Plain-English summary: Octal HR is a B2B platform. Your company (the "Customer") controls the employee data it uploads. We process it only on your instructions and never sell it. You always own your data.
1. Introduction
Octal HR ("we", "us", "our") operates the Octal HR HR management platform, available at octalhr.com and related subdomains. This Privacy Policy explains how we collect, use, disclose, and safeguard information when your organisation uses our services.
We act as a data processor for the personal data of your employees, and as a data controller for account-holder and website visitor data. By using Octal HR, your organisation agrees to the practices described in this Policy.
This Policy is governed by and construed in accordance with the laws of the Islamic Republic of Pakistan, including applicable provisions of the Prevention of Electronic Crimes Act 2016 (PECA) and the Personal Data Protection Bill where in force.
2. Information We Collect
2.1 Account & Administrator Information
When your organisation signs up, we collect:
- Organisation name, business type, and size
- Administrator name, email address, and phone number
- Billing details (name, address, payment method — card data is tokenised by our payment processor)
- Login credentials (passwords are hashed and salted; we never store plaintext)
2.2 Employee Data (Customer-Controlled)
Your organisation uploads and manages employee records through the platform. This data may include:
- Full name, national ID number, date of birth, gender
- Contact details (phone, email, address)
- Employment details (department, designation, joining date, salary structure)
- Attendance, leave balances, and biometric check-in/out times
- Payroll information (salary, deductions, social security contributions, income tax)
- Loan records, repayment schedules, and advance history
- Survey responses (anonymous or attributed, depending on your configuration)
- Performance reviews and goal records (when the Performance module is active)
- Emergency contact details and bank account numbers for payroll disbursement
We process this data solely on your instructions as documented in our Data Processing Agreement.
2.3 Usage & Technical Data
We automatically collect technical data when you interact with Octal HR:
- IP address, browser type, operating system
- Pages visited, features used, session duration
- Error logs and crash reports (no personal employee content is included)
- Cookie and tracking data (see our Cookie Policy)
3. How We Use Your Information
We use collected information for the following purposes:
3.1 Providing the Service
- Processing payroll calculations, generating payslips, and producing bank transfer files
- Tracking attendance, leave balances, and shift schedules
- Calculating and applying loan repayments and salary deductions
- Generating HR reports and analytics for your HR and finance teams
- Authenticating users and enforcing role-based access controls
3.2 Communications
- Sending transactional emails (payslip notifications, leave approvals, loan statements)
- Sending service announcements, maintenance notices, and security alerts
- Responding to support tickets and demo requests
3.3 Product Improvement
- Analysing aggregated, anonymised usage patterns to improve the platform
- Running internal A/B tests on new features (no personal employee data is used)
- Monitoring performance and diagnosing technical issues
3.4 Legal & Compliance
- Fulfilling tax and regulatory obligations (tax-authority compliance, social-security filings)
- Responding to lawful requests from competent government authorities
- Enforcing our Terms of Service and protecting against fraud or abuse
4. Sharing & Disclosure
We do not sell, rent, or trade personal data. We share information only in the following circumstances:
4.1 Sub-Processors
We engage trusted sub-processors to help us deliver the service. These include cloud infrastructure providers (data hosted in compliant regional data centres), email delivery services, and payment processors. All sub-processors are bound by data protection agreements and are listed in our Sub-Processor Register (available on request at info@octalhr.com).
4.2 Within Your Organisation
Data is accessible to administrators and users within your organisation according to the roles and permissions you configure. You control who can view payroll, employee records, or leave data.
4.3 Legal Requirements
We may disclose information where required by applicable law, court order, or governmental authority. We will notify you of such requests where legally permitted to do so.
4.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, customer data may be transferred to the acquiring entity, subject to the same data protection obligations.
5. Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit: All data between your browser and our servers is encrypted via TLS 1.2+
- Encryption at rest: Database backups and sensitive fields (national ID, bank accounts) are encrypted at rest using AES-256
- Access controls: Role-based permissions, two-factor authentication support, and session timeouts
- Audit logs: All data access and modifications are logged for accountability
- Regular backups: Automated daily backups with point-in-time recovery capability
- Penetration testing: Annual security assessments by independent third parties
Despite these measures, no system is completely secure. In the event of a data breach affecting your organisation, we will notify you within 72 hours of becoming aware of the incident.
6. Data Retention
We retain data for as long as your subscription is active and as required by applicable law:
- Employee records: Retained for the duration of your subscription plus 7 years (to satisfy tax-audit requirements)
- Payroll data: Retained for 7 years per Income Tax Ordinance 2001 requirements
- Attendance logs: Retained for 3 years after creation, or until you delete them
- Deleted employee records: Purged from production systems within 30 days of deletion; removed from backups within 90 days
- Account data: Retained for 90 days after subscription cancellation, then permanently deleted
You may request earlier deletion of specific data categories by contacting info@octalhr.com, subject to legal retention requirements.
7. Your Rights
As a Customer (organisation), you have the following rights with respect to the data you upload:
- Access: Export all your organisation's data at any time via the Reports module in CSV/Excel format
- Correction: Update or correct any employee record directly within the platform
- Deletion: Delete employee records; we will purge them from our systems per the retention schedule above
- Portability: Export all data in standard formats before cancelling your subscription
- Restriction: Restrict processing of specific data categories by contacting our support team
Individual employees may contact your HR administrator to exercise rights over their personal data. We process employee data only on your instructions as the data controller.
To exercise any right or make a privacy inquiry, email: info@octalhr.com
8. Third-Party Services
Octal HR may integrate with third-party services at your request (e.g., biometric device APIs, accounting software, ERP systems). When you enable an integration:
- Data shared with that service is governed by that service's privacy policy
- You are responsible for ensuring the integration is authorised by your employees where required
- We are not responsible for the data practices of third-party services
Our website uses Google Analytics to understand aggregate traffic. This data is anonymised and does not include employee data from the platform.
9. International Data Transfers
Octal HR stores and processes data in compliant regional data centres. Where data must be transferred across borders (e.g., for cloud backups or sub-processor services), we ensure that equivalent data protection standards are maintained through contractual safeguards.
If you require data residency in a specific region, contact us to discuss an Enterprise arrangement.
10. Children's Privacy
Octal HR is a business-to-business platform intended for use by organisations and adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor's data has been uploaded to our platform, please contact us immediately.
11. Policy Updates
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Post the updated policy on this page with a new "Last Updated" date
- Send an in-app notification to all administrators
- For significant changes, email all account owners at least 14 days before the change takes effect
Continued use of Octal HR after the effective date of changes constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related questions, data requests, or to report a concern: