Privacy Policy for your people’s data.

CollectivWork is an AI-powered HR-Tech ERP and Human Resource Management Software (HRMS) company dedicated to providing innovative solutions for efficient HR operations. Our services cover employee management, payroll processing, attendance tracking, recruitment, performance, learning, expenses, projects and more. This Privacy Policy sets out our commitment to protecting the privacy and personal data of everyone who interacts with our platform.

We recognise the importance of safeguarding personal data and maintaining the trust of our users. Workforce data — identity, payroll, bank and attendance records — is some of the most sensitive personally identifiable information (PII) an organisation holds. This policy explains how we collect, use, store and protect personal data, and the rights and choices you have regarding your information.

It is written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable data protection laws, and is supported by our ISO/IEC 27001-certified Information Security Management System and ISO 9001:2015-certified Quality Management System.

This policy applies to personal data collected, processed and stored by CollectivWork. It covers all platforms, applications, websites and services provided, owned or governed by CollectivWork that involve the handling of personal data — including the CollectivWork web application, mobile apps, candidate career portals, APIs and integrations, and our marketing website.

Data protection laws in many jurisdictions distinguish between “controllers” and “processors” of personal information. A controller (a “Data Fiduciary” under the DPDP Act) decides why and how personal information is processed. A processor (a “Data Processor”) handles information only on behalf of a controller and on the controller’s instructions, without making its own decisions about that information. Depending on the situation, CollectivWork may act as either.

• Employee, candidate and payroll records an organisation stores in CollectivWork

  CollectivWork’s roleProcessor / Data Processor, on the organisation’s documented instructions under a Data Processing Agreement (DPA)

  Who to contact firstYour employer, or the organisation you applied to

• Website visitors, demo and referral requests, customer account administrators, event attendees and marketing contacts

  CollectivWork’s roleController / Data Fiduciary

  Who to contact firstCollectivWork

• Service operations data such as security logs, usage analytics and support tickets

  CollectivWork’s roleController / Data Fiduciary, to run and secure the service

  Who to contact firstCollectivWork

This policy applies in full when CollectivWork is the controller of your personal information, unless a different CollectivWork privacy statement is shown when we collect it. It explains how we collect, use and share personal information for our own purposes, for example when you:

• Visit a CollectivWork website that links to this policy.
• Request a demo, submit a referral or contact our sales team.
• Interact with us as a representative of a company that is our customer or supplier.
• Create or use an account offered directly by CollectivWork, as opposed to one offered by our customers.
• Register for or attend a CollectivWork marketing, learning or training event or webinar.
• Give us feedback about our products or services.
• Receive sales or marketing communications from us, including emails or phone calls.

Where we process personal information as a processor on behalf of our enterprise customers, the customer’s own privacy notice governs that processing, and our obligations are set out in our agreement with them. The sections of this policy on security, sub-processors, international transfers, breach notification and retention describe how we protect that data.

We may collect various types of personal data from our users and employees, depending on the modules an organisation uses and how it configures them, including but not limited to:

• Contact details: names, addresses, location and contact information such as email address and phone number, and emergency contacts.
• Identification details: such as employee ID, photograph, date of birth and government-issued identifiers like a Social Security Number, PAN, Aadhaar or passport number, where an organisation collects them for statutory or verification purposes.
• Professional details: employment history, job titles, department, reporting lines, joining and exit dates, documents and other professional information.
• Payroll and financial details: salary structure, bank account details, tax declarations, statutory identifiers such as UAN and ESIC numbers, reimbursements and expense claims.
• Attendance and location data: check-in and check-out times, shifts, leave and timesheets, and — only with consent — geo-location for attendance, visits and field tracking.
• Recruitment data: CVs and applications, assessment and interview results, AI screening scores and their explanations, screening call recordings and transcripts, offers and background-verification outcomes.
• Performance and learning data: goals, OKRs and KRAs, feedback, reviews, ratings, course progress and certifications.
• Technical data: IP address, device and browser information, sign-in records, audit logs and cookie identifiers.

Sensitive personal data — financial information, government identifiers, health or disability information, and biometric data where an organisation uses biometric attendance devices — is processed only where there is a lawful basis and a genuine need, and is protected with stricter access controls and field-level masking.

• From your organisation: HR administrators create and update employee and candidate records, or import them from existing systems.
• From you directly: through employee self-service, the mobile app, career portals and job applications, and forms on our website such as demo and referral requests.
• Automatically: through log files, cookies and similar technologies when you use our website, web application or mobile apps.
• From third parties: such as job boards and recruitment agencies, background-verification providers and integrations that an organisation chooses to connect.

We collect and process personal data only for specified, explicit and lawful purposes, and only as much as those purposes need. These relate to providing our HRMS services, including:

• HR activities such as employee onboarding, performance evaluation and training.
• Payroll processing and management, including statutory deductions and filings.
• Attendance tracking and leave management.
• Recruitment, from sourcing and screening to offers and onboarding.
• Employee engagement and communication.
• Securing the platform, preventing fraud and investigating incidents.
• Providing support and improving the service using aggregated usage information.
• Compliance with legal obligations.

We do not sell, rent or trade personal data, and we do not use customers’ HR data for advertising.

We process personal data only where we have a lawful ground to do so, such as the performance of a contract, compliance with a legal obligation, your consent where it is required, or our legitimate interests as permitted by applicable law.

• Providing the HR-Tech ERP service to an organisation

  GDPR basisContract; the employer’s lawful basis

  DPDP Act basisLegitimate uses for employment purposes (Section 7); consent

• Payroll, tax and labour-law compliance

  GDPR basisLegal obligation

  DPDP Act basisCompliance with law (Section 7)

• Security, fraud prevention and audit logging

  GDPR basisLegitimate interests; legal obligation

  DPDP Act basisLegitimate uses; safeguarding the employer

• Location-based attendance

  GDPR basisContract with your employer; consent where required

  DPDP Act basisConsent

• Demo, referral and marketing communications

  GDPR basisConsent; legitimate interests where permitted

  DPDP Act basisConsent

Where the law requires it, we obtain explicit and informed consent — in clear and plain language, for a specific purpose — before processing your personal data. You may withdraw your consent at any time, as easily as you gave it. Please note that withdrawing consent may affect the availability and functionality of some of our services, and does not affect processing that took place before withdrawal.

CollectivWork includes AI features such as resume screening and matching, AI phone screening, assessment generation, receipt and document reading, summaries and insights. They are designed as decision support:

• AI outputs show the reasoning behind them, so an organisation can review, challenge or override them.
• We do not make decisions with legal or similarly significant effects about individuals solely by automated means; hiring, compensation and performance decisions stay with people in the organisation.
• A customer’s data is not used to train AI models for other customers.
• You can ask the organisation concerned — or us, where we are the controller — for human review of an AI-assisted outcome that affects you.

Our mobile apps request your location (coarse or fine) only after you acknowledge, consent and agree that your employer will enable location tracking for attendance purposes, such as geo-fenced check-ins, visits and field-workforce tracking during working time.

If you do not give consent, we will not request access to, or track, any location information from your mobile device at any time while you download or use our mobile apps. Under the GDPR, the legal basis for processing this information is our contractual obligation to your employer to provide the service. You can change the permission at any time in your device settings.

CollectivWork may share or make your personal information accessible to third parties as follows:

• CollectivWork affiliates: within the CollectivWork group where necessary to fulfil a request you have made, or for customer support, marketing, technical operations, event registration and account management.
• Service providers and sub-processors: vendors contracted to provide services on our behalf, such as IT and cloud hosting, marketing, customer support, call recording and data enrichment, email and SMS delivery and payment services. Each is bound by a written agreement requiring confidentiality and security, and may use the personal information we provide only as instructed by CollectivWork.
• CollectivWork partners: when you take part in webinars, events or other activities we run with third parties, we may share your contact information and interests with those approved partners so they can contact you about CollectivWork.
• Your organisation: where your organisation is a customer or prospective customer, we may share your information with relevant people there. For example, a list of attendees at a CollectivWork event, or end-user queries that the organisation should answer directly.
• Integrations an organisation enables: such as job boards, calendars, banks for salary disbursement or accounting tools that a customer chooses to connect.

We may also disclose information if we believe in good faith that it is necessary to (a) meet legal requirements or comply with legal process; (b) protect and defend our rights or property; (c) enforce our website Terms and Conditions; or (d) protect the interests of our customers, users or others.

If CollectivWork goes through a business transition such as a merger, acquisition or sale of all or part of its assets, your personal information may be among the assets transferred. We will require the buyer, and its agents and advisors, to use it only for the purposes described in this policy. We may also ask for your consent to share your information with other unaffiliated third parties not described here.

Customers can request our current list of sub-processors, and we give customers notice before adding a new one that processes their data.

Personal data may be processed in a country other than the one where it was collected. We transfer personal data internationally only where permitted by the DPDP Act and, for data subject to the GDPR, with appropriate safeguards such as adequacy decisions or the European Commission’s Standard Contractual Clauses, backed by supplementary technical and organisational measures. Customers can contact us for details of where their data is hosted.

We use technical and organisational measures that provide a level of security appropriate to the nature of the personal information and the risks involved in processing it. We follow industry best practice — and the controls of our ISO/IEC 27001-certified Information Security Management System — to protect personal data from unauthorised access, loss, alteration or disclosure. These include:

• Encryption: data encrypted in transit with TLS and at rest.
• Access control: role-based access on least-privilege principles, multi-factor sign-in options, and masking of sensitive PII fields for roles that do not need them.
• Audit logs: a record of who viewed, created, changed or exported data, and when.
• Secure development: secure coding, code review, vulnerability scanning and controlled change management.
• Resilience: monitoring, backups, and business-continuity and disaster-recovery planning.
• Governance: risk assessments, internal audits and management reviews under our ISO/IEC 27001 and ISO 9001:2015 management systems.
• People and vendors: confidentiality agreements and regular security and privacy training for staff, and security due diligence on sub-processors.

No method of transmitting information over the internet can be guaranteed to be completely secure. You are responsible for keeping your password, and any other means of authentication used to access secured resources, safe — and for telling your administrator or us promptly if you suspect unauthorised access.

We maintain a documented incident-response process to detect, contain, investigate and remediate security incidents. If a personal data breach affects data we process for a customer, we notify that customer without undue delay and support them in meeting their own obligations. Where we are the controller, we notify the Data Protection Board of India, the relevant supervisory authority and affected individuals as and when applicable law requires — including within 72 hours of becoming aware of a notifiable breach under the GDPR.

We keep personal information only for as long as we have an ongoing legitimate business need, for example to provide a service you have requested or to meet legal, tax or accounting requirements. For HR data processed for customers, the organisation sets retention in the platform and we follow its instructions. Retention periods vary by category of data. The criteria we use to set them include:

• How long we have an ongoing business relationship with you.
• The amount, nature and sensitivity of the personal information we process.
• Whether we are legally required to keep it — for example payroll, tax and labour-law records — or need it to resolve disputes, including establishing, exercising or defending legal claims.

When we no longer have a legitimate need to process your personal information, we delete or anonymise it. If that is not possible, for example because it is held in backup archives, we store it securely and isolate it from any further processing until it can be deleted. When a customer’s contract ends, we make their data available for export before deleting it as set out in our agreement.

Depending on where you live, data protection laws — including the GDPR and the DPDP Act — give you certain rights over your personal data, including the right to:

• Access the personal data we hold about you, and a summary of how it is processed and who it has been shared with.
• Correct personal data that is inaccurate or incomplete, and update it.
• Erase your personal data.
• Restrict how we process your personal data.
• Receive your data in a portable format.
• Object to our processing of your personal data, including for direct marketing.
• Withdraw consent you have previously given.
• Nominate another person to exercise your rights in the event of your death or incapacity (DPDP Act).
• Have a grievance redressed, and complain to the Data Protection Board of India or your local data protection supervisory authority.

To exercise any of these rights or make a related request, contact us using the details in the Contact us section below. We may need to verify your identity first, and we respond within the time limits set by applicable law.

If your data is held in CollectivWork by your employer, please send your request to them first, as they control that data. If you contact us, we will pass your request to them and help them respond.

We may use cookies and similar technologies on our website and applications to improve your experience, understand how our services are used and make them better:

• Strictly necessary: to keep you signed in, secure the service and remember your preferences.
• Analytics: to understand how our website is used so we can improve it.
• Marketing: to measure campaigns and show relevant information about CollectivWork.

Where the law requires it, we ask for your consent before setting non-essential cookies. You can manage your cookie preferences through your browser settings at any time.

CollectivWork is a business platform and is not directed at children. We do not knowingly collect personal data of children (under 18 under the DPDP Act, or the applicable age where you live), except where an organisation lawfully processes it — for example, an employee’s dependants for insurance or benefits — with verifiable consent of a parent or lawful guardian where required. We do not track, behaviourally monitor or target advertising at children.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will tell you about significant changes through appropriate channels, and the date at the top of this page shows when it was last revised. We encourage you to review it regularly.

If you have any questions, concerns or requests about this Privacy Policy or our privacy practices — including a request to exercise your rights or a grievance about how your personal data has been handled — please get in touch. Our privacy team, acting as Grievance Officer, acknowledges requests promptly and resolves them within the timelines required by applicable law.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India or, if you are in the EU, the UK or another jurisdiction, to your local data protection supervisory authority.