Services | Flexzo Hr Services Pvt.Ltd.

Privacy Policy

Your Privacy Matters to Us

To be successful, companies need to embrace a holistic approach to data privacy, which improves their chances of resisting threats from both internal and external sources and managing those risks effectively. With this policy, outline and define expectations from the employees in your organization for the process followed for Data Confidentiality/ Data Privacy and also ensure employees' commitment to the Data Privacy Policy.

Purpose

The purpose of the Privacy Policy is to outline and define the expectations from employees in the organization regarding the process followed for Data Confidentiality/Data Privacy. It also aims to ensure employees' commitment to the Data Privacy Policy. The Privacy Policy sets standards and a framework for the usage and protection of confidential data related to the organization. It communicates the organization's commitment to protecting the privacy of user data and consumer data within the organization. The Privacy Policy is evidence of the organization's commitment to data protection principles.

Personal Data

Personal data includes any information about an identified or identifiable person, known as a data subject, i.e. employee/s. Personal data includes the employee/s name, date of birth, address proof and/or passport details, compensation & benefits, and educational qualifications- all of which can be utilized as identification of employee/s. Additionally, personal data also includes sensitive personal data and biometric data.

Privacy of E-mail Lists

Individuals joining Flexzo mailing lists are added to the email datab ase, with the assurance that addresses are not sold, rented, loaned, traded, or leased to anyone.

Cookie Policy

Cookies are utilized to recognize users on subsequent visits to the website. Users can configure their browser settings to accept, reject, or be notified about cookies. Disabling cookies may affect the full functionality of the website.

External Web Services

The website may use external web services (e.g., video hosting), and users are advised to review the privacy policies of such services. Flexzo HR Services is not responsible for the information collection practices of external websites linked from its site.

Changes to Privacy Policy

Flexzo HR Services may update its privacy policy to align with evolving technology and trends. Users will be notified of any changes. Questions about changes to practices can be directed to Flexzo.

Data Privacy/Confidentiality Policy

Objective

The objective of Data Confidentiality or Data Privacy Policy (hereinafter referred to as ‘Data Privacy Policy’) is to set standards and/or framework for the usage and protection of confidential data related to the organization. Data Privacy Policy intends to communicate the organization’s commitment in terms of protecting the privacy of user data and protection of consumer data within the organization. It is evidence of the organization’s commitment to data protection principles. The main goal of the Data Privacy Policy is to protect and secure all data consumed, managed, and stored by the organization. It aims to ensure the security and integrity of all data, both data-at-rest and data-in-transit, and to comply with the Data Protection Law. The policy sets standards and frameworks for the usage and protection of confidential data related to the organization, and it communicates the organization's commitment to data protection principles

Scope & Applicability

The Scope of Data Privacy Policy covers all employee/s, customers, suppliers, external consultants, partners, contractors and any other external entity. The policy defines the types of data and their appropriate usage. Policy / Process.

Policy Definition

The Data Privacy Policy follows Federal Decree-Law No. 45 – (Data Protection Law) regarding personal data protection. It is designed to protect “personal data”, which is “any data related to a specific natural person or related to a natural person that can be identified directly or indirectly by linking the data”. This expressly includes an individual’s name, voice, image, identification number, electronic identifier, and geographical location. It also includes sensitive personal data and biometric data.
The Data Privacy Policy of the organization is set on the lines of the law to be compliant to standardize the use, monitoring and management of data. The main goal is to protect and secure all data consumed, managed and stored by the organization. The Data Privacy Policy includes all data stored by the core infrastructure of the organization, including on-premise storage equipment, offsite locations, and cloud services. It should help the organization ensure the security and integrity of all data—data-at-rest and data-in-transit. The details of the Data Protection Law have been stated in ANNEXURE A.

Procedures

The Data Privacy Policy implementation is defined via procedures. Information Technology (IT) department plays a vital role in implementing policy and ensuring adherence to the policy across the organization. IT department, i.e. the IT Manager and/or chosen representative from the IT department, shall devise a comprehensive inventory cataloguing the storage locations of sensitive company data. .

The comprehensive inventory is include the following analysis

HR systems data storing employee records in terms of name, gender orientation, designation, department, date of joining, compensation and wages details, payroll, health and retirement benefits.
Employee record/s in the policy is defined as Personal data. Personal data is any information about an identified or identifiable person, known as a data subject, i.e. employee/s. Personal data includes any information that can be used to identify someone, alone or in combination with other information. This includes the employee/s name, date of birth, address proof and/or passport details, compensation & benefits, and educational qualifications- all of which can be utilized as identification of employee/s.
Unstructured data residing in company equipment, remote servers and email accounts) Persons with a view or edit access to the data The volume of data ageing

The Data Privacy Policy of the organization is implemented by adhering to the following steps

Data Life Cycle Management – This refers to a framework that standardizes data processes in the organization, from data creation through storage and archiving until its final deletion.

Data Risk Management

This includes identifying and assessing all risks and threats that may affect the data and thereby protecting the data confidentiality via undertaking necessary steps as may be deemed to be considered necessary.

Data Back-up and Recovery

This includes the backup support mechanisms for data once data is created. All organization data is supported by a backup drive that is accessible in the case of an emergency, i.e. all systems failure.

Data Access Management Controls

This includes that the data related to the organization shall be used only by authorized user/s. The records of the same shall be kept by the organization’s IT department.
Data Storage Management – This includes tasks related to securely moving data on-premises or in external cloud environments. These may be data stores for frequent, high-performance access or archival storage for infrequent access.

Data Breach Prevention

Data breach prevention measures are implemented for the purpose of preventing unauthorized access to data. The goal is to avoid external malicious viruses or internal threats from gaining unauthorized access to information and systems. Cyber security measures are put in place for the purpose of preventing attacks on internal networks, network perimeters, data-intransit, and data-at-rest. Typically, these measures include data encryption, implementation of antivirus software, protection against ransomware, perimeter security hardware and software, and access management software.

Monitoring and Reviewing

Monitoring and reviewing processes help organizations gain visibility into data activities, risks and controls, helping improve protection and respond to threats and anomalies. Monitoring and reviews may also be necessary to meet compliance requirements. Ongoing monitoring provides visibility into all aspects of the data lifecycle, including data creation, storage, transmission, archiving, and destruction. These activities offer essential evidence for internal and external auditors that examine controls for data protection and management.

The organization upholds the highest responsibility in data collection from the subscribers if any, and the data received for job applications. Therefore data collected from subscribers, if any, job applicants, employee/s, data related to products, new product development and innovations, finance, supply chain and any other data shall be treated with confidentiality. All data shall be treated in the following manner:

All data shall be processed within its legal and moral boundaries.
All data shall be protected against illegal and unauthorized access.
All data shall be protected against any unauthorized or illegal access by internal or external parties.
Data shall not be communicated informally.
The data shall not be stored for more than the specified time.
Data shall not be distributed or transferred to organizations, states or countries that do not have adequate data protection policies.
Data shall not be distributed to any other parties other than the agreed upon
(exempting legitimate requests from law enforcement authorities)
Let the employee/s and/or parties involved from whom the data is being
collected and keep them informed of how, i.e. how, the data shall be processed/used and who has access to it.
Responsibility – IT Department / HR Department / Finance Department / Supply Chain
The IT Manager must formulate an effective governance strategy to keep track of inward or outward data flow.
The IT Manager and the Supply Chain Manager shall have to maintain oversight of third-party service providers and data processors since the Data Protection
Law considers the collecting party responsible for the safeguarding of personal data even if the information has subsequently been shared with other parties.
HR Manager/s and/or Business Head/s of the organization are strictly responsible for adhering to and ensuring the culture of data confidentiality with respective teams. Building an enterprise-wide appreciation of good information security practices requires a combination of senior-level buy-in and a commitment to continuous learning.
The IT Manager should constantly be vigilant in maintaining IT security and controls similar to the adoption of information security frameworks for Privacy Information Management.
Adoption of effective data breach response measures.

Non-compliance and consequences

In the event of non-compliance with Data Privacy Policy, the concerned Department Manager/s and/or concerned parties involved shall be suspended and/or terminated and/or legal action shall be taken towards parties involved in non-compliance.

Special Circumstances and Exceptions

In the event the Manager/s are unable to comply with the Data Privacy Policy due to challenges that involve specific situation/s or circumstances, then the party and/or parties involved shall be exempted in writing by the management from any legal action.

Copyright restrictions

Commercial use or publication of all or any item displayed is strictly prohibited without prior authorization from Flexzo. Nothing contained herein shall be construed as conferring any license by Flexzo HR Services to use any item displayed.

Documents may be copied for personal use only on the condition that copyright and source indications are also copied, no modifications are made and the document is copied entirely. However, some documents and photos have been published on this site with the permission of the relevant copyright owners (who are not Flexzo). All rights are reserved on these documents and permission to copy them must be requested from the copyright owners (the sources are indicated within these documents/photographs).

Flexzo HR Services takes no responsibility for the content of external Internet sites. Other websites that we link to are owned and operated by third parties and Flexzo HR Services has no control over them. The fact that we include links to other websites does not mean that Flexzo HR Services approves of or endorses any other third party website or the content of that website. We accept no liability for any statements, information, products or services that are published on or are accessible through any websites owned or operated by third parties.

Any communication or material that you transmit to, or post on, any public area of the site including any data, questions, comments, suggestions, or the like, is, and will be treated as, non-confidential and non-proprietary information. If there is any conflict between these terms and conditions and rules and/or specific terms of use appearing on this site relating to specific material then the latter shall prevail.

These terms and conditions shall be governed and construed in accordance with the laws of India.

If these terms and conditions are not accepted in full, the use of this site must be terminated immediately.