This policy explains how Qubelex Private Limited (“Qubelex”, “we”, “us”) collects, uses, shares and protects personal data when you use StaffPrime: the apps, the web app at web.staffprime.in and the website staffprime.in (the “Service”). It is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023 (“DPDP Act”). By using the Service you agree to this policy.
Who is responsible for your data
- Account and business owner data. For information about owners, admins and managers who sign up and pay for the Service, Qubelex is the data fiduciary.
- Staff data. For information a business records about its staff (attendance, locations, photos, leave and salary), the business is the data fiduciary and decides what is collected and why. Qubelex is its data processor and handles that data only on the business’s instructions to provide the Service. Staff should first contact their employer about their data; we will help the business respond.
What we collect
| Information | Purpose |
|---|---|
| Name, mobile number, email address; name and email from Google if you sign in with Google | Creating your account, signing you in, contacting you about the Service |
| Business details: name, phone, email, type, state, logo, and registration numbers you add (PF, ESI, TAN) | Setting up the business and printing details on payslips |
| Staff records a business adds: name, phone, role, department, joining date, pay rate and structure, photo, documents and notes | Running attendance, leave and payroll for that business |
| Attendance: check-in and check-out times, location and its accuracy at those moments, QR code scanned, check-in photos | Recording attendance and letting the business confirm where and when it happened |
| Leave, holidays, advances, loans, expenses, reimbursements, salary and payment records | Working out salary, keeping history and producing payslips |
| Plan and payment records: plan, billing period, amount, GST, status, auto-debit mandate status and the payment provider’s reference | Providing the plan you paid for, invoicing and meeting tax law |
| Referral codes, referrals and SP Wallet balances | Running Refer & earn |
| Device and technical data: notification token, app version, device type, IP address and server logs | Sending alerts, keeping the Service secure, preventing fraud and fixing problems |
| Messages you send us | Answering support requests and keeping a record of them |
Location is read only when a staff member checks in or checks out. We do not track location continuously. The camera is used only when you choose to scan a QR code or take a photo. We do not access your contacts, messages, call logs or other apps.
Some of this information, such as financial information and photos, may be sensitive personal data under the 2011 Rules. We collect it only to provide the Service and protect it as described below.
Consent and legal basis
We process account data with your consent, given when you sign up, and to perform our contract with you. We may also process data where the law allows without consent, such as to comply with law, a court order or a request from a government authority, and to respond to emergencies.
Businesses are responsible for giving their staff notice and obtaining any consent required before recording staff data in the Service. You may withdraw your consent at any time by writing to us or deleting your account; this does not affect processing already done, and we may then be unable to provide the Service to you.
How we share data
We do not sell personal data or use it for advertising. We share it only:
- Within your business: owners, admins and managers see the records their role allows; staff see their own.
- With service providers that process data for us under contract: Google Cloud and Firebase (hosting, database, file storage, sign-in, notifications), MSG91 (one-time passwords) and Razorpay or Cashfree (payments).
- With our support team: a small number of authorised Qubelex staff may access business data to resolve support requests and keep the Service running.
- With authorities when required by law, court order or lawful request, or to protect the rights, property or safety of Qubelex, our users or the public.
- In a business transfer: if Qubelex is involved in a merger, acquisition or sale of assets, data may be transferred subject to this policy.
Where data is stored
Our database, servers and files are hosted on Google Cloud in Mumbai, India. Some service providers, such as those for sign-in and notifications, may process limited data outside India. Any transfer outside India is made only as permitted under the DPDP Act and any restrictions notified by the Government of India.
How long we keep data
- We keep data for as long as your account or business is active and as needed to provide the Service.
- When an account or business is deleted, we delete or anonymise its personal data within 30 days, except where we must keep it longer by law.
- Payment, invoice and tax records are kept for as long as tax and company laws require, which is usually at least 8 years.
- Security logs are kept for a limited period for security and fraud prevention.
How we protect data
We follow reasonable security practices, including encryption in transit and at rest, access limited by role and checked on our servers, single-use expiring invite codes with limits on wrong attempts, and restricted internal access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your phone locked and your sign-in details private.
If a personal data breach occurs, we will act to contain it and notify affected businesses and individuals, and the Data Protection Board of India and other authorities, as the law requires.
Your rights
Subject to the DPDP Act and other laws, you may ask us to:
- give you a summary of the personal data we process about you and how;
- correct, complete or update it;
- erase it, where it is no longer needed and we are not required to keep it (see Delete your account);
- withdraw consent you have given;
- nominate another person to exercise your rights if you die or become unable to.
Write to [email protected] from the email or phone number on your account. We may need to verify your identity. If you are a staff member, we may pass your request to your employer, who decides about staff data.
Cookies and the website
The website staffprime.in does not use advertising or analytics cookies. Our hosting provider keeps standard server logs, such as IP address and pages requested, for security. The web app stores sign-in information in your browser so you stay signed in.
Communications
We send one-time passwords by SMS, and service messages such as payment confirmations, security alerts and changes to these policies by app notification, SMS or email. These are part of the Service. If we send marketing messages, you can opt out at any time.
Children
The Service is meant for businesses and adults. We do not knowingly collect data from anyone under 18. Businesses must not add children as staff except where the law allows, and must obtain any parental consent required.
Changes to this policy
We may update this policy. We will change the date at the top and, for material changes, tell you in the app or by email before they take effect.
Contact and complaints
For any question, complaint or request about your personal data, write to us:
Qubelex Private Limited, Building No 136, Senthan Green Park, Ameenpur, Hyderabad, Telangana 502032
Email: [email protected]
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.