Who is responsible

When your employer uses HR Max, your employer is the Data Fiduciary for your employment data under the Digital Personal Data Protection Act, 2023. HR Max acts as a Data Processor: we store and process that data only to provide the service to your employer, on their instructions. Questions about what your employer records, or requests to correct or erase employment records, are for your employer first; we will help them answer.

For our own customer and website contacts — the person at a company who signs up, books a demo or writes to us — HR Max is the Data Fiduciary.

What we collect

Depending on which features your employer turns on:

Account and sign-in — your mobile number (you sign in with a one-time code sent on WhatsApp), name and, where your employer records it, email address.
Employment record — employee code, department, designation, joining details, contact details, address, date of birth, emergency contacts, dependants and documents your employer uploads.
Identity, statutory and bank details — Aadhaar, PAN, UAN, ESIC number and bank account details, used for payroll and statutory filings. These are encrypted in our database.
Attendance — punches from your employer's biometric terminals, including any enrolment image or punch photograph the terminal sends; self-service punches from the app; shifts, leave and overtime.
Location — only if your employer enables it: your location when you punch in or out from the app (to check you are within an allowed area), and while a duty or field session is running. Location is not collected when no session is active.
Payroll — salary structure, attendance-based pay, deductions, payslips and payment records.
Device and app — a notification token, device identifier and app version, so we can send you notifications; and technical logs, including IP address, for security.
Activity — an audit trail of actions taken in the system, kept so that changes to records can be accounted for.

How it is used

To run your employer's HR, attendance, leave and payroll — calculating pay, preparing payslips and the statutory files your employer submits.
To sign you in, keep your account secure and send you notifications about approvals, payslips and announcements.
To protect the service: detecting misuse, investigating incidents and keeping an audit trail.
To support you and your employer when you ask for help.

We do not sell personal data, and we do not use your employment data for advertising.

Your employer, and within it only the people whose role and scope allow them to see it.
Service providers we rely on to run the service: cloud hosting; a WhatsApp messaging provider to deliver sign-in codes; Google Firebase Cloud Messaging to deliver app notifications. They process data only to provide those services.
Email your employer sends — reports are emailed through your employer's own mail server, to colleagues your employer's users choose.
Authorities, where the law requires it.

Payroll and statutory files are prepared for your employer to submit; HR Max does not file returns or transfer salaries itself.

How it is protected

Each company's data is isolated from every other's; access is checked on the server for every request, by role and scope; actions are recorded in an audit trail; and identity and bank details are encrypted in the database. Reports containing sensitive financial data are not sent as email attachments but as links that require the recipient to sign in. See security for more.

How long it is kept

Your employer sets how long attendance, location and biometric data are kept. Employment and payroll records are kept for as long as the law requires your employer to keep them, which can be several years after you leave. Data we hold for our own customer relationship is kept while the relationship lasts and as required for accounts and tax.

Deleting your account

You can ask to delete your account once signed in, under Setup → System → Delete Account on the web, or the equivalent screen in the mobile app. Without the app, go to /delete-account: you sign in with your mobile number and a WhatsApp code and are taken to the same screen. Your employer approves the request; once approved, your account is deleted 14 days after you asked, and you can cancel until then.

Deleted: your sign-in, your account in each company you belong to, your signed-in sessions and your devices' notification registrations.
Kept: your employment record — attendance, leave, payroll, PF and ESI — which your employer must keep by law, and a record that the account was deleted. You can ask your employer to erase your personal details from the employment record once the law allows.

Your rights

Under the DPDP Act you may ask for a summary of the personal data processed about you, have it corrected or completed, have it erased where it is no longer needed and the law allows, nominate someone to exercise these rights for you, and raise a grievance. In HR Max, employees can download their data and raise export or erasure requests from Data Privacy in self-service; your employer decides on them. You may also complain to the Data Protection Board of India.

Children

HR Max is a workplace system for employees and is not intended for anyone under 18.

Contact and grievances

For privacy questions or grievances, write to fibermaxrgp@gmail.com or to HR Max, GC-139, RCMS Complex, Civil Township, Rourkela, Odisha 769004, India. We aim to respond within 30 days. If your question is about what your employer records, we may pass it to them.

We may update this policy; the effective date above changes when we do, and significant changes are announced in the app.

Privacy Policy