Privacy Policy

1. Who we are

agnihr is a contract labour management platform operated by Noetic Laboratories (OPC) Private Limited (“Noetic Laboratories”, “we”, “us”), CIN U62012TN2025OPC186728. This policy explains how we handle personal data on our website and platform.

For our customers' contract worker data, we generally act as a data processor and process it on the customer's documented instructions. The customer is the data fiduciary / controller. For user account details and website visitor data, we act as the controller.

2. Scope

This policy covers personal data processed through the agnihr website and application. Where we process data on a customer's behalf, that processing is also governed by the agreement between Noetic Laboratories and that customer.

3. Information we collect

Depending on how you interact with us, we process:

• Account & user data: name, work email, phone, role and organisation of the people who use the platform.
• Worker & compliance data (on behalf of customers): worker identity and employment details, attendance, wages, deductions and statutory contributions (PF, ESI, PT, LWF), and related documents.
• Usage & technical data: device, browser, IP, log and diagnostic data, and essential cookies needed to run the service.
• Communications: messages you send us (e.g. walkthrough requests, support).

4. Our role: controller vs processor

We are the controller for our own users' account data, website data and communications. We are a processor for the contract worker and wage data that customers enter or upload. We use it only to provide the service and on the customer's instructions.

5. How and why we use data

We process personal data to:

• Provide and operate the platform: onboarding, attendance, payroll and billing.
• Calculate wages and statutory dues and generate registers, challans and returns from data the customer approves.
• Provide support, secure the service, prevent abuse and maintain audit trails.
• Meet legal, regulatory and statutory record-keeping obligations.
• Improve reliability and performance of the service.

6. Legal basis and consent

We process personal data where it is necessary to provide the service, comply with law, protect the service, perform customer agreements, or where consent has been provided by the relevant data principal or customer.

Where processing is based on consent, consent may be withdrawn by contacting us or the relevant customer administrator. Withdrawal does not affect processing already completed before withdrawal, and some records may still need to be retained where required by law or contract.

7. We do not sell your data

We do not sell personal data, and we do not use worker information for advertising or profiling unrelated to the service.

8. Cookies & analytics

We use cookies and similar technologies that are strictly necessary to keep you signed in and to run the platform, plus limited, privacy-respecting analytics to understand usage. We do not use third-party advertising trackers.

9. Sharing & disclosure

We share personal data only:

• With the customer's own authorised users, according to their role-based permissions.
• With vetted sub-processors (e.g. cloud hosting and infrastructure) bound by confidentiality and data-protection obligations.
• Where required by law, regulation, or a valid legal request.
• In connection with a merger, acquisition or reorganisation, subject to this policy.

10. Storage, location & security

Data is stored in access-controlled databases with role-based permissions, so worker and wage records are visible only to a customer's authorised users. We use encryption in transit and reasonable administrative, technical and organisational safeguards. Hosting region and detailed security measures are available on request during evaluation.

11. Data retention

We retain personal data for as long as the account is active and as long as statutory record-keeping requires (labour-compliance records often must be kept for several years). On termination, data can be exported and is then deleted or anonymised in line with the customer agreement and applicable law.

12. Your rights (DPDP Act, 2023)

Subject to applicable law, you may request to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update inaccurate or incomplete data.
• Erase data that is no longer required, subject to legal retention obligations.
• Withdraw consent where processing is based on consent.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance and have it addressed (see Grievance Officer below).

13. How to exercise rights

Send rights requests or privacy grievances to info@agnihr.com with enough information for us to verify the request and identify the relevant account, customer or worker record. Where the data is controlled by a customer, we may route the request to that customer and assist them in responding.

14. Worker (data principal) data

Where the data relates to a customer's contract workers, we process it as a processor. Requests from workers are routed to and decided by the customer as the data fiduciary; we assist the customer in responding.

15. Children

The platform is intended for business use and is not directed at children. We do not knowingly collect children's personal data.

16. International transfers

If personal data is processed or stored outside its country of origin, we apply appropriate safeguards consistent with applicable law and our customer agreements.

17. Changes to this policy

We may update this policy as the service or the law evolves. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify customers.

18. Grievance Officer & contact

For any privacy question, request or complaint, contact our Grievance Officer at info@agnihr.com. Address for correspondence: Noetic Laboratories (OPC) Private Limited, Pandian Nagar, East Coast Road, Vettuvankeni, Chennai, Tamil Nadu 600115, India. We aim to acknowledge and respond within the timelines required by applicable law, including the one-month grievance redressal period where applicable under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.