1. Roles
In this addendum, the organization using Aajar (the “Customer”) is the data fiduciary (the controller) of the personal data it and its users enter into Aajar (“Customer Personal Data”), and Score Xcreen (“we”) is its data processor. The data covers the Customer's employees and other workforce members, for example their attendance, location punches, leave, payroll and HR records.
2. What we do with Customer Personal Data
- We process Customer Personal Data only to provide, secure and support Aajar for the Customer, and on the Customer's documented instructions. Using the app, changing its settings and sending us a request through the Help form are such instructions.
- The subject matter is the Aajar service; the duration is the life of the Customer's account plus the retention period in section 9; the people concerned are the Customer's employees and invitees; the data types are those listed in the Privacy Policy.
- We do not sell Customer Personal Data, use it for advertising, or use it for our own purposes beyond running, securing and billing for the service (and, in anonymous and aggregated form, measuring how the service performs).
- If we think an instruction breaks the law, we will tell the Customer and may stop carrying it out.
3. The Customer's responsibilities
The Customer is responsible for having a lawful basis for the data it enters; for giving its employees any notice and obtaining any consent required for attendance tracking, location capture, biometric punches and payroll processing; for the accuracy of the data; for choosing roles and permissions sensibly; and for answering requests from its own employees about their data.
4. Confidentiality
We allow only personnel who need to access Customer Personal Data to do their work, and we bind them to confidentiality.
5. Security
We protect Customer Personal Data with reasonable security safeguards suited to the risk, including those described on the Security Overview: encrypted connections, hashed passwords, access limited by role and by organization, and a record of attendance corrections. We review these safeguards as the service changes.
6. Sub-processors
The Customer allows us to use other companies to help deliver the service (“sub-processors”). They currently fall in these categories: web hosting and file storage; email delivery; payment gateways and banks used to collect fees (they receive billing and payment details, not employee records). We make each sub-processor agree to protect data in line with this addendum and we remain responsible for them. We will update this section and, where practical, tell the Customer in advance if we add a sub-processor that will handle Customer Personal Data. A Customer that reasonably objects may stop using the service.
7. Personal-data breaches
If we become aware of a breach of security that leads to accidental or unlawful loss, access to or disclosure of Customer Personal Data, we will tell the Customer's Owner by email without undue delay, and in any case within 72 hours of becoming aware of it where we are able. We will give the information we have about what happened, the data affected and the steps being taken so the Customer can meet its own duties, such as informing the Data Protection Board of India and affected people.
8. Helping the Customer with requests and duties
Many requests from employees (access, correction, erasure) can be dealt with by the Customer directly inside Aajar. If we receive such a request about Customer Personal Data, we will pass it to the Customer rather than answer it ourselves, unless the law requires otherwise. On reasonable request we will give the Customer the information it needs to show that it has met its data-protection duties relating to our processing, and will help with data-protection assessments to a reasonable extent.
9. Return and deletion
- While the account is active, the Customer can export its records (for example attendance and payroll data to Excel) from the app.
- After a plan ends we keep the data for a reasonable period so the Customer can return or export it. When the Customer asks us to delete the organization, or when we are required to, we permanently delete the organization's Customer Personal Data and its users' logins from the live service, and copies in backups are overwritten in the normal course.
- We keep invoices and payment records as tax and accounting laws require, and any data we must keep by law, and we keep protecting it for as long as we do.
10. Transfers outside India
Our hosting provider may store or process data on servers outside India. We only use providers that give appropriate contractual and technical protection, and we do not transfer Customer Personal Data to any country or territory that the Government of India has restricted for this purpose.
11. Audits and information
We will answer the Customer's reasonable written questions about how we protect Customer Personal Data. Where the law requires more, we will allow a reasonable review, once a year unless there has been a breach, on reasonable notice, during working hours, under confidentiality, and at the Customer's cost.
12. Liability and order of precedence
Liability under this addendum is subject to the limits in the Terms of Service. If this addendum conflicts with the Terms about how personal data is handled, this addendum prevails.
13. Contact
For questions about this addendum, or to ask for a signed copy for your records, use the Help & contact form and begin your message with “Data processing”.