Privacy Notice & Data Processing Terms
Version 2026-09 · Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025
1. Who we are and our role
ShramSaathi is a startup of DigiTradeExpert (Maihar, Madhya Pradesh).
- Employee and worker data: the employer, contractor or principal employer that uploads the data is the Data Fiduciary. ShramSaathi is the Data Processor and processes the data only on the employer's instructions and for the purposes below.
- Account, login and billing data of organisations and their users: ShramSaathi is the Data Fiduciary.
- Consultants act on behalf of their client organisations. A principal employer sees a contractor's workmen and wage registers only for its own site, once the contractor links its account.
2. Personal data processed
Identity and employment details (name, father's/spouse's name, date of birth, gender, employee code, designation, category of employment, dates of joining and exit), contact details (mobile, email, address, emergency contact), statutory numbers (UAN, ESIC IP, and only the last 4 digits of Aadhaar), bank account and IFSC (encrypted at rest), attendance, wages, deductions, overtime, service record, photograph (for the identity card), nominee, grievances, and access logs.
3. Purposes and basis
Employment administration; payment of wages and issue of wage slips; statutory registers, records, returns and documents under the Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the OSH Code, 2020, plus the Central and State Rules; principal employer oversight of contract labour; and grievance redressal. This processing relies on the legitimate uses under Section 7 of the Act, including for the purposes of employment and for compliance with law. Any optional use (for example, non-statutory communications) will be based on consent, which can be withdrawn.
4. Who can see what (authorised access)
| Person | Access |
|---|---|
| Employee / worker | Own profile, payslips, attendance, letters, service card, grievances, data requests. Can submit corrections for employer verification. |
| Employer admin / editor | Own organisation's records. Imports wages, issues documents, approves corrections, answers requests. |
| Viewer (e.g. auditor) | Read-only view of own organisation's registers. |
| Principal employer | Linked contractor's workmen and wage registers for its own establishment only. Bank and Aadhaar are masked. |
| Consultant | Only the client organisations it manages. |
| ShramSaathi Super Admin | Organisation, subscription and plan data. No routine access to employee records. Technical access only for support or security, and it is logged. |
5. Storage, security and integrations
- Hosted on servers selected in the India region. All traffic uses HTTPS. Bank account numbers and cloud credentials are encrypted (AES-256-GCM or XSalsa20-Poly1305). PINs and passwords are hashed.
- Role-based access, account lock-out after repeated failed sign-ins, and an audit trail of access and changes, kept for at least one year.
- Employers may export or back up their own data to their OneDrive/SharePoint, Amazon S3 (Mumbai/Hyderabad) or an S3-compatible store in India. By default, exports go only to India regions and are password-encrypted (AES-256 ZIP).
6. Retention and erasure
Wage, overtime and attendance records are kept for 5 years, as required under the Code on Wages (Central) Rules, 2026, or longer where State rules or pending proceedings require it. After that, the employer can erase personal data. Wage figures are then kept only in anonymised form.
7. Your rights
You can ask for a summary of your personal data (s.11), correction, completion, updating or erasure (s.12), grievance redressal (s.13), and nomination of a person to exercise your rights (s.14). Workers can do this from My Data & Privacy in the employee portal. Anyone can also write to the contact below. Requests are answered within 90 days. If you are not satisfied, you may approach the Data Protection Board of India.
8. Personal data breach
If there is a personal data breach, we will inform the affected employer organisations without delay. The Data Protection Board and affected Data Principals will be informed as required by the DPDP Rules, 2025.
9. Contact / grievance
Grievance Officer, ShramSaathi · info@shramsaathi.in · Algorithus Private Limited, Lucknow, Uttar Pradesh
10. Data Processing Terms (for employer organisations)
- The organisation (Data Fiduciary) instructs ShramSaathi (Data Processor) to process employee personal data only to provide the service described above.
- The organisation confirms it has a lawful basis and has given employees the required notice. It is responsible for the accuracy of the data it uploads.
- ShramSaathi will keep the data confidential, apply reasonable security safeguards, keep logs, and not use the data for any other purpose (including advertising or model training).
- ShramSaathi will notify the organisation of any personal data breach without delay and will help with intimation to the Board and to Data Principals.
- ShramSaathi will support the organisation in answering Data Principal requests. The portal gives employees self-service access and correction.
- When the subscription ends, the organisation can export its data. ShramSaathi deletes it after the grace period, unless law requires it to be retained.
- Sub-processors: the hosting provider (India region), and the payment gateway (Razorpay) for billing data only. Cloud destinations the organisation configures remain under the organisation's control.
This notice is published in English. A Hindi summary is shown to workers in the employee portal. The notice should be reviewed by your legal adviser before go-live.