Privacy & Data Governance Statement
This Privacy Policy explains how KCGH HRM Hub processes, protects, and handles personal data submitted through our HRMS software platform, mobile apps (Android/iOS), biometric sync connectors, and Employee Self Service (ESS) portals. Designed in alignment with the Digital Personal Data Protection Act (DPDP Act 2023, India) and global data privacy standards (GDPR aware).
1. Introduction
At KCGH HRM Hub ("we", "us", "our", or "Platform"), we recognize the sensitivity of human resource data. This Privacy Policy details our practices regarding the collection, storage, processing, and protection of personal and professional information of employees, managers, and administrators ("Users") interacting with our enterprise software.
The subscribing employer ("Company" or "Client") acts as the primary Data Fiduciary / Data Controller, determining the purposes and policies for workforce data processing. KCGH HRM Hub functions as a Data Processor / Data Processor Agent, delivering cloud-hosted HR tools strictly in accordance with statutory compliance guidelines and contractual instructions from the Company.
2. Information We Collect
To provide accurate workforce management, time-tracking, and payroll functions, the Platform processes the following categories of data:
- Full Name & Contact: Employee Name, Official & Personal Email Address, Mobile Phone Number, Emergency Contact Details.
- Demographics & Identity: Date of Birth (DOB), Gender, Marital Status, Residential Address, Blood Group, Profile Avatar/Photo.
- Government Identifiers (Where Enabled): Permanent Account Number (PAN), Aadhaar Number, Provident Fund (UAN), ESI Number, Passport details.
- Organizational Context: Employee ID / Code, Joining Date, Department, Branch Location, Designation/Post, Manager/Supervisor Assignment.
- Payroll & Compensation: Basic Pay, Allowances, Deductions, Bonus Records, Overtime Rates, Bank Account Details for Salary Credit, TDS Tax Declarations.
- Loans & Advances: Advance Salary Requests, Approved Loan Amounts, EMI Schedule, Repayment Status, Settlement Records.
- Mobile Geo-Location: Precise GPS Latitude & Longitude captured exclusively during punch check-in / check-out actions.
- Hardware Sync Logs: Biometric Punch Timestamps (Fingerprint / Facial recognition logs from hardware terminals), NFC Card scans, QR Code check-ins.
- Leave & Shifts: Shift assignments, Leave applications, Overtime records, Time-Leave (Permission) logs, Attendance Correction forms.
- Device Information: Device Brand/Model, Operating System (Android/iOS version), Unique Device Identifiers, Mobile App Version.
- Network & Push Tokens: IP Address, Browser User-Agent, Firebase Push Notification Tokens (for real-time alerts).
- System Logs: User Session Tokens, OAuth Passport Tokens, Audit Logs for sensitive administrative actions.
3. Why We Collect Data (Purposes of Processing)
Data collected by KCGH HRM Hub is processed strictly for legitimate workplace operational purposes:
HR & Payroll Administration
Calculating monthly salaries, overtime payouts, tax deductions (TDS), Provident Fund (PF), ESI contributions, loan EMI recoveries, and payslip generation.
Attendance Verification
Validating shift compliance, geo-fenced mobile check-ins, preventing proxy attendance/fake punches, and processing leave requests.
Real-Time Notifications
Sending shift alerts, leave approval notifications, birthday announcements, official company notices, and emergency updates via push notifications, SMS, or email.
Audit & Regulatory Compliance
Fulfilling statutory labor law requirements, tax reporting obligations, maintaining immutable system audit logs, and security enforcement.
4. Legal Basis for Data Processing
Under the DPDP Act 2023 (India) and international privacy frameworks, workforce data processing relies on the following legal grounds:
- Performance of Employment Contract: Processing is required to fulfill employment duties, process salary payments, and track working hours.
- Compliance with Legal Obligations: Mandatory reporting under Income Tax Act, Employees' Provident Funds Act, ESI Act, and state labor regulations.
- Legitimate Business Interests: Maintaining company security, protecting intellectual assets, preventing biometric/payroll fraud, and operational reporting.
- Consent: Where required for optional features (e.g. mobile push notifications, profile avatar uploads).
5. Data Sharing & Disclosure
Strict Non-Sale Commitment
KCGH HRM Hub NEVER sells, rents, or monetizes employee personal data to third-party advertisers or data brokers under any circumstances.
Data disclosure is restricted strictly to authorized entities under essential operational conditions:
- Employer / Subscribing Company: Authorized HR Managers, Department Heads, and Administrators within your organization.
- Statutory Authorities: Income Tax Department, EPFO, ESIC, or court-mandated legal disclosures upon receiving valid statutory notices.
- Essential Infrastructure Partners: Cloud hosting providers (Hostinger Cloud), SMS/WhatsApp gateways, Firebase Push Notification services, and Google Maps API (for geo-verification).
6. Data Security Controls
We employ multi-layered administrative, technical, and physical safeguards to prevent data breaches:
8. Data Retention Policy
Workforce records are retained in active database storage for the duration of the Company's active subscription. Statutory records (payroll registers, attendance logs, tax deduction reports) are retained in compliance with local statutory laws (e.g. 7-8 years under tax regulations) or as dictated by the Company's internal HR governance rules.
9. Employee Statutory Rights
Under applicable personal data protection legislation, employees have the following rights:
Right to Access
View profile details, attendance logs, leave balances, loan statements, and payslips anytime via ESS.
Right to Correction
Request updates or corrections to incomplete or inaccurate personal data through HR administrator workflows.
10. Company Governance
Subscribing employers are obligated to ensure workforce data is collected lawfully, restrict administrative access to authorized personnel, and respond to employee data queries in a timely manner.
11. Children's Privacy
KCGH HRM Hub is an enterprise commercial HRMS software strictly intended for legal workforce deployment. We do not knowingly collect or process information of individuals under legal working age.
12. International Data Transfers
Primary database clusters are hosted in secure enterprise data centers located within the Republic of India. Where third-party service APIs require cross-border transport (e.g. push notification tokens), data is transmitted using encrypted TLS protocols under standard contractual clauses.
13. Policy Updates
We may revise this Privacy Policy periodically to reflect technological changes or statutory regulations. The "Last Updated" date at the top of this document indicates when the latest modifications took effect.
14. Privacy & Data Protection Contact
For data privacy queries, statutory requests, or Data Protection Officer (DPO) communications:
Data Protection Desk - KCGH HRM Hub
Corporate HQ, Tamil Nadu, Republic of India
Portal: https://hr.kcgoldhouse.in
Privacy Email: privacy@kcgoldhouse.in
DPO Contact: dpo@kcgoldhouse.in
Statutory Response Window: 7-14 Business Days