Your data, and
exactly what we do with it.

DenwaysHR is a human resources platform operated by Denways Technologies LLP (LLPIN ACY-3781), registered office Varkala, Thiruvananthapuram, Kerala 695310, India. This policy explains how we handle personal data across the platform and this website.

There are two distinct relationships to keep separate. When an employer uses DenwaysHR to manage its workforce, that employer decides what employee data is collected and why, and we process it on their instructions. When you visit this website or contact us about buying the product, we decide how that information is used ourselves.

If you are an employee of a company that uses DenwaysHR and you want your record corrected or removed, your employer is the right first point of contact. We will support them in acting on your request.

The platform holds the data an employer needs to run its HR, attendance and payroll operations. The exact fields depend on which modules that employer has switched on.

We process personal data to deliver the platform to the employer that engaged us, and for no unrelated purpose. That means running attendance and leave, calculating and disbursing payroll, generating statutory files such as wage protection submissions, and producing the reports an employer needs.

We also process a limited set of data to keep the service secure and working: authentication, rate limiting, intrusion detection, audit logging, error and uptime monitoring, and backups.

We do not sell personal data. We do not use employee data held on behalf of an employer to train models or to market to their staff.

Each customer organization's data is scoped and isolated at the database level, and an organization identifier supplied by a browser is never trusted to decide which organization's data is returned. Row-Level Security in the database enforces the same boundary independently of the application.

Inside an organization, access follows the roles that organization configures. Managers see their own reporting line and branch managers see their own branch, rather than the whole company.

Sensitive actions, including role changes, salary changes, payroll disbursement and administrative impersonation, are recorded in an audit log with the person who acted, what they touched and when.

We share personal data only where it is needed to run the service, meet a legal obligation, or where the employer instructs us to.

Service providers that process data on our behalf include our hosting and infrastructure providers, our network and security provider, and our payment processor. Each is bound to handle the data only for the purposes we set.

Where an employer uses payroll, files are generated for submission to the relevant wage protection system and to that employer's bank. Those submissions are made by, and on the instruction of, the employer.

We may disclose data where we are legally required to, and we will tell the affected employer unless we are prohibited from doing so.

Employee data is retained for as long as the employer's account is active, and afterwards for the period that employer's own retention obligations require. Employment, payroll and statutory records typically have to be kept for a defined period under local labour law, and deletion cannot run ahead of that.

When an account closes, we work with the employer to return or delete data according to their instruction and their legal obligations. Encrypted backups age out on their own schedule.

The fields that would do the most harm if exposed, including bank account details and government identifiers, are encrypted at rest in the database rather than only being placed behind an access check. Sensitive media such as attendance selfies and uploaded documents is served through signed links that expire, and uploaded files are scanned by an antivirus engine before they are trusted.

Sessions use HTTP-only, secure cookies that page scripts cannot read, every cookie-authenticated request carries cross-site request forgery protection, and authentication endpoints are rate limited. Production sits behind a network edge that provides managed firewall rules, denial-of-service protection and bot mitigation, and the origin accepts no direct public traffic.

The security page sets out the full list of controls currently in production.

Depending on where you live, you may have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form.

If your data is held by an employer using DenwaysHR, contact that employer first, since they decide what happens to their records. If we hold data about you as a prospect or website visitor, contact us directly and we will respond.

Every employee also has self-service access inside the product to their own attendance history, leave balances, payslips and personal record.

The application uses cookies that are necessary to run it, principally the HTTP-only session cookie that keeps you signed in and the token used for cross-site request forgery protection. These cannot be switched off without breaking sign-in.

Where we use anything beyond strictly necessary cookies on this website, we will say so and ask for consent before setting them.

Our infrastructure and service providers may process data outside the country your organization operates in. Where that happens, we rely on appropriate safeguards with each provider and limit them to processing the data for the purposes we set.

If your organization has a data residency requirement, raise it with us before you sign, so we can tell you what we can and cannot commit to.

We update this policy when our practices change. The date at the top of the page always reflects the current version, and we will notify account administrators of material changes rather than relying on you to re-read it.

Privacy questions, data requests and complaints can be sent to info@denways.com. Security reports should go to info@denways.com.

If you are an employee of a company that uses DenwaysHR, your employer remains the right first point of contact for anything about your own record.