Privacy Policy

1. Introduction

uHRMS ("we," "us," "our," or "Company") is committed to protecting your privacy and ensuring you have a positive experience on our website and service. This Privacy Policy explains our online information practices and the choices you can make about how your information is used.

2. Applicability and Regulatory Compliance

This Privacy Policy is compliant with:

• Digital Personal Data Protection Act, 2023 (DPDPA)
• Information Technology Act, 2000
• All applicable Indian data protection regulations

3. Information We Collect

We collect information in the following ways:

4. How We Use Your Information

We use the information we collect for purposes including:

• Providing, maintaining, and improving our Service
• Processing payroll, statutory compliance, and tax calculations
• Generating statutory reports (Form 16, PF ECR, TDS worksheets, etc.)
• Communicating with you about your account and service updates
• Sending transactional emails (payslips, notifications, confirmations)
• Complying with legal and regulatory obligations
• Detecting and preventing fraud or security incidents
• Analyzing usage patterns to improve our Service

5. Data Protection and Security

We implement comprehensive security measures:

• Encryption: All sensitive data (PAN, bank account numbers, POSH descriptions) encrypted at rest using AES-256-GCM
• Row-Level Security: PostgreSQL RLS ensures multi-tenant isolation
• Audit Logging: All access to sensitive data logged and auditable
• Regular Security Reviews: Periodic security audits and compliance checks
• SSL/TLS: All data transmitted over secure, encrypted connections

6. Data Sharing and Third Parties

We do not sell your personal data. We may share information with:

• Service Providers: Payment processors, email providers, cloud storage (for essential functionality)
• Legal Compliance: Government authorities when required by law
• CA/Accountants: Only when your organization assigns CA portal access (read-only, masked PII)

7. Your Rights (DPDPA)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Right to Access: Request a copy of your personal data
• Right to Correction: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Opt-Out: Withdraw consent for certain processing activities
• Right to Grievance: File a grievance with our Data Protection Officer

To exercise any of these rights, contact us at privacy@uhrms.app.

8. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service to you
• Comply with statutory compliance (statutory records retention: minimum 7 years per Indian law)
• Resolve disputes and enforce agreements

Once these purposes are fulfilled, we securely delete your data unless longer retention is required by law.

9. Cookies and Tracking

We use cookies to:

• Maintain your login session
• Remember your preferences
• Analyze usage patterns

You can control cookie settings in your browser. Some features may not work properly if you disable cookies.

10. International Data Transfer

Your data is primarily stored in India. If we transfer data outside India, we ensure appropriate safeguards compliant with DPDPA.

11. Children's Privacy

uHRMS is not intended for children under 18. We do not knowingly collect information from minors. If we learn we have collected data from a minor without parental consent, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or by posting an updated version on our website. Your continued use of the Service constitutes acceptance of updated policies.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

14. Grievance Redressal

If you have concerns about our data practices, you may file a grievance with our Data Protection Officer at dpo@uhrms.app. We will address grievances within 30 days.