S
SmartHR

Privacy Policy

Effective 16 September 2026. Applies to the SmartHR web application, the UHRP HR mobile app and the underlying UHRP (Universal HR Platform) service, operated by Clobas.

1. Who we are and what role we play

SmartHR is a human-resources platform that employers subscribe to in order to manage their workforce: attendance, leave, payroll, documents and related HR processes. Your employer decides what data is collected and why; under the Digital Personal Data Protection Act, 2023 (India) it is the Data Fiduciary, and under the GDPR it is the Controller. Clobas processes that data on the employer's instructions as a Data Processor.

If you are an employee using SmartHR through your employer, most questions about why a piece of data is held should go to your employer's HR team. Questions about how we protect it can come to us directly (section 11).

2. Data we process

Only what your employer has configured the platform to hold. Depending on the modules your employer has enabled this can include:

  • Identity and contact: name, employee ID, work email, phone, photograph, date of birth, gender, emergency contact.
  • Employment: designation, department, branch or site, manager, joining and exit dates, shift and roster, employment documents.
  • Statutory and payroll: salary structure, bank account, PAN, Aadhaar, UAN, ESI number, tax declarations, payslips, loans, reimbursements. Sensitive identifiers are encrypted at rest.
  • Attendance: clock-in and clock-out times; if your employer enables geo-fenced attendance, the GPS location at the moment you punch; if your employer enables selfie or face verification, the photo you take at punch and a derived face template.
  • Leave, performance, learning, expenses, travel, helpdesk records you or your employer create in those modules.
  • Device and usage: login times, IP address, browser or app version, and a push-notification token for the mobile app.

3. What the mobile app accesses on your phone

  • Location: read only while the app is open and only when you tap clock-in or clock-out, so attendance can be checked against your employer's geo-zones. The app never tracks location in the background.
  • Camera: only when you take an attendance selfie, enrol your face for verification, or photograph an expense receipt or document.
  • Photo library: only when you choose to attach an existing photo.
  • Notifications: to deliver approvals, reminders and payslip alerts. You can switch each category off inside the app or at the OS level.
  • Local storage: your session tokens are stored in the operating system's secure keystore. Attendance punches made while offline are queued on the device until they sync.

4. Why we process it

  • To provide the HR services your employer has subscribed to (contract performance).
  • To meet statutory obligations your employer has under Indian labour, provident-fund, ESI and income-tax law (legal obligation).
  • To secure the service: authentication, fraud and abuse prevention, audit logs (legitimate interest).
  • To send service notifications you or your employer have enabled.

We do not sell personal data, use it for advertising, or profile you for purposes outside the HR service.

5. Where data is stored and who else touches it

Production data is hosted in Oracle Cloud Infrastructure, Mumbai (India). We use a small number of sub-processors, each bound by contract to process data only on our instructions:

  • Oracle Cloud Infrastructure (Mumbai): application and database hosting, encrypted backups.
  • Amazon Web Services, ap-south-1 (Mumbai): encrypted object storage for uploaded documents.
  • Expo Application Services: delivery of mobile push notifications (the token and the notification text only).
  • An email delivery provider: transactional email such as password resets, approvals and payslip notices.

Data is not transferred outside India except where a sub-processor above needs to relay a message (push or email) to you.

6. How long we keep it

Retention is set by your employer within limits required by law. Our default schedule, which employers can view and tighten in the platform's compliance settings, is:

  • Payroll, tax and statutory records: 7 years after the end of employment (Income-tax Act and labour law requirements).
  • Employment records and documents: 5 years after the end of employment.
  • Attendance and leave records: 3 years.
  • Recruitment data: 2 years for unsuccessful candidates; hired candidates move to the employee record.
  • Audit and security logs: 2 years.

When an employer's subscription ends, its data is returned or deleted on request and in any case purged after the contractual wind-down period.

7. How we protect it

  • All traffic is encrypted in transit (TLS 1.2+).
  • Sensitive identifiers (bank, PAN, Aadhaar and similar) are encrypted at rest with keys held separately from the database.
  • Every employer's data is isolated by database row-level security; a request can only ever read rows belonging to its own tenant.
  • Role-based access control, session rotation, rate limiting, and audit logging on administrative actions.
  • Daily encrypted backups.

8. Your rights

Under the DPDP Act and, where applicable, the GDPR, you can ask to access, correct, erase or export your personal data, and to withdraw consent where processing relies on it. Because your employer is the Data Fiduciary, the quickest route is your HR team, who can act on the request inside the platform. You may also submit a data-subject request directly to us and we will route it to your employer and track it to completion.

Employers respond to such requests within 30 days. If you are unhappy with the outcome you may escalate to the Data Protection Board of India or, in the EU, your local supervisory authority.

9. Account deletion

Accounts are created and owned by your employer, not by you; the app has no self-signup. To close an account, ask your employer's HR team, or write to development@clobas.com and we will confirm the request with the employer. Deleting the mobile app removes the local session and queued data from your phone but does not delete the employment record your employer holds. See Support for the exact steps.

10. Children

The service is for employees and contractors of subscribing organisations and is not directed at anyone under 18.

11. Contact and grievance officer

Privacy questions and grievances: development@clobas.com. Postal: Clobas, India. We acknowledge grievances within 72 hours and resolve them within 30 days, as the DPDP Act requires.

12. Changes

We will post any change here with a new effective date, and notify employers of material changes at least 30 days before they take effect.