HRVMS — Human Resource Vendor Management System

1. Scope and Application

This Privacy Policy applies to the HRVMS (Human Resource Vendor Management System) and all of its associated modules, features, functionalities, and services. HRVMS is a comprehensive, cloud-based workforce management platform designed to support and streamline human resource operations, vendor management, employee administration, attendance tracking, payroll processing, reporting, and organizational workflows for businesses and institutions.

HRVMS supports multiple user roles, including Admin, Manager, Accountant, HR, and Employee, with role-based access controls and permissions. The platform enables organizations to manage employee information, timesheets, leave and work-from-home (WFH) requests, employee service requests, payroll generation, document management, attendance monitoring, vendor and client management, reporting, and employee lifecycle processes.

This Privacy Policy applies to all HRVMS components, modules, features, functionalities, and services, including but not limited to:

• Employee Management
• Timesheet Management
• Vendor Management
• Client Management
• Invoice and Expense Invoice Management
• Reports and Analytics
• Security Access and User Permissions
• System Setup and Configuration
• Holiday Management
• Leave and Work-From-Home (WFH) Management
• Employee Service Requests (ESR)
• Employee Status Management
• Employee Expense Management
• News and Events Management
• Payroll Processing and Payslip Generation
• Employee Onboarding
• Employee Offboarding
• Payment Management
• User Profile and Password Management

The availability and functionality of features may vary depending on the user's assigned role, permissions, organizational policies, and system configuration.

This Privacy Policy applies to the HRVMS web application, administrative interfaces, reporting dashboards, and all modules and functionalities accessible through the HRVMS platform.

HRVMS is intended for use by end users, administrators, managers, HR personnel, accountants, and employees, as applicable to their respective roles and permissions within the platform.

This Privacy Policy does not replace or supersede any applicable organizational policies, employment agreements, payroll regulations, attendance policies, security procedures, or other internal governance documents that may apply to a particular organization, its personnel, or its use of the HRVMS platform. Where applicable, such policies, agreements, regulations, procedures, and requirements shall continue to apply in addition to this Privacy Policy.

2. Who We Are

Primary Global Headquarters & United States: ClientServer Technology Solutions LLC — 555 US Highway 1 South, Suite 220, Iselin, NJ 08830, USA

India & Asia-Pacific Operations: ClientServer Solutions PVT LTD — #805, 9th Floor, DSL Abacus IT Park, Uppal, Hyderabad, Telangana – 500039, India

Canada: ClientServer Tech Systems Inc. — 2560 Matheson BLVD East, Suite 225 & 226, Mississauga, ON L4W 4Y9, Canada

United Kingdom & Europe: ClientServer Technology Solutions Ltd. — 100 Avebury Blvd, Milton Keynes, England, MK9 1FH, UK

3. Data Controller/Data Processor Roles

HRVMS is primarily an enterprise and institutional service. Depending on the deployment model, the applicable contractual arrangements, and applicable law, the organization that determines the purposes and means of processing personal information through HRVMS may act as the data controller, data fiduciary, or equivalent responsible entity.

ClientServer may act as a data processor, service provider, or equivalent processing entity when processing personal information on behalf of an organizational customer. In such circumstances, ClientServer processes personal information in accordance with the customer's documented instructions, applicable contractual terms, this Privacy Policy, and applicable laws and regulations.

The subscribing organization may determine, based on its business requirements, organizational policies, and applicable law:

• which users are enrolled or provided access to HRVMS;
• which categories of personal information are collected and processed;
• which HRVMS modules and functionalities are enabled for its users;
• the purposes for which personal information is collected and processed;
• applicable data retention and deletion requirements;
• user roles, permissions, and access privileges;
• other organizational requirements governing the use and processing of personal information through HRVMS.

Where the subscribing organization determines the purposes and means of processing, users should generally direct requests relating to their employment records, employee information, attendance records, timesheets, leave and WFH records, payroll and payslip information, expense records, organizational account information, documents, service requests, and other organization-controlled personal information to the relevant subscribing organization or other responsible entity.

Where required by applicable law or contractual arrangements, ClientServer may assist the subscribing organization in responding to applicable data-subject or individual rights requests and in fulfilling its obligations relating to the processing of personal information through HRVMS.

4. Information We Collect

We collect information reasonably necessary to provide, maintain, secure, and improve the Services and to support the functionalities enabled by a particular deployment. The categories of personal information processed may vary depending on customer configuration, user role, device, enabled modules, and Services used.

Production Application Privacy & Disclosure Confirmation — Personal and Device Information Collected by the Mobile Application:

• Personal Data Collected: Employee Name, Work Email Address, Password (encrypted), Employee Code/ID, User Role, Manager Status, Timesheets, Leave Requests, and downloaded HR Documents.
• Device Data Collected: Device OS version, used strictly to select compatible download paths, and network connectivity status.

Other than the essential HR operational data and the minimal device OS version information listed above, no other personal or device data is collected, tracked, or taken by the application.

5. Mobile Device Permissions

HRVMS requests device permissions only when a feature requires them. Permission names and availability may differ between Android and iOS.

Users can manage device permissions through Android or iOS privacy settings. Disabling permission may prevent the corresponding feature from working.

Production Application Privacy & Disclosure Confirmation: Neither Firebase Cloud Messaging (FCM) nor Apple Push Notification service (APNs) is integrated into the application, and no push notification service or provider is currently in use.

6. How Do We Use Personal Information

We use personal information to:

• Provide, operate, maintain, and secure HRVMS.
• Create, manage, and authenticate user accounts.
• Manage employee records, profiles, work history, and organizational information.
• Record attendance.
• Manage timesheets, leave requests, WFH requests, shifts, holidays, and workforce activities.
• Process payroll, payslips, reimbursements, expense claims, and related HR functions.
• Support employee onboarding, offboarding, and document management processes.
• Manage Employee Service Requests (ESR), approvals, communications, and workflow activities.
• Manage vendor, client, employee, and organizational records.
• Generate reports, dashboards, analytics, and business insights.
• Send attendance, payroll, leave, onboarding, offboarding, security, and administrative communications.
• Process invoices, payments, subscriptions, and related financial administration where applicable.
• Respond to support requests and troubleshoot technical issues.
• Maintain audit logs, monitor system usage, and investigate security incidents.
• Prevent fraud, unauthorized access, misuse, and policy violations.
• Improve system performance, reliability, usability, and service quality.
• Comply with applicable legal, regulatory, contractual, tax, accounting, and security obligations.
• Establish, exercise, or defend legal claims and rights.

7. Employee Data

HRVMS may process personal information relating to employees and other workforce members.

The subscribing organization is responsible for determining the lawful basis for collecting and processing employee information, establishing applicable workplace policies, and ensuring compliance with employment, labor, privacy, and other applicable laws.

Employee information may be processed for authorized purposes including workforce administration, attendance management, timesheet management, leave and WFH management, payroll processing, employee onboarding, employee offboarding, employee service requests, expense management, document management, reporting, compliance, and organizational operations.

We do not use employee information for unrelated marketing, targeted advertising, behavioral advertising, or unrelated commercial profiling.

8. Client Data

HRVMS may process information relating to clients, customers, and business partners maintained by the subscribing organization.

The subscribing organization is responsible for determining what client information is collected, the purposes for processing, and the applicable retention and access requirements.

Client information may be processed for authorized business purposes including client management, workforce allocation, employee assignments, invoicing, reporting, communication, contract administration, payment tracking, and operational management.

Client information is processed only as necessary to provide HRVMS functionality and support authorized organizational business activities.

We do not use client information for unrelated marketing, targeted advertising, behavioral advertising, or unrelated commercial profiling.

9. Vendor Data

HRVMS may process information relating to vendors, suppliers, contractors, and service providers associated with the subscribing organization.

The subscribing organization is responsible for determining the categories of vendor information collected, the purposes for processing, and applicable legal or contractual requirements.

Vendor information may be processed for authorized purposes including vendor management, workforce assignments, invoicing, payment administration, reporting, contract administration, communication, compliance, and business operations.

Vendor information is processed only to support the services and workflows configured by the subscribing organization.

We do not use vendor information for unrelated marketing, targeted advertising, behavioral advertising, or unrelated commercial profiling.

10. Third Party Service Providers and Sharing

HRVMS may disclose or process personal information through authorized service providers, infrastructure providers, payment providers, email services, analytics tools, support teams, and other third parties where necessary to provide, secure, operate, maintain, support, or improve the HRVMS application, or where required or permitted by law.

Third parties are expected to process information only for authorized purposes and apply appropriate confidentiality, security, and data-protection obligations.

Production Application Privacy & Disclosure Confirmation — Third-Party SDKs/Libraries Integrated:

• State & UI: provider, google_fonts, flutter_svg, toastification, cupertino_icons.
• Networking: dio, pretty_dio_logger.
• Local Storage & Security: flutter_secure_storage (encrypted token storage), shared_preferences.
• File Handling & Device Utilities: file_picker, permission_handler, path_provider, device_info_plus, connectivity_plus, pdf, printing.

Analytics/crash-reporting tools: NONE — No analytics (e.g., Firebase Analytics, Google Analytics) or crash-reporting tools (e.g., Firebase Crashlytics, Sentry) are integrated into the application.

Third-Party Data Sharing & Disclosure

The HRVMS Mobile Application does NOT share, sell, rent, or disclose user data to third-party data brokers, analytics providers, or advertising networks.

• Data Transmission: All data transmitted by the application travels directly over encrypted HTTPS connections between the user’s mobile device and the company’s authorized HR backend servers.
• Code Packages vs. Data Receivers: Open-source developer libraries integrated into the app build (such as UI widgets, state managers, and file utility packages) function strictly as local code utilities. They do not operate as external data collection endpoints, background tracking agents, or third-party data processors.

The production third-party provider list must remain synchronized with the actual Android and iOS SDK inventory. A provider that is not used in production should not be represented as an active provider.

11. Payment Processing

Payment processing services (such as Razorpay or bank payment gateways) are currently not active within the HRVMS application.

When online payment functionality for subscriptions, licenses, or services is enabled in future releases, payments will be processed securely through the authorized payment provider’s infrastructure. HRVMS does not store complete credit/debit card numbers or security codes (CVV). Transaction identifiers, payment status, amounts, and invoice records may be retained for accounting and compliance purposes.

Note: This clause and the production SDK inventory will be updated automatically upon full deployment of the payment gateway.

12. International Data Transfers

HRVMS uses established cloud hosting providers for application infrastructure, storage, operational services and backups as configured. Default deployments may operate in US regions, Microsoft Azure East US. HRVMS supports multi-region deployment capabilities across international availability zones, including India, the European Union, the United Kingdom and APAC, and may support other regions such as the Middle East, based on enterprise customer agreements, data-residency requirements and technical availability.

Where personal information is transferred across borders, ClientServer will apply appropriate contractual, technical and organizational safeguards as required by applicable law. Where applicable, these may include Standard Contractual Clauses (SCCs), Data Transfer Addenda, or equivalent transfer mechanisms. Data is protected in transit using TLS 1.3 where supported and at rest using AES-256 encryption where supported by the applicable infrastructure.

13. Data Retention

We retain personal information only for as long as reasonably necessary to provide HRVMS services, support business operations, fulfill contractual obligations, maintain security, perform audits, comply with legal and regulatory requirements, resolve disputes, and enforce applicable agreements. Retention periods may vary depending on organizational policies, customer-specific requirements, and applicable laws.

14. Data Deletion and Account Deletion

Users may request deletion or deactivation of their HRVMS account and associated personal information, subject to applicable law, company policy, employment requirements, and internal approval processes.

Where an HRVMS account is created and managed by the Admin, HR team, or authorized system administrator, deletion or deactivation may require internal review and approval because the company may have legal or business obligations to retain employee, attendance, payroll, invoice, onboarding, offboarding, audit, security, and compliance records.

HRVMS may contain personal and work-related information such as employee profiles, working information, documents, timesheets, leave/WFH records, payroll details, payslips, employee service requests, expense sheets, attendance records, onboarding forms, offboarding records, vendor/client details, invoices, and system access records.

When deletion is approved, HRVMS will remove, deactivate, or restrict the relevant account and personal information from active operational systems where deletion is technically and legally permitted. Information required for legal compliance, payroll, tax/accounting, audit, fraud prevention, security, dispute resolution, business continuity, or statutory retention may be retained for the applicable period.

Data stored in encrypted backups may remain until the applicable backup retention cycle expires and is not ordinarily used for normal operational processing.

Production Application Privacy & Disclosure Confirmation — Mobile Account and Data Deletion:

• In-App Account Deletion: NO — There is currently no self-service in-app account deletion button. Logging out of the application wipes local authentication tokens from the device.
• External Account/Data Deletion URL: NONE — There is no dedicated external web deletion URL. Account deletion is handled as an enterprise process, managed manually by the employer’s HR Administrator / IT Support upon email request (e.g., to the organization’s designated support contact).
• Data Retention/Deletion — Mobile Device: Logging out of the application immediately and permanently deletes stored access/refresh tokens and local user session data from the device.
• Data Retention/Deletion — Backend Server: Employee records, timesheets, and HR documents are retained on company servers in accordance with the organization’s HR data retention policies, as described elsewhere in this Section.

15. Data Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, and destruction.

• HTTPS/TLS encryption for supported data transmissions.
• Access controls and authentication for application and administrative services.
• Role-based and least-privilege access to sensitive systems.
• Password and credential protection using appropriate security mechanisms.
• Server-side protection of API credentials and secrets.
• Security-relevant logging and monitoring.
• Backups and recovery mechanisms are appropriate to the service.
• Security incident response procedures and periodic review of security controls.

Specific controls may vary by deployment. No electronic transmission or storage technology can be guaranteed to be completely secure, but we seek to maintain safeguards appropriate to the nature and sensitivity of the information.

16. Security Incidents and Data Breaches

We maintain incident-response procedures designed to detect, investigate, contain, remediate, and recover from security incidents involving personal information.

Where a security incident affects personal information and notification is required by applicable law, we will notify relevant customers, individuals, regulators or other authorities within the applicable timeframe and use the required method.

Where HRVMS processes information on behalf of an organizational customer, ClientServer may notify the customer and provide reasonable assistance so that the customer can meet its own notification and regulatory obligations.

Notifications may describe the nature of the incident, categories of information affected, steps taken to address the incident, and recommended protective measures, to the extent required and reasonably available.

17. Cookies and Tracking Technologies

The HRVMS web platform may use strictly necessary cookies, session storage, authentication tokens, or similar technologies required for secure login, session management, access control, and proper functioning of the application.

These technologies may be used to maintain user sessions, support role-based access, prevent unauthorized access, remember basic system preferences, and ensure reliable operation of HRVMS modules such as Employee, Timesheets, Vendor, Client, Invoice, Reports, Security Access, Leave/WFH, Employee Service Request, Payroll, Employee Onboarding, and Employee Offboarding.

HRVMS does not intentionally use cookies or similar tracking technologies for unrelated advertising or cross-site behavioral tracking.

If analytics, crash reporting, monitoring, or similar technologies are introduced for performance, reliability, diagnostics, security, or product improvement purposes, the privacy policy and applicable disclosures should be updated as required before or when such functionality is deployed.

18. Advertising, Profiling, Sale of Personal Information

HRVMS is an enterprise and institutional application and is not intended to sell personal information for monetary consideration.

We do not sell, rent, lease or trade student information, employee information, attendance records or other personal information for targeted advertising or unrelated commercial profiling.

We do not use behavioral advertising, emotion recognition, or unrelated profiling.

Production Application Privacy & Disclosure Confirmation: The mobile application does not use tracking or advertising — no advertising SDKs (e.g., AdMob or similar), no IDFA/GAID collection, and no cross-app tracking frameworks are present in the application.

19. Privacy Rights and Choices

Depending on the user's location, applicable law, company policy, and the nature of the HRVMS record, users may have privacy rights relating to their personal information processed through HRVMS.

These rights may include:

• Access or obtain a copy of personal information stored in HRVMS.
• Request correction of inaccurate or incomplete employee profile, document, attendance, payroll, leave/WFH, timesheet, onboarding, offboarding, invoice, or service request information.
• Request deletion or deactivation, subject to lawful retention exceptions.
• Withdraw consent where processing is based on consent.
• Object to or request restriction of processing where applicable.
• Request portability of personal information where required by applicable law.
• Request information about categories of data processed, purposes of processing, recipients, retention periods, and applicable third-party service providers.
• Raise concerns regarding employee documents, payroll data, attendance records, payslips, service requests, expense records, onboarding records, or offboarding records.
• Submit a complaint or grievance to the HRVMS Admin/HR team, privacy contact, or applicable regulatory authority.

These rights are not absolute and may be restricted by law, employment obligations, payroll and accounting requirements, contractual duties, audit obligations, security requirements, legal claims, or the rights and privacy of other individuals.

20. Privacy Requests and Identity Verification

To request access, correction, deletion, consent withdrawal, account deactivation, or any other privacy-related action for HRVMS, users may contact the HRVMS Admin, HR team, or the designated privacy contact.

Privacy and data-protection requests may be submitted to:

Email: info@clientservertech.com
Subject: Privacy Request – HRVMS

Users should provide sufficient information to identify the relevant HRVMS account or record, such as name, email address, employee code, user role, country/location where applicable, and the type of request.

Identity verification may be required before fulfilling a request, especially where the request relates to sensitive information such as employee records, payroll data, payslips, attendance records, employment documents, onboarding documents, offboarding records, timesheets, leave/WFH records, expense details, service requests, or account security.

Privacy requests will generally be acknowledged within 1–2 business days. Substantive resolution or execution will generally be completed within 30 calendar days, subject to applicable legal requirements, permitted extensions, request complexity, identity verification, internal approval, and lawful retention obligations.

A request may be declined or limited where permitted or required by law, including where disclosure or deletion would violate legal, payroll, accounting, audit, tax, employment, statutory, contractual, security, or compliance obligations, compromise another person’s privacy or security, interfere with legal proceedings, or prevent compliance with lawful retention requirements.

21. Grievance and Privacy Contact

Privacy and data-protection requests may be submitted to:

Email: info@clientservertech.com
Subject: Privacy Request - HRVMS

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, technology, third-party providers, legal requirements or privacy practices. The revised Policy will display an updated “Last Updated” date. For material changes, we may provide additional notice through the Services, email, customer communications, or other reasonable methods where required.

23. Contact Information

24. App Store and Google Play Transparency

HRVMS is intended for distribution through Android and iOS app stores. Our store's privacy disclosures are intended to remain consistent with this Policy and the actual production application.

• Google Play Data Safety disclosures must accurately describe data collected, shared, security practices, and deletion mechanisms.
• Apple App Store privacy information must accurately reflect data collected by the app and third-party SDKs.
• Where the app permits account creation, the production release must provide the applicable account-deletion path and external deletion resource.
• Final store declarations must be completed using the actual production of SDK and data-flow inventory.

25. Customer / Deployment Responsibilities

For HRVMS, the company, HRVMS Admin, HR team, and authorized deployment owners are responsible for configuring and using the system in accordance with applicable laws, company policies, and internal procedures.

Responsibilities may include:

• Determine the applicable lawful basis and required notices for processing employee, manager, HR, accountant, admin, vendor, client, candidate, attendance, payroll, onboarding, offboarding, expense, and service request information.
• Obtain and document required consent where applicable, including consent for employee data processing, attendance processing, document collection, payroll processing.
• Configure user roles, security access, country-level access, approval of workflows, and least-privilege permissions appropriately.
• Ensure employees, managers, HR users, accountants, admins, candidates, and other users receive required privacy notices and system usage instructions.
• Use HRVMS only for authorized HR, payroll, attendance, vendor management, reporting, onboarding, offboarding, service request, expense management, and organizational purposes.
• Maintain applicable employment, payroll, accounting, invoice, tax, attendance, audit, and statutory retention requirements.
• Periodically review access for Super Admin, Admin, HR, Manager, Accountant, Employee, and Employer roles.
• Ensure uploaded documents, employee records, payroll records, payslips, onboarding forms, EPFO forms, NDA forms, expense sheets, service request attachments, and offboarding records are handled securely.
• Notify the technical or privacy team promptly of relevant legal, security, privacy, or data-protection requirements affecting HRVMS.
• Ensure that any third-party integrations, email configurations, payment services, analytics tools, and infrastructure providers used in production are reviewed and documented.

26. Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

HRVMS is intended to process digital personal data in accordance with applicable Indian data-protection requirements, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), to the extent applicable to the relevant processing activity and responsible entity.

Appendix A — Data Category and Purpose Matrix

Appendix B — Third-Party Provider Register