Privacy Policy

This policy explains how Aurum Enterprise Solutions ("we", "us") handles personal data in AurumOne, our online payroll, attendance and HR service (the "Service"). It covers the Service only. Our website has its own, shorter privacy notice.

We have written it against Indian law: the Digital Personal Data Protection Act, 2023 and its Rules, as their provisions come into force, and until then the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Words used in this policy

• Client means a company or other business that has an account on the Service.
• Users means the people a Client allows to sign in: owners, administrators, HR and payroll staff, managers and employees with portal access.
• Employees means a Client's employees, contract workers and other people whose records the Client keeps in the Service.
• Client Data means everything a Client or its Users put into the Service, or that its attendance terminals send to it.

2. Our two roles

We hold personal data in two different capacities, and what you can expect from us depends on which one applies.

1. For Client Data, we act for the Client. The Client decides what to record about its Employees and why. Under the law the Client is the Data Fiduciary and we are its Data Processor. We use Client Data only to provide the Service to that Client, on its instructions. If you are an Employee and have a question about your records, please contact your employer first. If you write to us, we will pass your request to your employer and help them answer it.
2. For account and billing data, we decide. For the personal data we need to run a Client's account, send invoices and keep the Service secure, we are the Data Fiduciary and this policy is our notice to you.

3. Client Data we hold for Clients

Depending on how a Client uses the Service, Client Data can include:

• Employee details: name, photo, contact details, address, department, designation, joining and leaving dates, and other details the Client chooses to record;
• attendance: punches from attendance terminals, shifts, overtime, leave and holidays;
• pay: salary structure, earnings, deductions, advances, loans, payslips and reports;
• bank account details for salary payment;
• statutory numbers, where the Client enters them, such as PAN, UAN, ESIC number and Aadhaar number;
• documents the Client uploads, such as identity proofs, letters and certificates.

Clients are responsible for having a lawful basis for this data and for giving their Employees the notices the law requires.

4. Biometric data

The Service does not store fingerprint, face or other biometric templates. Biometric attendance terminals keep templates on the terminal itself, at the Client's premises. The Service records only that an Employee has enrolled, and which finger positions, so the Client can manage its terminals. When a terminal sends a template or a photo along with other data, the Service removes it before keeping any record of that traffic.

5. Account and billing data we hold for ourselves

• Users' account details: name, email address, phone number, role and sign-in settings.
• Sign-in and security records: when a User signs in, from which network (IP) address and browser, and a record of significant actions in the Service, so that we and the Client can see who did what.
• Billing details: the Client's billing contact's name, email and phone, the business name and address, GSTIN, invoices, credit notes and payment records.
• Payments: when a Client pays online, our payment partner tells us the amount, the date and a payment reference. We never see or store card numbers, UPI PINs or bank passwords.
• Acceptance records: when a Client's administrator accepts our Terms or policies, we record who accepted, when, the version, and the network address and browser used.
• Support conversations: what a Client's Users write to us by email or WhatsApp, and our replies.

We use this data to provide and bill for the Service, to keep it secure, to answer support requests, to send notices about the account, and to meet our legal obligations, such as keeping tax records. We do not sell it, use it for advertising, or send marketing emails without asking.

6. Why we may use personal data

• Client Data: we process it on the Client's instructions, under our agreement with the Client. The Client is responsible for the legal basis for its own use.
• Account and billing data: we use it because it is needed to perform our agreement with the Client, for the legitimate uses the Digital Personal Data Protection Act, 2023 allows (section 7), such as data given voluntarily for a specified purpose and compliance with the law, and with consent where the law requires it.

7. Sensitive personal data

Some Client Data is treated by Indian law as sensitive personal data, in particular financial information such as bank account details and salary. Biometric information is also sensitive, which is why the Service does not store biometric templates. We handle sensitive personal data with the reasonable security practices described in section 10.

8. Who else handles it, and where

• Amazon Web Services hosts the Service, its database, uploaded documents and its backups on servers in the Mumbai region, India.
• SMTP2GO delivers the emails the Service sends, such as invitations, password resets, invoices and notices. It may process those emails outside India.
• Razorpay processes online payments of our invoices. It is a payment aggregator regulated by the Reserve Bank of India and may process payment data outside India under its own terms.
• GoDaddy provides our domain name service and our mailbox, where support emails are kept. It may store email outside India.
• WhatsApp (Meta) carries and stores support conversations if a User chooses to write to us there, under its own terms.

These providers act for us and only to provide their service. Apart from them, we share personal data only when the law, a court or a government authority requires it. We will tell Clients before we add or replace a provider that handles Client Data.

9. How long we keep it

• Client Data: for as long as the Client's subscription lasts, then for 30 days so the Client can export it. It is then deleted from the live Service. Copies in our nightly backups are removed as those backups expire, within 8 days.
• Invoices, credit notes and payment records: 8 years, because Indian tax law requires it.
• Sign-in, security and device-traffic records: for as long as needed to keep the Service secure and to troubleshoot it, and as long as Indian law requires.
• Acceptance records: for as long as the Client's account exists, and afterwards for as long as they may be needed as evidence of the agreement.
• Support conversations: for as long as the Client's account exists, then deleted within a year.

10. How we protect it

• Every connection from a browser to the Service is encrypted (HTTPS).
• Each Client's data is kept separate from every other Client's, and the database itself enforces that separation (row-level security), so a fault in one screen cannot show one Client another Client's records.
• Database backups are encrypted.
• Within a Client's Workspace, Users see only what their role allows.
• Only our staff who need access have it. When our support staff sign in to a Client's Workspace to help, the session is time-limited, shown in the Service and recorded.
• Significant actions are recorded in audit logs.
• Passwords are stored only in a scrambled (hashed) form, and keys and secrets are kept on the server, never in our code.

No one can honestly promise that a system will never be breached, but we work to prevent it and to detect it.

11. If there is a breach

If a personal data breach affects Client Data, we tell the affected Client without undue delay, and in any case within 48 hours of becoming aware, with what we know, so that the Client can notify the Data Protection Board of India and the people affected. If a breach affects account and billing data, we tell the people affected and the Data Protection Board as the law requires. We also report incidents to the authorities when Indian law requires it.

12. Your rights

If your personal data is in the Service, you have the right to:

• ask for a summary of the personal data held about you and how it is used;
• ask for it to be corrected, completed or updated;
• ask for it to be erased, unless the law requires it to be kept;
• have a complaint heard and answered;
• name someone who can exercise these rights for you if you die or become unable to act yourself.

If you are an Employee, please ask your employer first, because it decides what is recorded about you. Many corrections can be made by your employer directly in the Service.

For account and billing data, write to us at support@aurumtech.in or to our Grievance Officer below, from the email address we know you by, and say what you would like. We reply within 30 days.

13. Children

The Service is for businesses. We do not knowingly collect personal data from children, except where a Client keeps records of its own workers. Clients must employ workers only at the age the law allows, and must obtain any consent of a parent or guardian the law requires for a worker under 18.

14. Cookies

The Service uses only the cookies and browser storage it needs to work: to keep a User signed in, to protect forms against misuse, and to remember settings such as language. It uses no advertising or analytics trackers.

15. Changes to this policy

When we change this policy, we publish a new version with a new date. Clients' billing administrators are asked to accept the new version in the Service, and for a significant change we also tell Clients by email before it takes effect.

16. Grievance Officer

If you have a concern about how we handle personal data, please contact our Grievance Officer:

Het Jasoliya

Email: support@aurumtech.in

Address: 306-Time Square, Gaurav Path Road, Surat 394510, Gujarat

We acknowledge every grievance within 72 hours and resolve it within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.