Privacy Policy

Humvora Technologies ("Humvora", "Company", "we", "us", or "our") is committed to protecting the privacy and security of personal data processed through our cloud-based human resource management platform and related services, accessible at www.humvora.com and through associated mobile and web applications (collectively, the "Platform" or "Services"). This Privacy Policy describes how Humvora collects, uses, discloses, stores, transfers, and protects personal data in connection with the Platform. This Privacy Policy applies to: (a) representatives of organizations that subscribe to or evaluate the Platform ("Customers"); (b) administrators, employees, contractors, and other end users authorized by a Customer to access the Platform ("Authorized Users" or "Employee Users"); (c) job applicants and candidates whose data is processed through the recruitment and applicant tracking modules of the Platform ("Candidates"); and (d) visitors to our website ("Visitors"). IMPORTANT NOTE ON ROLES: In most cases, when Humvora processes Personal Data of Employee Users and Candidates on behalf of a Customer through the Platform, Humvora acts as a "data processor" or "service provider", and the Customer acts as the "data controller" or "business" that determines the purposes and means of processing such data. Where Humvora processes Personal Data for its own purposes — such as Customer account administration, billing, website analytics, marketing to Customers, and product improvement — Humvora acts as a data controller in its own right.

The categories of Personal Data collected and processed through the Platform vary depending on the role of the individual and the Modules enabled by the Customer: (a) Account and Identity Data: full name, employee identification number, date of birth, gender, nationality, marital status, government-issued identification numbers (PAN, Aadhaar, passport, driving license), photographs, digital signatures, and login credentials. (b) Contact Data: residential address, permanent address, personal and official email addresses, personal and official phone numbers, and emergency contact details. (c) Employment Data: job title, department, designation, reporting manager, employment type and status, joining date, work location, work history, employment contracts, offer letters, promotion and transfer records, disciplinary records, and exit records. (d) Compensation and Financial Data: salary structure, bank account details, payment card details, tax identification numbers, tax declarations, provident fund and social security numbers, loan records, and payslip data. (e) Attendance, Time, and Location Data: clock-in/out timestamps, work shift schedules, leave applications and balances, holiday calendars, overtime records, geolocation data, and biometric data (fingerprint or facial recognition templates). (f) Performance and Talent Data: goal-setting records, performance appraisal ratings and feedback, competency assessments, training records, and succession planning information. (g) Recruitment Data (Candidates): name, contact details, resume/CV content (education, employment history, skills, references), interview notes, background verification results, and offer correspondence. (h) Health-Related Data: medical leave, insurance enrollment, disability status for accommodation, and vaccination records (sensitive personal data processed only with appropriate safeguards). (i) Communications Data: helpdesk tickets, support chat transcripts, internal messages, surveys, and feedback submissions. (j) Technical and Usage Data: IP addresses, device identifiers, browser type and version, operating system, login timestamps, pages visited, features used, and diagnostic logs. (k) Customer Account and Billing Data: company name, business registration details, billing address, tax registration numbers, invoicing contacts, and payment transaction records.

Directly from Customers and Authorized Users: when a Customer or its Administrators set up the Platform, configure Modules, and input or upload employee records, organizational data, payroll inputs, and policy documents; and when Employee Users access self-service features to view or update their own information, submit leave or expense requests, complete performance reviews, or interact with helpdesk modules. From Candidates: when a Candidate applies for a position through a careers portal or applicant tracking system powered by the Platform, uploads a resume, completes an online application form, or participates in assessments configured by the Customer. Automatically through use of the Platform: technical and usage data is collected automatically when the Platform is accessed, including through cookies, pixels, log files, and SDKs embedded in our mobile applications. From Third-Party Integrations: where the Customer enables integrations with biometric attendance devices, background verification agencies, banking partners, single sign-on providers, or other Third-Party Services. From Visitors to our Website: when a Visitor fills out a contact form, requests a demo, subscribes to a newsletter, or otherwise voluntarily provides information through www.humvora.com.

Humvora processes Personal Data for the following purposes: (a) Provision of the Platform and Services: to enable Customers and Authorized Users to access and use subscribed Modules. Legal basis: performance of contract with the Customer. (b) Account Management and Communications: to create and manage accounts, send transactional communications, and respond to support requests. Legal basis: performance of contract and legitimate interest. (c) Compliance and Statutory Reporting: to facilitate compliance with labour, taxation, and social security laws. Legal basis: Customer's legal obligations as an employer. (d) Security and Fraud Prevention: to detect, investigate, and prevent fraudulent transactions, unauthorized access, security incidents, and abuse of the Platform. Legal basis: legitimate interest in protecting security and integrity. (e) Product Improvement and Analytics: to analyze usage patterns, diagnose technical issues, and improve functionality. Legal basis: legitimate interest in product improvement. (f) Marketing and Business Development (Customers and Visitors only): to send information about new features, product updates, events, and offers. Legal basis: consent or legitimate interest. (g) Legal Compliance and Dispute Resolution: to comply with laws, respond to lawful requests, enforce Terms of Service, and defend legal claims. Legal basis: compliance with legal obligations. (h) Corporate Transactions: to facilitate due diligence in connection with mergers, acquisitions, or asset sales. Legal basis: legitimate interest. Where consent is relied upon, it may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

Where a Customer enables biometric attendance features (fingerprint scanners or facial recognition), Humvora processes biometric templates strictly in accordance with the Customer's configuration and instructions. Such biometric templates are stored as encrypted mathematical representations rather than raw images, are used solely for identity verification for attendance purposes, and are not used for marketing or profiling without separate consent. The Customer, as data controller for its Employee Users, is responsible for: (a) obtaining all consents required under applicable law prior to enabling biometric data collection; (b) providing Employee Users with clear notice of the purpose, retention period, and their rights; and (c) ensuring compliance with sector-specific laws, including alternative non-biometric verification methods. Health-related data, religious affiliation, disability status, and similar categories of sensitive Personal Data are processed only on Customer instructions, with access restricted to authorized Administrator roles.

Humvora does not sell Personal Data to third parties for monetary or other valuable consideration. We may disclose Personal Data in the following circumstances: (a) Sub-processors and Service Providers: Humvora engages third-party sub-processors including cloud infrastructure providers, data center operators, email and communication services, customer support tooling, analytics providers, and payment processors. These sub-processors are contractually bound to process Personal Data only as instructed, implement appropriate security measures, and maintain confidentiality. (b) Third-Party Integrations Enabled by the Customer: where Customers configure integrations with biometric devices, background verification agencies, banking partners, accounting software, or SSO providers. (c) Affiliates: Personal Data may be shared with Humvora's corporate affiliates subject to equivalent privacy protections. (d) Legal and Regulatory Disclosures: Humvora may disclose Personal Data where required by law, regulation, legal process, or governmental request. (e) Corporate Transactions: in connection with mergers, acquisitions, or asset sales, Personal Data may be transferred to the acquiring entity. (f) With Consent: Humvora may disclose Personal Data where explicit consent has been provided.

Humvora's primary data hosting infrastructure may be located in data centers within India and/or other jurisdictions as specified in the applicable Order Form or DPA. Where Personal Data is transferred across national borders, Humvora shall implement appropriate safeguards as required by applicable law to ensure such transfers provide an adequate level of protection. Such safeguards may include: (a) reliance on adequacy decisions; (b) execution of standard contractual clauses approved by competent authorities; (c) reliance on binding corporate rules; or (d) other lawful transfer mechanisms. Customers requiring details of specific transfer mechanisms may contact privacy@humvora.com.

Humvora retains Personal Data for as long as necessary to provide the Services to the Customer during the Subscription Term, and thereafter for such additional period as may be necessary to comply with legal, regulatory, tax, accounting, or reporting obligations, to resolve disputes, to enforce agreements, and in accordance with Humvora's data retention schedules. Following termination or expiry of a Customer's subscription, Customer Data shall be retained for an export window and subsequently deleted or anonymized in accordance with the Terms of Service, except where longer retention is required by applicable law. Technical and usage logs collected for security, fraud prevention, and diagnostic purposes are generally retained for a limited period, typically not exceeding twelve (12) to twenty-four (24) months, unless a longer period is required for an ongoing security investigation or legal proceeding.

Humvora implements a layered information security program incorporating administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. These measures include: encryption of Personal Data in transit using TLS and at rest using industry-standard encryption; role-based access controls; multi-factor authentication for administrative access; network security controls including firewalls and intrusion detection systems; regular security testing including vulnerability scanning and periodic penetration testing; secure software development practices; and employee security awareness training. While Humvora implements robust security measures, no method of electronic transmission or storage is completely secure. Customers and Authorized Users also play a critical role in maintaining security, including safeguarding login credentials, configuring access permissions appropriately, and promptly reporting suspected security issues to security@humvora.com.

Humvora and its service providers use cookies, web beacons, pixel tags, local storage, and similar tracking technologies (collectively, "Cookies") on our website and within the Platform to operate and improve our Services, remember user preferences, authenticate sessions, and understand usage patterns. Categories of Cookies used include: (a) Strictly Necessary Cookies: required for website and Platform function (session authentication, security) - cannot be disabled without impairing core functionality. (b) Performance and Analytics Cookies: collect information about usage to improve performance and usability. (c) Functionality Cookies: remember user choices such as language preferences and display settings. (d) Marketing Cookies: used on marketing website (not authenticated Platform) to deliver relevant advertising and measure campaign effectiveness. Visitors can manage cookie preferences through the cookie consent banner and browser settings. Within the authenticated Platform, Strictly Necessary Cookies are required for Services to function and cannot be disabled.

Subject to applicable law, individuals whose Personal Data is processed may have the following rights: (a) right to access and obtain a copy of their Personal Data; (b) right to correct inaccurate or incomplete Personal Data; (c) right to request deletion of Personal Data, subject to legal retention; (d) right to restrict or object to certain processing; (e) right to data portability; (f) right to withdraw consent; (g) right to lodge a complaint with a supervisory authority; and (h) rights relating to automated decision-making. For Employee Users and Candidates: because Humvora processes such data as a service provider on behalf of the Customer, individuals should first direct requests to their employer or prospective employer (the Customer). For Customer Account Contacts and Visitors: requests regarding data Humvora processes as a controller may be submitted to privacy@humvora.com. Humvora will respond to verified requests within timeframes required by applicable law.

The Platform is designed for use by organizations and their adult workforce and is not directed at children. Humvora does not knowingly collect Personal Data directly from individuals under the age of eighteen (18) for purposes of creating an independent account on the Platform. Where a Customer's workforce lawfully includes individuals below the age of eighteen (18) in accordance with applicable labour laws (e.g., apprentices or interns), the Customer is responsible for ensuring that any consents or parental/guardian consents required under applicable data protection law have been obtained prior to entering such data into the Platform. Our public-facing marketing website is not directed at children, and we do not knowingly collect Personal Data from children through such website.

Certain features of the Platform may involve automated processing, such as automated leave balance calculations, payroll computations based on configured formulas, automated routing of approval workflows, and, where enabled by the Customer, applicant screening or ranking tools that use configurable criteria to shortlist Candidates. Where such automated processing produces legal effects or similarly significantly affects an individual (e.g., automated rejection of a job application without human review), and where required by applicable law, the Customer, as the controller responsible for configuring such features, is responsible for ensuring appropriate safeguards are in place, including the ability for affected individuals to request human review of automated decisions, to express their point of view, and to contest the decision.

Our website and Platform may contain links to third-party websites, applications, or services that are not owned or controlled by Humvora, including links to integrated Third-Party Services described in the Terms of Service. This Privacy Policy does not apply to such third-party websites or services, and Humvora is not responsible for the privacy practices of any third party. We encourage individuals to review the privacy policies of any third-party websites or services they visit or use.

Humvora may update this Privacy Policy from time to time to reflect changes in our practices, the Services we offer, or applicable legal requirements. We will post the revised Privacy Policy on our website with an updated "Last Updated" date, and for material changes that significantly affect how Personal Data is processed, we will provide additional notice, such as an email notification to Customer Administrators or a prominent notice on the Platform, at least fifteen (15) days prior to the change taking effect where reasonably practicable. Continued use of the Platform or our website following the effective date of any revised Privacy Policy constitutes acceptance of the revised terms.

European Economic Area, United Kingdom, and Switzerland: For individuals located in these regions, the legal bases for processing described in Section 4 apply, and individuals have the rights described in Section 11 in accordance with the GDPR, UK GDPR, and Swiss Federal Act on Data Protection. Where Humvora acts as a data processor, the terms of the applicable DPA shall govern. India: Humvora processes Personal Data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and rules made thereunder. Individuals in India may exercise rights including grievance redressal through Humvora's designated Grievance Officer at grievance@humvora.com. United States (including California): To the extent the CCPA/CPRA applies, California residents may have rights to know, access, delete, correct, and opt out of the sale or sharing of Personal Data (Humvora does not sell or share Personal Data as defined under the CCPA). Requests may be submitted to privacy@humvora.com. Other Jurisdictions: Humvora aims to provide consistent privacy protections globally, and where local law provides additional rights, Humvora will comply to the extent applicable.

In accordance with applicable data protection laws, Humvora has designated a Grievance Officer / Data Protection Contact to address inquiries and complaints relating to the processing of Personal Data. Humvora Technologies Attention: Privacy / Grievance Officer Website: www.humvora.com Email: info@humvora.com Registered Office: Noida, Uttar Pradesh, India We will aim to acknowledge receipt of all privacy-related inquiries promptly and to resolve them within the timeframes required by applicable law.