Privacy policy

1Who we are

Orvanta HRMS (the "Service") is a multi-company human-resources, payroll and tax platform operated by Orvanta HRMS, Pakistan ("Orvanta", "we", "us"). In this policy a "client" is a company that uses the Service, and "users" are the people the client invites (Super Admin, HR, Finance, Manager, Viewer, Employee and custom roles).

Our role. For employee and payroll data that a client enters, the client is the controller (it decides what is collected and why) and Orvanta is the processor acting on the client's instructions. For sign-in details, security logs, billing contacts and website visits, Orvanta is the controller. Section 14 sets out processor terms that apply to every client.

2Summary in plain words

3Information we handle

We do not knowingly collect children's data. Clients must not enter data they have no right to process, and should enter special categories of data (for example health notes on a leave) only where necessary and lawful.

4How and why we use information

5Who can access information

The client's own users

Access follows the roles the client's Super Admin assigns. Employees see only their own records; managers see their team; HR and Finance see what their role needs; Super Admins control everything inside their company.

Orvanta platform administrators

Platform administrators can access a client account to provide support. This includes opening the account to recover access, restore a backup, apply a requested correction, investigate a fault or security incident, or deactivate an account. Access is limited to what the task needs, a reason is required, the state before any change is saved first, and each action is recorded with its reason in the platform audit log. Platform administrators do not browse client data out of curiosity, and do not see passwords (which are stored only as one-way hashes).

Authorities

We disclose data only where the law requires and after checking that the request is valid, and we tell the affected client first where we lawfully can.

6Service providers (sub-processors)

Providers process data only to deliver their part of the Service under written terms. We will list any new provider here, and tell clients, before it handles client data.

7Google Drive backups

The platform Administrator may connect a Google account so the server can save backup copies of client data into folders it creates (Orvanta Files / Orvanta Clients / company / section). The connection uses Google's narrowest file permission: Orvanta can see only the files and folders it creates, not the rest of the Drive. Orvanta's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Access can be disconnected in Orvanta or revoked at myaccount.google.com/permissions at any time.

8Security

• HTTPS encryption in transit; bank, national-ID and salary fields encrypted at rest.
• Passwords stored as salted one-way hashes and checked against known breached passwords; minimum length enforced.
• Authenticator-app 2-step verification, mandatory for Super Admin and platform accounts; recovery codes stored hashed.
• Rate-limited sign-in, CAPTCHA on public forms, session expiry, remote sign-out and automatic revocation on deactivation.
• Separate database per company; role-based access enforced on the server, not just the screen.
• Versioned tax rules and formulas, locked payroll months, and tamper-evident activity logs.
• Regular backups and restore checks.

No system is perfectly secure. If we learn of a personal-data breach affecting a client we will tell the client without undue delay (and in any case within 72 hours of confirming it), explaining what happened, what data is involved and what we are doing about it.

9Retention and deletion

Data is kept while the client's account is active. When a client closes its account or asks for deletion we delete or return its data within 30 days, except what we must keep by law (for example payroll records a tax law requires) or security logs we keep for up to 12 months. Backup copies are removed on the normal backup cycle, up to 90 days. Clients can export data at any time as a spreadsheet, a data pack or a full backup. Employees' payroll records are kept as long as the client decides, subject to the client's legal duties.

10Your rights

Subject to the law that applies to you (for example Pakistan's data-protection rules, the GDPR/UK GDPR, or similar), you may ask to access, correct, export or delete your personal data, restrict or object to certain uses, withdraw consent given earlier, and complain to a data-protection authority. If you are an employee of a client, please first ask your employer, because the client controls that data; we will assist the client to respond. For your own account data you can write to us at the contact address and we will answer within 30 days. We do not make decisions about people solely by automated means that have legal effect on them; payroll calculations follow rules the client configures and reviews.

11Cookies and browser storage

Orvanta uses only what it needs to work: a sign-in session token, and small preferences such as theme, language, last-viewed month and collapsed menus. We use no advertising, cross-site tracking or analytics cookies. Clearing site data signs you out and resets preferences. The Service may be installed as an app on your device and can cache its own files for offline use; cached payroll data stays on your device and is removed when you sign out.

12International transfers

Servers and providers may be located outside your country. Where personal data moves across borders we rely on the provider's contractual safeguards (such as standard contractual clauses where applicable) and keep the data encrypted in transit. A client can ask which region its data is stored in.

13Children

The Service is for businesses and is not directed to anyone under 18. If you believe a child's data has been entered unlawfully, contact us and we will help the client remove it.

14Changes to this policy

We will update this policy as the Service changes. For material changes we notify each client's Super Admin by email and in the Service before they take effect, and show the new version and date above. Earlier versions are available on request.

15Processor terms for clients (data processing addendum)

This section applies whenever a client's employee data is processed and forms part of the agreement between Orvanta and the client.

1. Instructions. We process client personal data only to provide the Service and on the client's documented instructions (including its use of the Service's settings and features). We tell the client if we think an instruction breaks the law.
2. Confidentiality. Our personnel and anyone we authorise are bound by confidentiality, and access is limited to what each person needs.
3. Security. We apply the measures in section 7 and keep them appropriate to the risk.
4. Sub-processors. The client authorises the providers in section 5. We impose equivalent duties on them, remain responsible for them, and give notice of changes so the client can object.
5. Assistance. We help the client meet its duties on data-subject requests, security, breach notification and impact assessments, by providing export, correction and deletion tools and reasonable support.
6. Breach. We notify the client without undue delay after becoming aware of a personal-data breach affecting its data.
7. Return and deletion. On termination we return or delete client data as in section 8.
8. Audit. We make available the activity logs and information reasonably needed to show compliance and allow reasonable audits on notice, no more than once a year unless there has been a breach.
9. Client duties. The client confirms it has a lawful basis to process the data, has informed its employees, and uses the Service's role controls responsibly.

16Contact

Questions, data requests or complaints: clasherx539@gmail.com. Orvanta HRMS, Pakistan.