Privacy Policy

HRPay collects data that is necessary to deliver our payroll, compliance, and HR management services. The categories of data we collect include:

We process your data for the following purposes, each tied to a lawful basis under applicable data protection law:

• Payroll Processing: Computing net pay, tax deductions (TDS), PF/ESI contributions, and generating payslips and Form 16.
• Statutory Compliance: Filing PF ECR, ESIC challans, TDS returns, and other regulatory submissions on behalf of your employer.
• Platform Delivery: Providing access to the HRPay dashboard, attendance tools, leave management, and reports.
• Customer Support: Responding to queries, resolving disputes, and troubleshooting account issues.
• Product Improvement: Analysing aggregated usage patterns to improve features, performance, and user experience.
• Security & Fraud Prevention: Detecting suspicious activity, preventing unauthorised access, and maintaining audit logs.
• Communications: Sending service notifications, compliance reminders, product updates, and (with consent) marketing emails.

HRPay does not sell or rent your personal data. We share data only in the following controlled circumstances:

• Government & Regulatory Bodies: PF, ESIC, income tax authorities, and other statutory bodies as required by law.
• Your Employer Organisation: HR administrators and finance teams within your organisation have access to your payroll and attendance data as part of our B2B service model.
• Trusted Sub-Processors: Cloud hosting (AWS), email delivery (SendGrid), analytics (Google Analytics), and customer support (Intercom) — all bound by data processing agreements.
• Legal Compliance: When required by court order, governmental directive, or applicable law.
• Business Transfers: In the event of a merger or acquisition, with prior notice and equivalent privacy protections maintained.

• Encryption: AES-256 encryption at rest; TLS 1.3 for all data in transit.
• Access Controls: Role-based access control (RBAC) with principle of least privilege; MFA for all admin accounts.
• Infrastructure: Hosted on ISO 27001-certified AWS data centres in Mumbai (ap-south-1) with geo-redundancy.
• Auditing: Immutable audit logs for all data access; regular third-party penetration testing.
• Incident Response: Dedicated security team with a documented breach notification procedure.

Upon expiry of the applicable retention period, data is securely deleted or anonymised per our data disposal procedure.

• Right to Access: Request a copy of the personal data HRPay holds about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your data, subject to statutory retention obligations.
• Right to Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interest, including direct marketing.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.

To exercise any right, email privacy@hrpay.in. We respond within 30 business days.

HRPay uses cookies and similar tracking technologies. For full details on types used, third-party providers, and how to manage your preferences, please refer to our Cookie Policy.

HRPay is a B2B enterprise platform not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, contact us at privacy@hrpay.in and we will promptly delete it.

Material changes will be communicated via in-app notification and email at least 14 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Data Protection Officer: dpo@hrpay.in
Privacy Grievances: privacy@hrpay.in
Response SLA: 30 business days
Address: HRPay Technologies Pvt. Ltd., 4th Floor, Magnum House, BKC, Mumbai – 400051, Maharashtra, India