Privacy & Data Protection Policy

(Applicable to HRMS + Payroll + CLMS + Contract Labour Compliance Services) Groniva Corporation Private Limited

Effective Date: 01-10-2025
Version: 1.0
Jurisdiction: Pune, Maharashtra, India
Grievance Officer: Mr. Vikrant Ghan (privacy@groniva.com)

A. Introduction & Scope

A.1 This Unified Privacy & Data Protection Policy (“Policy”) explains how Groniva Corporation Private Limited (“Groniva”, “We”, “Us”, “Our”) collects, processes, stores, protects, and shares data through its HRMS, Payroll, Contract Labour Management System (CLMS), Compliance Monitoring Services, mobile apps, portals, API integrations and related workforce management solutions (“Platform”).

A.2 This Policy applies to:

Principal Employers / Enterprises
Contractors / Sub-contractors / Vendor Partners
Employees / Direct Staff
Contract Workers / Gig/Outsourced Workforce
System Administrators / HR Personnel
Approvers / Compliance Officers

A.3 This Policy extends to all data collected during:

Employee HR lifecycle management
Payroll calculation & disbursement
Labour deployment and shift allocation
Contractor onboarding & registration
Worker documentation (ID/KYC)
Compliances & statutory filings support

B. Legal Basis & Regulatory Alignment

B.1 This Policy complies with:

Information Technology Act, 2000
IT (Reasonable Security Practices & Procedures and SPDI) Rules, 2011
Digital Personal Data Protection (DPDP) Act, 2023 (principle-compliant)
Indian Contract Act, 1872
Evidence Act (for electronic records)

B.2 For Contract Labour & Workforce Compliance, it aligns with:

Contract Labour (Regulation and Abolition) Act, 1970 (CLRA)
Inter-State Migrant Workmen Act (ISMW Act)
Building & Other Construction Workers (BOCW) Act, where applicable
Factories Act / OSH Code (as applicable by state)
Shops & Establishment Acts (State level)
Equal Remuneration & Minimum Wages compliance

B.3 The Platform facilitates statutory compliance digitally on behalf of enterprises/contractors but does not replace legal obligations of employers or contracting entities.

C. Data Responsibility Roles (Dpdp + Labour Chain)

C.1 Under DPDP Act Principles:

Entity	Legal Role
Principal Employer / Enterprise	Data Fiduciary / Controller
Contractor / Sub-Contractor	Co-Processing Entity / Executor
Groniva (Platform)	Data Processor / Technology Enabler

C.2 For CLMS workflows:

PE retains accountability as per labour law
Contractor ensures worker documentary accuracy
Groniva only facilitates secure digital processing

C.3 Groniva does not independently decide purpose of data — purpose is determined by the client (Employer/Fiduciary).

D. Categories Of Data We Process

D.1 Personal & Workforce Identity

Name, phone, email, photograph
Permanent & local address
Father/mother/guardian details

D.2 Employment / Deployment

Designation, joining date, location, contractor mapping
Attendance & shift patterns
Assignment history

D.3 Sensitive Personal Data (SPDI)

Aadhaar / ID proofs (when employer/contractor uploads)
PAN / Bank details (for payroll)
Salary / wage details
Emergency contacts
PF/UAN/ESIC identifiers

D.4 Workforce Compliance

Labour license references
Deployment mapping under CLRA
Muster roll, registers, digital forms

D.5 System Metadata

IP address, device info, logs
Login time & authentication check
Fraud/security events

E. Purpose Of Data Collection & Use

E.1 We process data to deliver:

HR lifecycle automation
Payroll calculation, slips, and transfer routing
Worker onboarding & verification
Contractor workforce deployment
Labour compliance registers
Audit readiness for PE / Contractor
Regulatory inspection documentation
Attendance & productivity analytics

E.2 Statutory / lawful purposes:

PF/ESIC/TDS filings through employer
Manpower compliance reporting
CLRA registers & contractor submissions

E.3 Platform security purposes:

Identity/authentication
Fraud & misuse detection
System safety audit logs

F. Consent & User Rights

F.1 Consent is derived from:

Employer/Contractor onboarding of workers
Employee/worker login
Digitally captured acceptance where applicable

F.2 Worker/Employee Rights:

Right	Covered?
Access	✅
Correction	✅
Withdrawal of consent (if not legally mandated)	✅
Deletion (post statutory term)	✅

F.3 Deletion is not permitted during active statutory retention requirement (labour law supersedes).

G. Security & Storage

G.1 Security Standards

Encrypted transmission (HTTPS/TLS)
RBAC + Least Privilege access
Masking of sensitive identity fields
Audit trails & monitoring

G.2 Storage

Primary hosting: India
Backups follow industry-standard encryption

H. Data Sharing

H.1 We do NOT sell personal data. H.2 Limited disclosure only to:

Statutory authorities through employer
Banking partner for authorised payroll
Approved sub-processors (infra level)

H.3 Access to CLRA/Inspectors: Provided only when employer/contractor initiates or as part of legal mandate.

I. Retention & Exit

I.1 Retention follows:

Data Type	Retention
HRMS	Subscription life + audit period
Payroll	As per tax law retention
CLMS	As per labour law registers & licensing audits

I.2 Upon client offboarding:

Data is returned OR
Securely purged per DPA

J. Audit & Cross-border Transfer

Cross-border transfer: only with written employer authorisation.

K. Grievance Redressal

Grievance Officer: Mr. Vikrant Ghan
Email: privacy@groniva.com
Resolution Period: up to 30 days.

L. Governing Law & Disputes

This Policy is governed by laws of India.
Jurisdiction: Pune, Maharashtra

Mobile Application Data Collection and Usage

This section applies specifically to users accessing our services through mobile applications.

1. Data Collected via Mobile App

When you use our mobile application, we may collect certain data directly from your device, including:

Device identifiers (such as Advertising ID, Android ID, and app instance identifiers)
Location data (coarse and precise location, if permission is granted)
Device and usage information (such as device type, OS version, app usage logs, and crash reports)

2. Purpose of Data Collection

We collect this data to:

Provide and maintain app functionality
Improve app performance, stability, and user experience
Enable location-based features (if applicable)
Ensure security and prevent fraud or misuse
Analyze usage trends and optimize services

3. Permissions Used by the App

Our mobile application may request the following permissions:

Location (Approximate and Precise): To enable location-based features
Internet Access: To communicate with secure servers and APIs

Permissions are requested only when required for specific features and can be managed by users through device settings.

4. Data Sharing

We may share limited data with trusted third-party service providers (such as cloud hosting, analytics, or infrastructure providers) strictly for:

App functionality
Performance monitoring
Security and fraud prevention

We do not sell personal data to third parties.

5. Data Processing and Security

Data collected through the mobile app is transmitted securely using encryption (HTTPS/TLS) and processed on secure servers.
We implement appropriate technical and organizational safeguards to protect user data.

6. Data Retention

We retain mobile app data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

7. User Control and Rights

Users have full control over their data:

Permissions (such as location) can be enabled or disabled via device settings
Advertising ID can be reset or limited via device settings
Users may request access, correction, or deletion of their data by contacting us at:
privacy@groniva.com

Privacy & Data Protection Policy