Data processing terms
Your company decides what happens to your employees' data. These terms say what we may and may not do with it.
On this page
Who decides and who processes
Under the Digital Personal Data Protection Act, 2023, your company is the Data Fiduciary for the personal data of its employees: it decides what is collected and why. Human Before Resource Private Limited is your Data Processor: we process that data only to run HBRX for you.
For our own records, such as your account owner's sign-in, billing details and enquiries sent from this website, we are the Data Fiduciary. The Privacy notice covers that data.
These terms form part of the Terms of use.
Only on your instructions
We process employee data only to provide HBRX, as your settings and your users' actions instruct.
- We do not sell personal data.
- We do not use it for advertising.
- We do not use it to train AI models.
- We do not combine it with data from other companies.
Who at HBRX can see it
Our staff cannot open your company's data. When support needs a look, staff ask with a reason for 1 to 72 hours, and only your account owner can say yes. Even then staff see only the employee directory (code, name, status and joining date), never pay, bank or documents. Every request and grant is recorded in your audit log, and access ends on its own.
Security
We protect the data with encryption, strict separation between companies, two-step sign-in for administrators and an audit trail. The Security page explains each control.
Sub-processors
We use a small number of service providers to run HBRX. They are listed on the Sub-processors page with what each one does. We tell your account owner at least 30 days before we add a provider that handles employee personal data, so you can raise an objection.
Where data is stored
The main database and the logs are on servers in India. Uploaded files and backups are encrypted on those servers before they are sent to storage, so the storage provider only ever holds encrypted copies. The keys that unlock them stay in India.
If something goes wrong
If we confirm a breach that affects your company's personal data, we tell your account owner without undue delay, aiming for within 24 hours. We share what happened, what data is affected and what we are doing, so you can meet your own duties to inform the Data Protection Board and the people affected.
Helping with employees' requests
HBRX gives you the tools to answer requests from your employees: they can see their own records, ask for corrections through change requests, and ask for a copy or deletion of their data from the app. Requests reach your HR team, who decide.
When you leave
After your plan is cancelled or ends, you have 30 days to export your data. We then delete your company's data from our database and storage within the next 30 days, and destroy your company's encryption keys. Backups age out within 35 days after that. We send a deletion certificate if you ask for one.
Records and audits
Your audit log keeps a record of sign-ins, changes, exports and sensitive views for at least one year. We answer reasonable questions about how we process your data and give you the information you need to show your own compliance.