LAZYMONKEYAI HRMS — ENTERPRISE PRIVACY POLICY

SECTION 1: EXECUTIVE GOVERNANCE & STATUTORY SCOPE

This Privacy Policy constitutes an official, legally binding document detailing the operational, organizational, technical, and regulatory controls implemented by LazyMonkeyAi Technologies in collecting, processing, storing, transmitting, and erasing personal, operational, biometric, financial, and telemetric data managed within the LazyMonkeyAi Human Resource Management System (HRMS) ecosystem.

LazyMonkeyAi HRMS operates as a multi-tenant enterprise software platform providing integrated Human Capital Management (HCM), automated Applicant Tracking Systems (ATS), geofenced shift clock-in validation, payroll processing, statutory tax compliance, 360-degree performance evaluation matrices, SCORM-compliant video learning management systems, and workforce analytics. This document applies to all enterprise tenant administrators, active employees, former staff members, external job candidates, contingent contractors, and system operators accessing the system across native iOS, Android, and web client interfaces.

SECTION 2: MULTI-TENANT ARCHITECTURE & DATA ISOLATION MODELS

LazyMonkeyAi HRMS is engineered upon a strictly isolated multi-tenant architecture designed to guarantee logical data segregation across corporate clients. Every database transaction, API call, and file storage reference incorporates a mandatory tenant identifier (tenant_id).

• Row-Level Security (RLS): PostgreSQL relational schemas enforce strict tenant isolation rules. Data from Tenant A is logically segregated and inaccessible to Tenant B under all execution paths.
• Role-Based Access Control (RBAC): System authorization enforces granular permission scopes (view:hrms, manage:payroll, manage:recruitment). Users possess access rights strictly matching their assigned corporate roles.
• Tenant Ownership Rights: The subscribing enterprise corporate entity retains full ownership of all workforce data uploaded to or generated within their dedicated tenant partition.

SECTION 3: COMPREHENSIVE DATA TAXONOMY & COLLECTED ATTRIBUTES

LazyMonkeyAi HRMS collects and processes specific data elements strictly necessary to execute workforce operations, legal mandates, and security protocols:

3.1 Employee Demographic & Identity Attributes

• Core Workforce Attributes: Legal full name, official employee code, corporate email address, contact phone number, job title, department assignment, physical work location, joining date, reporting manager hierarchy, employment type (Full-Time, Part-Time, Intern, Contractor), and shift schedules.
• Self-Service Profile Attributes: Personal profile photograph, permanent and temporary residential addresses, emergency contact directory, date of birth, gender, marital status, and blood group.

3.2 Geofencing & Geolocation Coordinates

• Point-in-Time Geofence Verification: Geographic latitude, longitude coordinates, and GPS accuracy radius captured at the precise moment an employee submits a Clock-In, Clock-Out, WFH check-in, or remote site check-in request.
• Zero Passive Background Monitoring: Location coordinates are evaluated strictly at the instant of active submission. The app does never track, record, or transmit user location passively in the background.

3.3 Local Biometric Hardware Authentication Tokens

• Local Enclave Verification: Fingerprint (Touch ID) and facial recognition (Face ID / Android Biometrics) authenticate user identity locally on the mobile device via OS hardware enclaves (iOS Secure Enclave / Android Keystore).
• Zero Biometric File Upload: Raw biometric image files, fingerprint templates, or facial vector maps are never transmitted to, processed by, or stored on LazyMonkeyAi servers.

3.4 Compensation, Tax & Banking Records

• Financial & Statutory Profiles: Beneficiary bank account number, IFSC code, bank name, Permanent Account Number (PAN), Aadhaar number (where mandated by local statutes), tax regime elections, basic salary, HRA, special allowances, Provident Fund (PF) account details, ESI numbers, and Form 16 certificates.

3.5 Recruitment & Applicant Candidate Data

• ATS Candidate Attributes: Applicant full name, personal email address, phone number, work experience history, educational qualifications, portfolio links, interview evaluation scores, and offer letter terms.
• Document OCR Artifacts: Uploaded PDF, DOCX, and TXT candidate resume files processed by automated Optical Character Recognition (OCR) engines for skill extraction.

3.6 Technical Telemetry & System Audit Logs

• Audit Trail Telemetry: Client IP address, device hardware model, operating system version, browser user-agent string, session tokens, and timestamped user action logs (login, attendance clock-in, payroll execution, document access).

SECTION 4: LAWFUL PROCESSING BASES UNDER GLOBAL REGIMES

LazyMonkeyAi HRMS processes personal and organizational data strictly under recognized international legal frameworks (GDPR, CCPA, IT Act 2000):

• Performance of Employment Contract: Executing core employment functions, managing attendance logs, processing leave balances, calculating compensation, and disbursing monthly salary slips.
• Statutory Legal Compliance: Fulfilling mandatory tax withholdings (TDS), Provident Fund (PF) contributions, Employee State Insurance (ESI) filings, and statutory workplace audit requirements.
• Legitimate Business Interests: Streamlining recruitment talent acquisition, validating geofenced work site attendance, preventing proxy attendance fraud, maintaining system audit trails, and generating workforce analytics.
• Explicit Consent: Processing voluntary candidate job applications and optional self-service profile fields.

SECTION 5: GEOFENCING, GPS ACCURACY & SPATIAL PRIVACY CONTROLS

5.1 Geofenced Clock-In Verification Rules

To ensure workforce integrity without compromising personal employee privacy, LazyMonkeyAi HRMS enforces point-in-time geofence validation. When an employee taps 'Clock In', the mobile application queries device GPS hardware to obtain current latitude and longitude coordinates. These coordinates are evaluated against authorized office perimeter radiuses (e.g., 100 meters). Once the geofence calculation completes, the coordinates are saved alongside the timestamp as an immutable attendance verification record.

5.2 Spatial Privacy Safeguards

• No Continuous Tracking: The app does not request or consume background location permissions (ACCESS_BACKGROUND_LOCATION).
• User Visibility: Employees receive clear on-screen indicators and OS permission prompts prior to location access.

SECTION 6: LOCAL BIOMETRIC HARDWARE AUTHENTICATION ARCHITECTURE

6.1 Hardware-Backed Local Tokenization

Mobile user authentication supports hardware biometric unlock (Touch ID / Face ID) via native secure authentication APIs. Biometric verification is executed entirely inside the local device hardware enclave. Upon successful verification, the OS returns a cryptographic confirmation token allowing the application to unlock locally stored AES-256 encrypted JWT access tokens.

6.2 Absolute Server Isolation

LazyMonkeyAi backend servers do not receive, store, or process biometric data. The platform relies on local OS hardware APIs, guaranteeing that employee biometric templates remain 100% contained within the user's physical device.

SECTION 7: AI RESUME OCR, MACHINE LEARNING ETHICS & APPLICANT PRIVACY

7.1 Automated Candidate Document Processing

Candidate resumes submitted to the recruitment module undergo automated text extraction via Optical Character Recognition (OCR) engines. Extracted text is processed by machine learning algorithms to identify core parameters: candidate name, contact email, phone number, technical skill tags, years of experience, and educational background.

7.2 Non-Bias & Algorithmic Fairness Standards

• Objective Keyword Scoring: AI match scores reflect alignment between candidate technical skills and job requirements.
• Demographic Exclusion: Machine learning models do not incorporate demographic, gender, age, or ethnic variables into match calculations, mitigating bias in candidate evaluation.
• Human-in-the-Loop Governance: AI match scores serve solely as assistive sorting tools. Final hiring decisions remain strictly under human HR manager discretion.

SECTION 8: PAYROLL, STATUTORY TAXATION & BANKING SECURITY

8.1 Compensation Data Security

Payroll calculations involve sensitive compensation structures including basic pay, house rent allowance (HRA), statutory deductions (PF, ESI, Professional Tax, TDS), and net payout amounts. All compensation records are stored in encrypted database schemas.

8.2 Banking Direct Disbursement Protocols

• Encrypted File Generation: Bulk payroll execution generates standardized NEFT/RTGS batch transfer files formatted for major banking gateways (HDFC, ICICI, Axis Bank).
• Automated Audit Logging: Every payroll execution event records the executing admin user ID, timestamp, total disbursement amount, and batch checksums.

SECTION 9: LEARNING MANAGEMENT SYSTEM (LMS) TELEMETRY

The integrated Learning Management System (LMS) processes course enrollment records, video lesson playback timestamps, SCORM package completion percentages, quiz scores, and course completion certificates. LMS telemetry is utilized strictly to evaluate employee skill development and manage corporate training compliance.

SECTION 10: SUB-PROCESSORS, CLOUD HOSTING & THIRD-PARTY AUDIT

LazyMonkeyAi HRMS strictly prohibits selling, renting, or trading personal data to third-party advertisers. Data is shared exclusively with audited infrastructure sub-processors under executed Data Processing Agreements (DPAs):

• Cloud Database & Hosting Infrastructure: Amazon Web Services (AWS) and Google Cloud Platform (GCP) ISO 27001 and SOC 2 Type II certified data centers hosting encrypted PostgreSQL database clusters.
• Banking Transfer Gateways: Automated batch transfer file generation for direct salary disbursement via corporate banking channels.
• Transactional Communication Providers: Secure SMTP email gateways for transmitting payslips, candidate offer letters, login verification codes, and system alerts.

SECTION 11: CRYPTOGRAPHIC STANDARDS & STORAGE ARCHITECTURE

11.1 Encryption in Transit

All network communication between mobile/web clients and server endpoints enforces mandatory TLS 1.3 encryption with HTTP Strict Transport Security (HSTS). Legacy TLS versions (1.0, 1.1) are disabled.

11.2 Encryption at Rest

Database storage volumes, object stores, and backup snapshots enforce AES-256 Transparent Data Encryption (TDE). Database passwords and sensitive API keys are stored in encrypted key vaults.

11.3 Mobile Local Client Security

Mobile client access tokens (JWT Bearer tokens) are encrypted locally using AES-256 GCM within the OS keychain (KeyStore on Android, Keychain on iOS). Tokens expire after short durations and require re-authentication.

SECTION 12: DATA RETENTION, ARCHIVAL & DESTRUCTION LIFECYCLES

12.1 Statutory Retention Schedules

• Active Employee Records: Retained for the duration of employment plus 7 years post-exit for statutory tax, Provident Fund, and labor compliance audit requirements.
• Candidate Recruitment Data: Retained for 24 months from application date for active talent pool matching, unless deletion is explicitly requested earlier.
• System & Audit Logs: Retained for 3 years to comply with enterprise security audit standards.

12.2 Secure Destruction Protocols

Upon expiration of statutory retention periods or validated erasure requests, data is permanently overwritten using cryptographic erasure techniques adhering to NIST SP 800-88 standards.

SECTION 13: STATUTORY USER DATA RIGHTS (GDPR & ISO STANDARDS)

In alignment with international data privacy legislation (GDPR, ISO/IEC 27001, CCPA, and statutory employment laws), employees and job candidates possess the following enforceable data rights:

• Right of Access & Inspection: Direct self-service access to inspect personal profile data, attendance history, leave balances, performance ratings, and monthly payslips.
• Right to Rectification: The ability to request updates or corrections for incomplete or inaccurate personal records via employee self-service tools or HR administrator review.
• Right to Erasure ("Right to be Forgotten"): Candidates may request deletion of non-statutory ATS recruitment records upon conclusion of hiring processes.
• Right to Restriction of Processing: The right to request temporary restriction of personal data processing during active dispute resolutions.
• Right to Data Portability: Employees may export their payslip documents, tax certificates (Form 16), and personal profile attributes in standardized PDF or CSV formats.

SECTION 14: INCIDENT MANAGEMENT & BREACH RESPONSE

LazyMonkeyAi HRMS operates a 24/7 Security Incident Response procedure. In the event of a confirmed security incident impacting personal data, LazyMonkeyAi will execute immediate infrastructure containment and notify tenant administrators and regulatory authorities within 72 hours of breach confirmation.

SECTION 15: CUSTOMER SUPPORT & LEGAL CONTACT INFORMATION

For all customer support inquiries, technical assistance, privacy inquiries, data access requests, compliance audits, or data deletion requests, please contact our dedicated Customer Support team: