Privacy Policy
Learn how account, company and employee information is processed and protected.
1. Scope
This policy describes how the NovaHR operator processes account, company, employee, attendance, payroll, leave, recruitment and support information.
2. Data controller and processor roles
The subscribing organisation generally controls employee data. The system operator processes that data according to the subscription agreement and configured services.
3. Information processed
Depending on enabled modules, information may include identity and contact details, employment history, attendance coordinates, leave records, compensation, bank details, documents, performance, recruitment, travel, expenses and support interactions.
4. Security
The application includes tenant isolation, access roles, CSRF protection, password hashing, prepared database queries, audit logs, upload validation and expiring API tokens. Production deployments should add HTTPS, encrypted backups, secure secrets management, monitoring and incident response.
5. Retention and deletion
Configure retention periods based on employment, tax, payroll, labour and privacy requirements. Tenant exports and verified deletion workflows should be part of the production operating procedure.
6. Rights and requests
Employees should contact their employer for access, correction or deletion requests. The operator should support the employer with secure export and correction tools.
7. International transfers
Document hosting regions, subprocessors and transfer safeguards before processing personal data across borders.
Last updated: 09 November 2026. This template is not legal advice.