Privacy Policy

1. Scope

This policy describes how Udayly, provided by [Your Company Legal Name], handles personal data processed through the Service on behalf of a subscribing organization ("Customer"). Each Customer is the Data Fiduciary for its own employees' data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"); Udayly processes that data as instructed, through the Service's configuration, on the Customer's behalf.

2. What personal data the Service processes

• Identity & contact: name, gender, date of birth, phone, personal email, address, emergency contact.
• Employment: department, designation, manager, employment type, dates of joining/leaving.
• Statutory & financial: PAN, Aadhaar, UAN, ESI number, bank account and IFSC, salary/CTC structure.
• Operational: attendance records, leave requests, expense claims, performance reviews and goals, uploaded documents (ID proofs, certificates, resumes), and messages/images posted to the internal feed.

3. Purpose of processing

Solely to provide HR administration functions the Customer has configured: payroll processing, attendance and leave tracking, recruitment, performance management, internal communications, and related record-keeping — not for advertising, and not sold or shared with unrelated third parties.

4. Security measures in place

• Each Customer's data is isolated by company/tenant at the database query level — no cross-tenant access, enforced on every page.
• PAN, Aadhaar, bank account numbers, and any linked email account's SMTP password are encrypted at rest (AES-256-GCM), not stored as plain text.
• Sensitive files (documents, resumes, payslips, letters) are only ever reachable through permission-checked application pages, never a directly guessable public link.
• Only HR, an employee's own manager, or the employee themselves can view PAN/bank/Aadhaar/emergency-contact details and uploaded documents — enforced in addition to tenant isolation.
• An audit log records who created, updated, deleted, or viewed sensitive records, and when.
• Failed login attempts are rate-limited; newly issued passwords must be changed on first sign-in.

No security measure is absolute; this is an internally-reviewed implementation, not one that has been through an independent third-party penetration test as of this writing.

5. Data retention

Data is retained for as long as the Customer's account is active, plus [X days/months] after termination to allow for data export, after which it is deleted from active systems. Backups are retained for [X days] before rotation.

6. Sub-processors

Depending on the Customer's own configuration, data may pass through: the hosting provider running the Service ([hosting provider name]), and, if the Customer links its own email account under Email Settings, that email provider's servers for outgoing mail. Udayly does not add other sub-processors without notice.

7. Rights of Data Principals

Employees whose data is processed ("Data Principals" under the DPDP Act) may request, through their employer (the Customer, as Data Fiduciary): access to their personal data, correction of inaccurate data, erasure where no longer necessary for the stated purpose, and grievance redressal. Requests should go to the Customer's designated contact:

Grievance Officer: [Name] · [email@yourcompany.com]

8. Cross-border data transfer

[State here whether data is hosted within India or transferred elsewhere, and under what safeguard — this must reflect your actual hosting arrangement.]

9. Changes to this policy

We may update this policy from time to time; material changes will be notified to account administrators in advance of taking effect.

10. Contact

Questions about this policy: [privacy@yourcompany.com]