Privacy Policy

Benchmark follows the principle of data minimisation, collecting only information required to deliver services securely and effectively.

Personal and Account Information

We may collect:

• Name and professional contact details
• Business email address and phone number
• Company name, designation, and organisational role
• Authentication credentials and access identifiers

Customer and Employee Data

Benchmark processes customer-controlled HR data, including:

• Employee profiles, employment details, and documents
• Attendance, leave, and shift records
• Payroll, bank, and statutory details (such as PAN, UAN, ESIC, PF, and TDS information)
• Hiring and performance records

This data remains the property of the customer (the employer) and is processed solely for service delivery. Employees with questions about their data should contact their employer's HR team first.

Technical and System Data

Collected automatically for security and reliability:

• IP addresses and device identifiers
• Browser and operating system information
• Access timestamps and usage logs
• Platform interaction metadata

Cookies and Tracking

We use cookies and similar technologies to support platform functionality, performance monitoring, and security and fraud prevention. Cookie preferences can be managed through browser settings.

Benchmark processes data strictly for legitimate business and operational purposes, including:

• Providing and maintaining platform functionality
• Processing payroll and statutory compliance as configured by the customer
• Enforcing access control and identity verification
• Delivering reports and workforce insights
• Monitoring platform performance and security
• Responding to support requests and service communications
• Meeting contractual, legal, and regulatory obligations

Benchmark does not sell personal data or use customer data for advertising purposes.

Benchmark maintains an information security program aligned with ISO 27001 and SOC 2 trust principles, covering:

• Logical access controls and role-based permissions
• Encryption of data in transit and at rest
• Secure authentication and credential management
• Audit logging and activity monitoring
• Vulnerability management and incident response procedures
• Change management and system monitoring

Security controls are reviewed regularly and updated to address evolving risks.

Access to personal and customer data is:

• Restricted to authorised personnel only
• Granted based on least-privilege principles
• Logged and monitored for unauthorised activity

All Apptware employees and contractors are bound by confidentiality obligations and security policies.

Data may be shared only with:

• Approved service providers supporting hosting, monitoring, analytics, or security
• Statutory portals (such as EPFO, ESIC, and the Income Tax Department) when the customer uses filing features
• Legal or regulatory authorities when required by law

All subprocessors are subject to:

• Due diligence and security review
• Contractual data protection obligations
• Use limitations aligned with service delivery

A current list of subprocessors can be provided upon request.

Benchmark retains information only for the duration necessary to:

• Fulfil contractual commitments
• Support operational and audit requirements
• Comply with applicable laws, including labour and tax record-keeping laws

Secure deletion or anonymisation processes are applied when data is no longer required.

Benchmark maintains documented incident response procedures aligned with industry standards. In the event of a confirmed data security incident:

• Impact is assessed promptly
• Containment and remediation actions are initiated
• Customers are notified in accordance with contractual and legal requirements

Benchmark supports compliance with applicable data protection frameworks, including:

• Digital Personal Data Protection Act, 2023
• Indian Information Technology Act and related rules
• GDPR (where applicable)
• Contractual privacy and security commitments

Data processing is governed by contractual agreements where required.

Depending on jurisdiction, individuals may have rights to:

• Access personal information
• Request correction or deletion
• Withdraw consent or object to processing
• Raise a grievance

Requests can be submitted through the contact details below and will be handled in accordance with applicable laws.

Data may be processed in regions where Apptware or approved service providers operate. Appropriate safeguards are implemented to ensure secure cross-border data transfers.

Benchmark is intended for business use only and does not knowingly collect data from individuals under the age of 18.

This Privacy Policy may be updated periodically to reflect changes in legal, regulatory, or operational requirements. Updates will be published on this page with a revised effective date. Continued use of Benchmark constitutes acceptance of the updated policy.