Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") governs the collection, processing, storage, and transfer of Personal Data within the Vinti Web Solution Human Resource Management System (HRMS) platform. We are committed to safeguarding personal information in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and the Information Technology Act, 2000 (including SPDI Rules 2011) of India.

This Policy applies to:

• Employees, Contractors, and Interns whose data is administered within the HRMS.
• Job Candidates and Applicants submitting resumes or participating in recruitment.
• System Administrators and HR Managers managing tenant or corporate workspaces.
• Visitors to our public portal and marketing website.

2. Identification of Roles: Data Fiduciary vs. Data Processor

Under the Digital Personal Data Protection Act, 2023:

• Employer / Client Organization as Data Fiduciary: Your employing entity determines the purposes and means of processing employee data (such as payroll structure, attendance policies, and shift allocations) and acts as the primary Data Fiduciary.
• Vinti Web Solution as Data Processor / Service Provider: Where Vinti Web Solution provides SaaS hosting, software maintenance, and cloud infrastructure, it acts strictly as a Data Processor on behalf of and under the documented instructions of the employer organization.
• Vinti Web Solution as Data Fiduciary for Website Visitors: For direct visitors to our public marketing website, careers page, and platform inquiries, Vinti Web Solution acts as the Data Fiduciary.

3. Categories of Personal Data Collected

We collect and process only data strictly necessary for legitimate employment and system administration purposes:

• Personal Profile & Identity Data: Full name, employee code, gender, date of birth, personal email address, work email address, contact telephone numbers, residential address, emergency contact name and phone number, profile photograph/avatar, blood group, and government identity references where legally mandated.
• Attendance & Working Hours Data: Check-in and check-out timestamps, shift allocations, scheduled hours, worked minutes, break durations, late arrivals, early departures, overtime records, and manager approvals.
• Location & Geolocation Data: Where location-based punch-in or login auditing is enabled, we capture device IP address, network city/region, latitude, longitude, and device identifier at the precise moment of check-in/out or login. Continuous 24/7 background GPS tracking is never conducted.
• Payroll & Financial Data: Bank account holder name, bank name, branch, account number, IFSC code, SWIFT code, UPI identifier, basic salary, allowances, overtime earnings, bonuses, deductions (Provident Fund, ESIC, Tax Deducted at Source / Income Tax, Professional Tax), loan advances, and generated payslips.
• Leave & Time-Off Data: Leave entitlement balances, applications, leave categories (casual, sick, earned, maternity/paternity), reason for absence, medical certificates (where uploaded), and approval history.
• Documents & Identity Proofs: Educational certificates, past employment records, identity documents (Aadhaar, PAN, Passport, Driving License), offer letters, and ID card templates.
• Internal Communications & Meetings: Direct chat messages, group messages, shared file attachments, emoji reactions, internal company emails, scheduled meetings, and WebRTC video call signal records.
• Security & Device Logs: Authentication timestamps, IP address, operating system, browser brand, device classification (desktop/mobile), session tokens, and active tab heartbeats.
• Cookies & Storage: Session cookies, CSRF tokens, user theme preferences, and cookie consent records.

4. Purpose and Legal Basis of Processing

Personal data is processed under the following lawful bases under Section 4 and Section 7 of DPDPA 2023:

• Legitimate Uses for Employment Purposes (Section 7(i) DPDPA 2023): Processing necessary for payroll disbursement, attendance verification, employment benefit administration, performance evaluation, and maintaining organizational discipline.
• Compliance with Legal & Statutory Obligations: Processing mandatory under the Income Tax Act 1961, Employees' Provident Funds and Miscellaneous Provisions Act 1952, Payment of Gratuity Act 1972, Maternity Benefit Act 1961, and State Shops & Commercial Establishments Acts.
• Explicit Consent (Section 6 DPDPA 2023): For non-employment marketing communications, optional website analytics, and voluntary employee profile features.

5. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade employee or applicant personal data. Disclosures are restricted to:

• Banking and Payment Gateways: For direct salary crediting into employee bank accounts.
• Statutory & Regulatory Authorities: Government bodies including the Income Tax Department, EPFO, ESIC, and labor commissioners where required by law.
• Authorized Infrastructure Providers: Secure cloud hosting, database servers, and transactional email relays operating under strict Data Processing Agreements.
• Auditors & Legal Counsel: In connection with corporate governance, financial auditing, or dispute resolution.

6. Cross-Border Data Transfers

All primary HRMS databases, employee documents, and attendance records are hosted on secure servers located within the territory of India, in compliance with applicable data localization mandates.

7. Data Retention and Safe Disposal

Personal data is retained only for the duration necessary to fulfill employment contractual obligations and statutory limitation periods (e.g., 8 years for payroll/tax records under Indian tax laws; 3 years for attendance records). Detailed retention periods are set forth in our Data Retention Policy.

8. Data Principal Rights

Under Chapter III of the Digital Personal Data Protection Act, 2023, employees and data subjects possess the following statutory rights:

• Right to Access: Summary of personal data being processed and identities of Data Fiduciaries/Processors with whom data has been shared.
• Right to Correction & Updating: Rectification of inaccurate or incomplete personal, banking, or contact data.
• Right to Erasure: Deletion of data no longer required for statutory or contractual purposes.
• Right of Grievance Redressal: Dedicated channel to address privacy concerns before approaching the Data Protection Board of India.
• Right to Nominate: Designation of an authorized representative in the event of death or incapacity.

To exercise these rights, submit a formal request via our Privacy Requests Portal.

9. Protection of Children's Data

The HRMS is an enterprise workplace management application and does not knowingly onboard or employ minors below the age of 18, in accordance with applicable labor laws and Section 9 of the DPDPA 2023.

10. Policy Updates and Contact

We may periodically update this Privacy Policy to reflect regulatory amendments or system enhancements. When material updates occur, registered users will be notified upon login or via broadcast announcement. For inquiries, contact our Grievance Officer at support@vintiwebsolution.in or +91 9981087328.