Vinkso HRMS & Payroll ("Vinkso", the "Service") is a cloud-based human resources, attendance and payroll platform operated by Vinkweb Infotech FZCO registered address in Dubai, UAE] ("we", "us", "our"). If you contract Vinkweb Infotech PVT LTD India for any development and enhancement of the product or service

This Privacy Policy explains what personal data we collect through the Service, our website Vinkso and our mobile apps, why we collect it, who we share it with, and the rights you have. It is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and India's Digital Personal Data Protection Act, 2023 and the rules made under it.

Our role: controller and processor

We play two different roles, and which one applies depends on whose data it is.

Data :

Employee and HR records your organisation uploads or creates in Vinkso (payroll,attendance, leave, performance, recruitment)

Whose decision : Your employer (ourcustomer)

Our role : Processor (UAE) / Data Processor (India). We act only on the customer's documented instructions.

Data :

Account, billing and contact details of the people who sign up for, buy or administer Vinkso

Whose decision : Vinkweb Infotech

Our role : Controller (UAE) / DataFiduciary (India)

Data :

Website visitors, demo requests, support andsales enquiries

Whose decision : Vinkweb Infotech

Our role : Controller (UAE) / DataFiduciary (India)

Information we collected

3.1 Employee data processed for our customers

What we hold depends on the modules your employer switches on. It may include:

Identity and contact

Examples : Name, employee ID, photo, date of birth, gender, nationality, address, phone, email, emergency contacts

Government identifiers

Examples : Emirates ID, passport, visa and labour card details (UAE); PAN, Aadhaar (where provided), UAN, ESIC number (India)

Employment

Examples : Job title, department, manager, joining and exit dates, contract terms, documents

Pay and banking

Examples : Salary, allowances, deductions, bank account and IBAN, WPS/SIF records, end-of-service gratuity, GPSSA contributions, EPF, ESI, PT, LWF and TDS details, Form 16 / 24Q data

Time and attendance

Examples : Clock-in/out times, shifts, leave balances and requests, overtime

Location

Examples : GPS location at clock-in, geofence events and, if the field force module is enabled, location during working hours. Location is not tracked outside the employer's configured working hours or geofences

Performance and learning

Examples : Goals, OKRs, reviews, 360-degree feedback, course progress

Recruitment

Examples : CVs, application answers, interview notes and, if enabled, recorded video interviews and transcripts

Expenses and visitors

Examples : Expense claims and receipts; visitor names and visit logs

Sensitive data

Examples : Only where the employer configures it and the law allows: health or medical leave certificates, disability status, religion (for UAE leave entitlements)

3.2 Customer account and business data

Name, work email, phone, company name, trade licence or GST details, billing address, plan and payment records. Card payments are handled by our payment provider; we do not store full card numbers.

3.3 Data collected automatically

IP address, device and browser type, app version, log-in times, pages and features used, error logs and crash reports. We collect this to run, secure and improve the Service.

3.4 Communications

Emails, WhatsApp messages, support tickets, chat and call recordings when you contact us. We tell you before a call is recorded.

How we use information

Employee data is used only to provide the Service to the employer: running payroll, generating payslips and statutory files (WPS/SIF, ECR, Form 24Q, FVU and similar), managing attendance, leave, performance and recruitment, and producing reports. The employer is responsible for having a lawful basis, such as performance of the employment contract, compliance with labour and tax law, or consent where required.

Purpose :

Create and manage your account, provide support, bill you

Legal basis :

Performance of our contract with you

Purpose :

Keep the Service secure, detect fraud and abuse, keep audit logs

Legal basis :

Legitimate use and legal obligation

Purpose :

Meet tax, accounting and regulatory duties

Legal basis :

Legal obligation

Purpose :

Improve features using aggregated, de-identified usage data

Legal basis :

Legitimate interest

Purpose :

Send product news and marketing emails or WhatsApp messages

Legal basis :

Consent, which you can withdraw at any time

AI features and automated processing

Vinkso includes AI assistants that help with tasks such as screening CVs, transcribing and summarising video interviews, drafting performance review summaries, answering HR policy questions and flagging payroll anomalies.

Human in loop

AI outputs are suggestions. Hiring, dismissal, pay and performance decisions are made by people at the employer, not by Vinkso automatically.

No training on your data

We do not use customer or employee data to train AI models, and our AI providers are contractually barred from doing so

Customer control

Admins can switch off individual AI features. Candidates must be told before a video interview is recorded or analysed.

Processing location

AI requests may be processed by the providers listed in section 6, including outside the UAE and India.

Who we share data with

We share personal data only with:

• Your employer and the users they authorise, according to the roles and permissions they set.

• Sub-processors who help us run the Service, under written contracts that require confidentiality and security.

• Banks, exchange houses and government portals when the employer instructs us to generate or submit files, such as WPS salary files, GPSSA, EPFO, ESIC or income tax filings.

• Integrations the customer turns on, such as accounting or ERP systems, email or WhatsApp.

• Authorities when the law requires it, such as a court order or a regulator's lawful request.

• A buyer or successor if we are involved in a merger, acquisition or asset sale, under the same protections.

Current sub-processors

Provider :

AWS

Purpose :

Cloud hosting, databases, backups

Location :

UAE

Provider :

Amazon Web Services (SES)

Purpose :

Transactional email

Location :

United States of America

Provider :

Meta (WhatsApp Business Platform)

Purpose :

WhatsApp notifications and support

Location :

Global

Provider :

Groq

Purpose :

AI model inference

Location :

United States

Provider :

Ziina

Purpose :

Subscription billing

Location :

UAE

Where data is stored and international transfers

Customer data is stored in UAE, and each customer's data is kept logically separate from other customers'. Our engineering and support team is based in India and may access data to provide support or fix issues, under strict access controls.

Where personal data moves outside the UAE or India, we rely on the transfer mechanisms each law allows: transfers to countries with adequate protection, contractual safeguards with the recipient, or the consent of the person concerned where required. We do not transfer data to any country the Government of India has restricted under the DPDP Act.

How long we keep data

When data is no longer needed, we delete it or make it permanently anonymous.

Data :

Employee data in an active subscription

Retention :

As long as the employer keeps it in Vinkso, subject to their own retention settings

Data :

Employee data after a subscription ends

Retention :

Available for export for 30 days, then deleted from live systems within 60 days and from backups within 90 days

Data :

Payroll, tax and statutory records

Retention :

As long as the employer instructs, typically the period required by UAE and Indian labour and tax law

Data :

Customer account and billing records

Retention :

Life of the account plus 5 years for tax and accounting purposes

Data :

Recruitment data for unsuccessful candidates

Retention :

12 months unless the employer sets a shorter period or the candidate asks for deletion

Data :

Security and audit logs

Retention :

3 months

Data :

Marketing contacts

Retention :

Until you unsubscribe or withdraw consent

Security

We protect personal data with technical and organisational measures appropriate to HR and payroll data, including:

• Encryption in transit (TLS 1.2+) and at rest

• Separate database schemas per customer

• Passwordless and multi-factor sign-in, role-based access and least-privilege access for our staff

• Audit logs of access to sensitive records

• Regular backups, vulnerability testing and staff confidentiality agreements

No system is completely secure. If a personal data breach affects you, we will notify the affected customer without undue delay and, where we are the controller or fiduciary, notify the UAE Data Office, the Data Protection Board of India and affected individuals as the law requires. Customers remain responsible for keeping their users' log-in details safe.

Your rights

Depending on where you are, you may have the right to:

• Access the personal data held about you and get information about how it is used

• Correct inaccurate or incomplete data

• Delete data that is no longer needed, unless the law requires us or your employer to keep it

• Withdraw consent where processing is based on consent, without affecting processing already done

• Object to or restrict certain processing, including direct marketing

• Data portability, meaning a copy of your data in a usable format (UAE)

• Nominate another person to exercise your rights if you die or become incapacitated (India)

• Grievance redressal and, if you are unhappy with our response, to complain to the UAE Data Office or the Data Protection Board of India

How to make a request. Employees should contact their employer first (see section 2). Anyone else can email pradapsingh@vinkweb.com. We may need to verify your identity, and we will reply within 30 days or the shorter period the law requires.

Children's data

Vinkso is a business service and is not meant for anyone under 18. If an employer stores data about a child, such as a dependant for benefits or insurance, the employer is responsible for obtaining verifiable parental consent where required.

Our website and web app use essential cookies to keep you signed in and secure, and analytics cookies to understand usage. You can manage non-essential cookies through our cookie banner or your browser settings.

Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new "Last updated" date and, for material changes, notify customer admins by email or in the app at least 14 days in advance.