Skip to content
Kaam HR

Legal

Privacy policy

We hold some of the most sensitive data a person has: identity documents, face data and salary. This policy explains what we collect, why, and the rights you have over it.

Last updated

1. Who we are

Kaam HR Technologies Pvt. Ltd. (“Kaam HR”, “we”) provides a human resources, attendance and payroll platform to businesses (“customers”). This policy explains how we handle personal data in two situations:

  • As a Data Processor for our customers, when we process their employees’ data on their instructions.
  • As a Data Fiduciary for data we collect directly, such as when you visit this website, book a demo or create a customer account.

We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

2. Data we collect

On behalf of customers, the platform may hold:

  • Identity and contact details: name, employee ID, phone, email and address.
  • Employment details: designation, department, site, shift, pay type and salary.
  • KYC documents uploaded during onboarding, such as Aadhaar, PAN and bank details.
  • Attendance records, including check-in time, location at check-in and face-match result.
  • Face descriptors: numeric representations of a face used to verify check-ins.
  • Leave requests, payroll records, advances, penalties and payslips.

Directly from website visitors and prospects, we collect what you submit in our forms (name, work email, company, company size, phone and message) and basic technical data such as IP address and browser type.

3. How we use data

We use personal data only for these purposes:

  • To provide the service: verifying attendance, managing leave, computing payroll and generating reports.
  • To secure the service: authentication, fraud prevention and maintaining audit logs.
  • To respond to demo requests and enquiries, and to manage customer accounts and billing.
  • To meet legal obligations, such as tax and statutory record-keeping.

We do not sell personal data, use it for advertising, or use employee data to build profiles for any purpose other than the customer’s HR operations.

4. Biometric data

Face verification is used only to confirm that the person checking in is the enrolled employee. Before enrolment, employees are shown a notice explaining this purpose and asked for consent, which is recorded.

Matching uses numeric face descriptors. Enrolment images are stored with restricted access and are deleted when the employee is removed or on a verified erasure request. Customers must offer an alternative check-in method to employees who withdraw consent.

We process personal data on the basis of consent, or for legitimate uses permitted by Section 7 of the DPDP Act, including purposes of employment. Where processing relies on consent, it can be withdrawn at any time, as easily as it was given. Withdrawal does not affect processing that happened before it.

6. Storage and security

Data is stored in data centres located in India. It is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access is limited by role, and every administrative change is written to an audit log.

Read more about our controls on the security page.

7. Sharing and sub-processors

We share data only with sub-processors who help us run the service, such as cloud hosting, file storage and email delivery, under written contracts that require equivalent protection. A current list of sub-processors is available on request. We may disclose data where required by law or by a lawful order of a competent authority.

8. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as required by law. Customers configure retention for employee data. When a customer account ends, we delete or return customer data within 90 days, except where we must retain it by law.

9. Your rights

Under the DPDP Act you have the right to:

  • Obtain a summary of the personal data processed about you.
  • Correct, complete or update your personal data.
  • Have your personal data erased when it is no longer needed.
  • Nominate another person to exercise your rights in case of death or incapacity.
  • Have your grievance addressed.

If you are an employee of one of our customers, please contact your employer first; they are the Data Fiduciary for your data. We will help them respond.

10. Grievance officer

For questions or complaints about this policy, contact our Grievance Officer at privacy@kaamhr.in. We acknowledge grievances within 48 hours and resolve them within the period prescribed under the DPDP rules.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Changes to this policy

We will post any changes on this page and update the date above. For material changes, we will notify customers by email at least 30 days in advance.