Privacy & Data Protection Policy
This policy explains how AccoNova processes personal data for its website and HRMS services, the roles of AccoNova and customer organizations, processing purposes, retention, security, required processing disclosures and available rights. The applicable role may differ between website visitors and customer-controlled employee data.
Jump to Clause (8 Clauses)
1. Introduction & Scope
This policy covers personal data used for the AccoNova website, business enquiries and HRMS service. It distinguishes our direct relationship with website visitors from employee records controlled by a customer organisation. AccoNova processes personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, together with the Information Technology Act, 2000 and the rules thereunder.
For customer employee records, the employer determines purposes and instructions and AccoNova provides processing services. For website enquiries and subscription administration, AccoNova handles information to respond and manage the service. The applicable law and contractual terms determine each party’s obligations. For personal data collected on this website and in business enquiries, AccoNova is the Data Fiduciary. For employee personal data entered by a customer organisation, the customer is the Data Fiduciary and AccoNova acts as a Data Processor on the customer's instructions.
2. Personal & Employee Data We Collect
The data used depends on the workflow enabled and the information actually provided. Do not send employee identity or payroll documents through a general demo enquiry. We do not knowingly process the personal data of a child (under 18) without verifiable consent of the parent or lawful guardian, and we do not undertake tracking or behavioural monitoring of children.
| Data Category | Specific Details Processed |
|---|---|
| Employer Profile | Company legal name, registered corporate office address, GSTIN, PAN, TAN, industry classification, and primary administrator contact details. |
| Employee Personal Data | Full legal name, employee code, official/personal email, mobile number, date of birth, gender, blood group, emergency contacts, and profile photographs. |
| GPS & Attendance Logs | Attendance times and, when enabled, location or selfie evidence submitted through a supported browser. Actual collection depends on permissions and employer configuration. |
| Payroll & Statutory Data | Salary structural slabs (Basic, HRA, DA, Special Allowance), bank account number, IFSC code, Permanent Account Number (PAN), Aadhaar details (where provided for e-KYC), EPF Universal Account Number (UAN), ESIC Insurance Number (IP), and State Professional Tax classifications. |
| Document Uploads | PDFs and images of tax regimes declaration documents (Form 12BB), identity proofs, appointment letters, and expense reimbursement bills. |
3. How We Process & Use Your Information
Information supports the requested service, account administration and the customer’s configured HR workflows.
Automating salary sheets, basic pay, HRA, statutory EPF deductions, ESIC contributions, Professional Tax slabs, Labour Welfare Fund (LWF), and TDS calculation.
Provide location or selfie evidence for authorised attendance review, subject to device permissions and an exception process.
Prepare payroll reports and supported export files for employer review. A report is not a government filing acknowledgement.
Sending transactional alerts, automated salary slips, password resets, tax declaration reminders, and critical compliance deadline notices.
4. Security & Data Protection Standards
Security depends on both service controls and customer administration. If we become aware of a personal data breach, we will notify the Data Protection Board of India and the affected Data Principals in the manner required by the Digital Personal Data Protection Act, 2023.
Role-based access and protected connections help limit access to records. Review account roles, keep credentials private and use the Security page to request relevant controls information. This notice does not claim independent certification or guaranteed encryption specifications.
5. Third-Party Integrations & Data Sharing
Service delivery can involve external providers and legally required disclosures. Customers can request relevant processing disclosures through the DPA and security review process.
6. Retention, return and deletion
Retention is purpose-specific. This policy does not impose one universal statutory period on all records or promise an unverified deletion deadline.
- Website enquiries: Ask hello@acconova.in about access, correction or deletion of information submitted in an enquiry.
- Customer employee records: The employer controls its retention instructions, subject to applicable obligations and the processing agreement. Employees should contact their employer first.
- Account closure: Before ending a subscription, export needed records and agree data return, deletion and any continuing retention with support.
- Legal and operational needs: Some billing, security or other records may need to be retained for their applicable purpose or obligation. The scope should be confirmed for the request.
7. Your Rights & Consent Controls (DPDP Act, 2023)
You may exercise your rights as a Data Principal under the Digital Personal Data Protection Act, 2023. Contact AccoNova about website and business-contact data; for employee data in a customer workspace, direct requests to the employer's administrator so the request can be assessed against its responsibilities.
- Request access to or correction of information relevant to your account.
- Ask about deletion, retention or a processing concern, subject to applicable obligations.
- Review browser location and camera permissions. Ask your employer about an alternative attendance process if a required permission is unavailable.
- Provide enough identifying context to locate the request, without sending passwords or unnecessary identity documents.
- Right to access: obtain a summary of the personal data we process and the identities of the Data Fiduciaries with whom it has been shared.
- Right to correction and erasure: request correction, completion or updating, and erasure of data that is no longer required.
- Right to grievance redressal: raise a concern with the Grievance Officer below, and escalate to the Data Protection Board of India if it is not resolved.
- Right to nominate: nominate another person to exercise your rights in the event of your death or incapacity.
- Right to withdraw consent: withdraw consent at any time; processing then stops unless a legal obligation requires otherwise.
8. Grievance Officer and complaints
For a privacy concern, include the affected website or workspace and a description of the request. In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the Grievance Officer for AccoNova is designated below. A complaint is acknowledged within 24 hours and resolved within 15 days. If it is not resolved, you may escalate it to the Data Protection Board of India as provided under the DPDP Act, 2023.