Introduction
PunchFlow ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our HRMS and Payroll platform, website, mobile applications, and related services (collectively, the "Services").
By using PunchFlow, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not access or use our Services.
Our Commitment: We never sell your personal data to third parties. Your employee and company data belongs to you.
Data We Collect
We collect several types of information to provide and improve our Services:
- Account Information: Company name, admin contact details, billing information, and subscription details when you register.
- Employee Data: Name, email, phone, address, date of birth, government ID numbers (for statutory compliance), bank details, salary information, attendance records, and leave history.
- Usage Data: IP address, browser type, device information, pages visited, and features used within the platform.
- Biometric Data: Fingerprint or facial recognition templates (if using biometric attendance devices) — stored in encrypted, irreversible format.
- Communication Data: Emails, chat messages, and support tickets exchanged with our team.
How We Use Your Data
We use the collected data for the following purposes:
- Service Delivery: To provide HRMS, payroll, attendance, and leave management functionality.
- Statutory Compliance: To generate PF, ESI, PT, TDS returns and other regulatory filings as required by Indian law.
- Communication: To send transactional emails, payslips, leave approvals, and service updates.
- Improvement: To analyze usage patterns and improve platform features and performance.
- Security: To detect and prevent fraud, unauthorized access, and security breaches.
- Legal Obligations: To comply with legal requests, court orders, and regulatory requirements.
Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. We may share data only in the following limited circumstances:
- Service Providers: Trusted third-party vendors who assist with hosting, payment processing, email delivery, and analytics — all bound by strict confidentiality agreements.
- Statutory Bodies: Government authorities (EPFO, ESIC, Income Tax Department) as required for compliance filings.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred with prior notice.
- Legal Requirements: When required by law, subpoena, or to protect our rights and safety.
Important: All third-party service providers are SOC 2 Type II certified and bound by data processing agreements (DPA).
Data Security
We implement industry-standard security measures to protect your data:
- Encryption: All data in transit is protected with TLS 1.3 encryption. Data at rest is encrypted using AES-256.
- Access Controls: Role-based access control (RBAC) ensures users only see data relevant to their role.
- Audit Logs: Every action is logged with timestamps and user identification for accountability.
- Backups: Automated daily backups with point-in-time recovery capability.
- Penetration Testing: Regular third-party security audits and vulnerability assessments.
- Biometric Security: Biometric templates are stored using irreversible hashing — raw biometric data is never stored.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten").
- Right to Restriction: Request limitation on how we process your data.
- Right to Portability: Receive your data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact us at privacy@punchflow.in. We will respond within 30 days.
Cookies & Tracking
We use cookies and similar technologies to enhance your experience:
- Essential Cookies: Required for the platform to function (authentication, security).
- Functional Cookies: Remember your preferences and settings.
- Analytics Cookies: Help us understand how users interact with the platform (Google Analytics, Mixpanel).
- Marketing Cookies: Used to deliver relevant advertisements (only with your consent).
You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling essential cookies may affect platform functionality.
Data Retention
We retain your data for as long as your account is active or as needed to provide Services. After account termination:
- Active Accounts: Data retained indefinitely while your subscription is active.
- Cancelled Accounts: Data retained for 30 days after cancellation to allow export and recovery.
- Statutory Data: Payroll and compliance records retained for 7 years as required by Indian law (Income Tax Act, EPF Act).
- Backups: Backup copies may be retained for up to 90 days after deletion.
Children's Privacy
PunchFlow is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@punchflow.in and we will delete the information promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of significant changes via:
- Email notification to the account administrator.
- A prominent notice on the platform dashboard.
- Updated "Last Updated" date at the top of this page.
Continued use of the Services after changes constitutes acceptance of the revised policy. We encourage you to review this page periodically.