPA:
Platform Administrator
Marix ERP — operated by RMZ International
Email: [email protected]
This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Kingdom of Saudi Arabia.
Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Riyadh. Nothing in this clause limits the rights of data subjects to bring claims before a relevant data protection supervisory authority in their jurisdiction.
This policy is designed to support compliance with the EU General Data Protection Regulation (GDPR), the Saudi Personal Data Protection Law (PDPL), and other applicable data protection frameworks. It should be reviewed by a qualified legal professional before publication, particularly if your tenants operate in regulated industries.