Privacy Policy

This Privacy Policy describes how Merciglobal Systems Pvt Ltd handles personal data within the Merci HRMS platform. We act as a data processor on behalf of our customers (employers), who are the data controllers of their employees' information.

1. Data we process

• Employee records: name, contact, date of birth, photo, department/designation, and employment details.
• Statutory identifiers: PAN, Aadhaar, UAN, PF/ESI numbers and bank details, used solely for payroll and compliance.
• Attendance, leave, payroll and expense data generated through use of the Service.
• Recruitment data: applicant details and résumés submitted via the careers portal.
• Account & usage data: login timestamps and basic technical logs for security.

2. How we use it

Data is used only to provide the Service — computing attendance and payroll, generating payslips and statutory challans, managing leave and expenses, and enabling recruitment. We do not sell personal data or use it for advertising.

3. Document & file storage

Uploaded documents — résumés, expense bills and photos — are stored on encrypted, access-controlled object storage. They are never publicly accessible; files are served only through an authenticated, signed proxy to logged-in users.

4. Data isolation

Each organisation's data is logically separated. Data belonging to one customer is never exposed to another customer.

5. Security

• Passwords are stored using strong one-way hashing.
• All form actions are protected against cross-site request forgery.
• Access to HR modules is governed by role-based permissions.
• Uploads are validated by type and size before storage.

6. Retention

We retain data for as long as your account is active or as needed to provide the Service. On cancellation, data is retained for a limited export window and then deleted, subject to any legal retention requirements.

7. Your rights

Employees should direct requests to access, correct, or delete their data to their employer (the data controller). Employers can exercise these rights within the platform or by contacting us.

8. Sub-processors

We use reputable infrastructure and email providers strictly to operate the Service. They are bound by confidentiality and process data only on our instructions.

9. Changes

We may update this policy; material changes will be notified through the Service or by email.

10. Contact

Privacy questions? Email support@merciglobal.com or use our contact page.