Privacy Policy

Klogu People is provided by [Operator's registered company name] (“we”). This policy explains what personal data the Service handles, why, and for how long, as the Digital Personal Data Protection Act, 2023 (“DPDP Act”) requires.

We handle personal data in two different roles:

• Your account. This covers the details of the person who signs up and of the admins who use the Service. We decide how this data is used, so we are its Data Fiduciary.
• Your staff's records. This covers what your organisation puts into the Service about its employees. Your organisation is the Data Fiduciary for these records. We process them only to run the Service for it, on its instructions.

• When you sign up: your name, your company's name, your work email and your mobile number.
• When anyone signs in: the one-time code or PIN used, the time, and the device's IP address. We use these to stop repeated guessing and abuse.
• What your organisation adds about its staff, which it chooses. This can include:
  • names, contact details, employee IDs, dates of birth and photographs;
  • job, location and pay;
  • attendance, including the location of a phone check-in where your organisation uses GPS attendance;
  • leave and claims;
  • statutory numbers such as PAN, Aadhaar, UAN and ESIC;
  • bank details, and uploaded documents.

• To run the Service: sign-in, attendance, leave, payroll, registers and the rest of what your organisation uses.
• To send what the Service needs to send: sign-in codes, and messages about your trial or subscription. When you ask to continue after a trial, we also call or write to you about it.
• To keep to one free trial per organisation, per email address and per mobile number. See section 5 for what we keep for this.
• To keep the Service secure, and to meet our legal obligations.

We do not sell personal data, and we do not use it for advertising.

When you sign up, you agree to this policy and our Terms & Conditions. We record which version you agreed to, and when. You may withdraw your consent at any time by asking us to close your account. Closing it ends the Service for your organisation, and its data is then deleted as in section 5.

• A sign-up whose email is never confirmed is deleted within two days.
• A free trial that isn't continued is closed 30 days after it ends. All of its data, including uploaded files, is permanently deleted 90 days after it ends.
• After a trial is deleted, we keep only a one-way code (a keyed hash) of the email address, mobile number and company name used to sign up, with the date and the policy version agreed to. It cannot be turned back into the details. It exists only so that the same details cannot start a second free trial.
• A paying organisation's data is kept for as long as its subscription runs, and afterwards for as long as we have agreed with it or the law requires. Wage and attendance records are often ones an employer must be able to produce for several years.
• Backups of the database are kept for up to 7 days, then overwritten.

We use service providers to run the Service: cloud hosting, the database, file storage, and the delivery of emails and text messages. They handle data only on our instructions and under contract. We disclose personal data to authorities only when the law requires it.

Our providers may store or process data on servers outside India, as the DPDP Act permits.

The Service is served only over encrypted connections (HTTPS). Each organisation's data is kept apart, and the Service checks it on every request. Uploaded documents are private files, reachable only by signed-in users. Sign-in uses one-time codes, PINs or an authenticator app rather than stored passwords. Changes to sensitive records are written to an audit log.

Under the DPDP Act you may ask us:

• for a summary of the personal data we hold about you and how it is used;
• to correct or update it, or to erase it;
• to nominate someone to act for you;
• to deal with a grievance.

If you are an employee of an organisation that uses Klogu People, your employer decides what is recorded about you. Please ask your employer first, and we will help them answer you.

The Service is for organisations and their working-age staff. It is not meant for use by anyone under 18.

Questions, requests and complaints about personal data: [Grievance Officer's name], [Grievance Officer's email]. If you aren't satisfied with our answer, you may complain to the Data Protection Board of India.

General questions: [contact email].

When this policy changes, its version and date at the top change too. If a change affects how we use your data, we will tell you before it applies.