1. Introduction

Global Best HR & Management Consulting Private Limited is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us.

This Privacy Policy explains how we collect, use, process, store, transfer, disclose, and protect personal information through our Human Resource Management System (GB NanO HRMS).

By accessing or using the Platform, users acknowledge that they have read, understood, and agreed to the practices described in this Privacy Policy.

2. Scope

This Privacy Policy applies to:

• Organizations subscribing to our Services ("Customers")
• Employees, contractors, consultants, interns, and personnel whose information is managed through the Platform
• Authorized users and administrators
• Visitors to our website
• Prospective customers and business partners

3. Definitions

For the purposes of this Privacy Policy:

• Personal Data means any information relating to an identified or identifiable individual.
• Customer Data means information uploaded, stored, processed, or managed by Customers through the Platform.
• Data Principal means the individual to whom the personal data relates.
• Data Fiduciary means the entity determining the purpose and means of processing personal data.
• Data Processor means an entity processing personal data on behalf of a Data Fiduciary.

4. Roles and Responsibilities

For employee information processed through the HRMS Platform:

• The Customer generally acts as the Data Fiduciary and determines the purpose and means of processing employee information.
• The Company acts as a Data Processor and processes personal data solely on behalf of and according to the instructions of the Customer.
• Customers are responsible for ensuring that appropriate notices, consents, authorizations, and legal bases for processing have been obtained from their employees and personnel where required under applicable laws.

5. Information We Collect

5.1 Employee and Workforce Information
We may process: Full name, Employee ID, Date of birth, Gender, Photograph, Contact information, Residential address, Emergency contact information, Marital status (where applicable), Employment documentation

5.2 Employment Information
We may process: Department, Designation, Employment history, Reporting hierarchy, Attendance records, Shift schedules, Leave records, Training records, Performance records, Appraisal information, Promotion and transfer records

5.3 Payroll and Financial Information
We may process: Salary information, Bank account details, Tax information, Provident Fund information, Insurance details, Reimbursement information, Statutory contribution information

5.4 Identity Verification Information
Where permitted by law and required by Customers: PAN details, Aadhaar information, Passport details, Driving License information, Other government-issued identification records

5.5 System and Technical Information
We may collect: IP addresses, Browser information, Device information, Login timestamps, User activity logs, Session information, Security logs, Error reports

6. How Information Is Collected

Information may be collected through: Data provided by Customers, Employee self-service submissions, Platform usage, Automated system logs, Third-party integrations, Customer support interactions, Recruitment and onboarding processes

7. Purpose of Processing

We process information for the following purposes:
Human Resource Administration
Employee onboarding and offboarding, Employee record management, Attendance management, Leave management, Workforce administration
Payroll and Benefits Administration
Salary processing, Tax calculations, Benefits administration, Reimbursements, Statutory compliance processing
Performance and Workforce Management
Goal tracking, Performance evaluations, Learning and development programs, Workforce analytics
Platform Operations
User authentication, Access management, Security monitoring, System maintenance, Technical support
Legal and Regulatory Compliance
Compliance with employment laws, Compliance with tax obligations, Audit requirements, Regulatory reporting obligations
Service Improvement
Product development, Platform optimization, Analytics and reporting, Security enhancements

8. Employee Activity and Monitoring Information

The Platform may collect and process employee activity information as configured by the Customer, including:

• Attendance records
• Login and logout activity
• Work schedules
• Leave utilization
• Workforce analytics
• Geolocation information where enabled by the Customer
• Access and audit logs

The Customer is solely responsible for configuring such features and ensuring compliance with applicable employment and privacy laws.

9. Legal Basis for Processing

We process personal information based on: Consent where required, Performance of contractual obligations, Compliance with legal and regulatory requirements, Legitimate business interests, Employment-related obligations, Customer instructions provided through contractual arrangements

10. Sharing and Disclosure of Information

We do not sell personal information. We may disclose information to:
Customer Organizations
Authorized personnel within the Customer organization.
Service Providers and Sub processors
Trusted third parties that support our operations, including: Cloud hosting providers, Infrastructure providers, Payment processors, Email service providers, Communication platforms, Security service providers, Customer support tools

Such providers are contractually required to maintain confidentiality and implement appropriate security measures.

Government and Regulatory Authorities
Where required by law, regulation, court order, legal process, or governmental request.
Corporate Transactions
In connection with mergers, acquisitions, restructuring, financing, sale of assets, or similar business transactions.

11. International Data Transfers
Personal information may be processed, stored, or transferred outside India where our service providers or infrastructure providers operate.

Where such transfers occur, appropriate contractual, technical, and organizational safeguards shall be implemented to ensure an adequate level of protection consistent with applicable laws.

12. Data Security

We implement appropriate technical and organizational measures to protect personal information, including: Encryption of data in transit, Encryption of data at rest where applicable, Role-based access controls, Authentication and authorization controls, Password protection mechanisms, Multi-factor authentication where supported, Audit logging, Network security controls, Security monitoring, Backup and disaster recovery procedures, Regular security reviews and assessments

Despite our efforts, no method of electronic transmission or storage can be guaranteed to be completely secure.

13. Data Retention

We retain personal information only for as long as necessary to: Deliver Services, Fulfil contractual obligations, Comply with legal requirements, Resolve disputes, Enforce agreements

Upon termination of a Customer subscription, Customer Data may be retained for up to ninety (90) days for retrieval and migration purposes unless otherwise agreed in writing or required by law.

Following the retention period, data may be permanently deleted, anonymized, or archived in accordance with applicable legal requirements.

14. Data Breach Response

In the event of a suspected or confirmed personal data breach, we will: Investigate the incident promptly, Take reasonable measures to mitigate potential harm, Implement corrective actions, Comply with applicable legal notification obligations, Notify Customers and relevant authorities where required by applicable law

15. Rights of Data Principals

Subject to applicable laws, Data Principals may have the right to: Obtain information regarding processing activities, Access personal information, Correct inaccurate or incomplete information, Request erasure of personal information, Withdraw consent where processing is based on consent, Seek grievance redressal, Nominate another individual to exercise rights on their behalf where permitted by law

Requests relating to employee information should generally be directed to the relevant employer organization, which acts as the Data Fiduciary.

16. Cookies and Similar Technologies

Our website and Platform may use cookies and similar technologies to: Maintain user sessions, Authenticate users, Improve functionality, Analyze usage trends, Enhance user experience, Improve platform performance and security

Users may control cookie preferences through browser settings, although certain features may not function properly if cookies are disabled.

17. Third-Party Integrations

The Platform may integrate with third-party applications and services.

The use of such services may involve the sharing of information necessary for integration functionality.

We are not responsible for the privacy practices of third-party services and encourage users to review their privacy policies independently.

18. Children's Privacy

The Services are intended exclusively for business and employment-related purposes and are not directed toward individuals under eighteen (18) years of age.

We do not knowingly collect personal information from children.

19. Compliance with Applicable Laws

We process personal information in accordance with applicable laws and regulations, including: Digital Personal Data Protection Act, 2023 (India), Information Technology Act, 2000, Applicable employment and labour laws, Tax and statutory compliance requirements, Other applicable legal and regulatory obligations

20. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time.

Continued use of the Services following publication of changes constitutes acceptance of the revised Privacy Policy.

21. Grievance Officer and Contact Information

For privacy-related questions, requests, complaints, or grievances, please contact:

Company Name: Global Best HR & Management Consulting Private Limited

Support Email: contact@gbnanohrms.com

Phone: +91 73580 35182

We will make reasonable efforts to respond to privacy-related requests and grievances within applicable timelines prescribed by law.

22. Consent and Acknowledgement

By accessing, using, administering, or otherwise interacting with the Platform, users acknowledge that they have read and understood this Privacy Policy and consent to the collection, use, processing, storage, and disclosure of information as described herein and as permitted by applicable law.