Privacy Policy

This Privacy Policy applies to:

• Employees whose accounts are created and managed by their employer (“Users”, “You”)
• Clients (companies, organizations, institutions) who subscribe to our Services

Note: Employees cannot self-register; only HR or authorized administrators can create accounts and provide login credentials.

We may collect the following types of data:

2.1 Personal Identification

We may collect the following personal and employment-related information from employees, as provided by your employer:

• Basic Identification: Full name, employee ID, work email, phone number, date of birth, profile picture
• Government IDs: CNIC, Passport, or other national identification numbers
• Employment History: Previous experience, qualifications, certifications, and training records
• Emergency Contacts: Name, relationship, and contact details of designated emergency contacts
• References: Professional or personal references as provided to the employer

2.2 Account and Login Data

• Username, password, authentication tokens
• Mobile IMEI (for device authentication if enabled by employer)
• IP address and location (for account verification, access control, and geofencing)

2.3 Work Activity & Monitoring Data

If enabled by your employer, we may monitor:

• Login and logout times
• Active hours and breaks
• Applications and websites used during work
• Screenshots of work screens (optional, if enabled)
• Mouse/keyboard activity (not content of typing)
• Offline or away time input

2.4 Device & System Data

• Operating system, device model, app version
• Network configuration (e.g., IP address, network type)

2.5 Payment & Bank Data (if payroll functionality is used)

• Bank account number, routing number (processed securely for payroll)

2.6 Cookies & Analytics

• Cookies and similar technologies for session management, authentication, and service improvement

We use collected data only for legitimate corporate purposes, including:

1. User authentication and account security
2. Ensuring only authorized employees can access Services
3. Attendance tracking and productivity monitoring (if employer enables)
4. Providing HR, payroll, and reporting services
5. Debugging, analytics, and improving the Services
6. Compliance with legal or contractual obligations
7. Preventing unauthorized access, fraud, or abuse

Note: Location, IMEI, and IP address are used solely for authentication and revocation of unauthorized devices if enabled by the employer.

We do not sell or share your personal data for advertising. Data may be shared:

• With your employer: Your employer is the data controller for monitoring and HR purposes.
• With service providers: Hosting, analytics, security, payroll processing, and support vendors acting as processors.
• For legal compliance: To meet lawful obligations, prevent fraud, or respond to legal requests.

End users' Personal Data remains under the control of the employer. Any access or deletion requests must be submitted to your HR or system administrator.

We implement industry-standard security measures, including:

• SSL/TLS encryption for all data in transit
• Encrypted storage for sensitive information (passwords, payroll data)
• Role-based access controls
• Regular audits and vulnerability testing

Data is retained as long as the account is active or as required for legal compliance. Deleted accounts are removed securely upon employer request.

As an employee using the Services:

• You may request access to or correction of your personal data from your employer (data controller)
• You may request deletion of your account or personal data through your HR/admin
• You may opt-out of optional data sharing features if allowed by employer
• Certain rights may be limited by law or your employer's compliance obligations

Note: Direct requests to Zaffre Tech will be forwarded to your employer.

This system monitors work-related activity if enabled by your employer. Monitoring may include:

• Applications and websites used
• Attendance, work hours, breaks
• Screen activity, screenshots, and activity logs
• Device identifiers (IMEI, IP address, location)

Monitoring is limited to work hours and performed solely for business, security, compliance, and productivity purposes.

By using this system, you acknowledge that your employer controls data collection and processing.

Our Services are not directed to children under 16. We do not knowingly collect personal data from children.

Some services or subprocessors may be located outside your country. We ensure that all transfers comply with applicable data protection laws and adequate safeguards are in place.

We may update this Privacy Policy occasionally. Changes are effective upon posting. Your continued use of the Services after updates indicates acceptance.

For questions or concerns about this Privacy Policy: