Privacy
Version 2026-09 · Last updated 19 September 2026
This covers the HR-VEND web workspace and the Onduty mobile app. It is written to be read, so it says what we actually hold rather than every category we might one day.
The most important thing on this page. If you are an employee using Onduty or your company's HR-VEND workspace, your employer decides what is held about you and why — not us. Under India's Digital Personal Data Protection Act 2023 your employer is the Data Fiduciary and HR-VEND is the Data Processor: we run the software and store the data on their instructions.
So a request to see, correct or delete your record goes to your employer's HR team first. We will help them answer it, and we will not act on your record on our own.
Who we are
HR-VEND is operated by Pinetech IT Solutions. Contact us about anything on this page at info@hrvend.com, which also reaches our grievance officer for the purposes of the DPDP Act.
What we hold, and why
If you are an employee
Your employer's workspace holds the employment record they keep, which typically includes:
| What | Why |
|---|---|
| Name, employee number, work email, phone | Identifying you in the record and signing you in |
| Attendance, leave, shifts, overtime | Running attendance and leave, and the statutory registers an employer must keep |
| Salary, payslips, bank details, PF and ESI numbers | Paying you, and the statutory filings that go with it |
| Date of birth, gender, address, PAN, Aadhaar reference | Statutory enrolment, age verification and equal-opportunity reporting |
| Documents your employer collects or issues | Appointment letters, ID proofs, policy acknowledgements |
| Performance reviews, cases, exit records | Where your employer uses those parts of the product |
Under the DPDP Act, processing this to employ you is a legitimate use — it does not need your consent, but it does need to be told to you, which is what this page is for.
If you are a job candidate
Your application, CV, contact details, interview feedback and any background-check results. A candidate is not an employee, so this is done on notice and consent, and a background check is never started before you have agreed to it. Unsuccessful applications are deleted at the end of the retention period unless you agreed to be kept on file for future roles.
The Onduty app specifically
The app holds nothing your workspace does not already hold, and adds only what is needed to be an app:
| What | Why | How long |
|---|---|---|
| A device identifier we generate | So a sign-in can be tied to one device and that device signed out | 30 days from last use |
| App version, OS version, device name | Working out why a notification did not arrive | While the device is registered |
| A notification token | Delivering notifications, via Google | Until you turn notifications off or sign out |
The app does not use your location, camera, photos, contacts or calendar, and contains no advertising or analytics software. It asks for two Android permissions: internet access, and the ability to see whether you are online.
Notifications are deliberately vague — "your leave request was decided", never the decision or the reason; "your payslip is ready", never the amount — because a notification is displayed on a locked screen that other people can see. The detail is only in the app, after you unlock it.
Notifications are optional. Refusing them, or withdrawing them later, deletes the device records above and stops nothing else from working.
If you visit this website
The marketing site uses Google Analytics to count visits. If you start a trial we hold the name, work email, company and workspace address you give us, and if you subscribe, our payment provider Razorpay handles the payment — we never see your card details.
Who else sees it
We do not sell personal data and we do not share it for advertising. It reaches only:
- Your employer, whose data it is.
- DigitalOcean, where the servers and file storage are.
- SendGrid, which delivers our email.
- Google (Firebase), which delivers app notifications, if your employer has them switched on.
- Razorpay, for subscription payments — billing contacts only, never employee records.
- A government authority, where the law requires it.
Each customer's data is in its own separate database, so one employer's workspace cannot read another's.
How long it is kept
Employment records outlive employment, because the law requires it. The periods below are the Indian statutory ones your employer is working to:
| Record | Kept for |
|---|---|
| Payroll, TDS, Form 16 and Form 24Q | 8 years |
| Statutory registers — wages, attendance, leave, deductions | At least 3 years after the last entry |
| Provident fund records | The life of the establishment |
| Employees' State Insurance records | 5 years |
| Harassment case files | 3 years after closure, under restricted access |
| Unsuccessful job applications | 12 months, or 36 if you agreed to be kept on file |
| App device records | 30 days from last use; 90 days once disabled |
When your employer stops using HR-VEND, their workspace and its data are deleted on their instruction.
How it is protected
- Everything travels over HTTPS. There is no unencrypted route into the product.
- Each customer has a separate database.
- Sensitive identifiers such as PAN and Aadhaar are encrypted where they are stored, and printed only as the last few digits on reports. Seeing one in full is a separate, recorded action.
- What a person can see is decided by the role their employer gave them.
- Changes to records are logged, so it is possible to say who changed what and when.
- Files are stored privately and reached through links that expire after fifteen minutes.
No system is beyond compromise. If a breach affects your data we will tell your employer and the Data Protection Board within the time the DPDP Act allows, and your employer will tell you.
Your rights
Under the DPDP Act you may ask for a summary of what is held about you, ask for it to be corrected or completed, ask for it to be erased where it is no longer needed and no law requires it to be kept, nominate someone to act for you, and complain if you are not satisfied.
Ask your employer's HR team first. They hold the record and they decide. If they need us, they know how to reach us, and we will help them answer within the time the Act allows.
Where you gave consent rather than it being a legitimate use — a background check as a candidate, or app notifications — you can withdraw it at any time without giving a reason.
If you have asked your employer and got nowhere, write to info@hrvend.com. You may also complain to the Data Protection Board of India.
Children
This is a workplace product and is not for anyone under 18. The minimum age for employment in India is 14, and where an employer records someone between 14 and 18 the product applies the restrictions the law places on that.
Changes
When this page changes materially we will update the version at the top and tell the workspace administrator. The app records which version you were shown when you acknowledged it, so it is possible to say what you were told and when.