Privacy Policy

Almost every question about privacy on this platform resolves once you know which of these two situations applies.

• HR records — we are the processor. Employee files, attendance, leave, payroll and documents belong to the organization that subscribes to Nexa People. That organization decides what to collect and why; we only act on its instructions. If you are an employee, your employer — not Nexa People — is the controller of your record, and requests about it start with them.
• Our own business data — we are the controller. When you visit this website, request a demo, email support or pay an invoice, we decide how that data is used and we answer for it directly.

The exact fields depend on what each employer chooses to enable. In a typical deployment the platform stores:

• Identity and contact details — name, date of birth, gender, photograph, personal and work contact details, address, emergency contacts and dependants.
• Government and statutory identifiers — national identity card numbers (including issue and expiry dates), passport numbers, and payroll registrations such as social-security, pension, provident fund and tax numbers.
• Employment record — designation, department, station, grade, shift, contract and probation dates, reporting line, appraisals, disciplinary entries, exit and final settlement records.
• Attendance and leave — punch times, the daily attendance result, shift assignments, leave balances and requests, overtime and penalty calculations.
• Financial data — salary structure, allowances and deductions, loans, bank account title and number, and generated payslips.
• Documents — whatever the employer uploads against a record, such as contracts, certificates and ID scans.

Some of these are sensitive by law. The platform has fields for religion and marital status, and its ID fields commonly hold national identity numbers. They exist because payroll and statutory reporting in our markets ask for them. They are optional, and an employer that does not need a field should leave it empty — we do not require it to run payroll.

• Account and billing — the details of the people who sign up, administer and pay for the subscription.
• Support correspondence — what you send us when you ask for help, including any screenshots you attach.
• Website and demo requests — the contact details you submit and basic technical data such as IP address and browser type. Cookies are covered separately in our Cookie Policy.
• Security and audit logs — sign-in events, IP addresses and a record of actions taken in the platform. We keep these to investigate misuse and to give employers the audit trail their own compliance requires.

• To provide the service the employer subscribed to — the contract we perform.
• To meet legal obligations that apply to us, and to help employers meet theirs.
• To keep the platform secure, prevent abuse and investigate incidents — our legitimate interest, and the employer's.
• To bill, support and communicate with customers about the service.
• To improve reliability and performance, using operational data rather than the contents of HR records.

Where an employer's local law requires employee consent or notice for a particular feature — location-based attendance is the usual example — it is the employer's responsibility to obtain it. Marketing email is sent only to business contacts and always carries an unsubscribe link.

Attendance is the part of the platform that reaches furthest into someone's day, so we are specific about it. Employers can optionally restrict where the platform may be used:

• IP restrictions— sign-in and punching can be limited to an approved network, which means we compare the IP address of the request against the employer's allow-list.
• Geo-fencing— a punch can be required to fall inside a defined radius around a site, which means the device's reported coordinates are checked at the moment of the punch.
• Device binding — an employee can be tied to one registered device identifier so a punch cannot be shared.

These checks are off unless an employer turns them on, and they apply at the moment of an action. The platform is not a continuous location tracker: it does not follow a device between punches, and it does not collect location in the background.

Where an employer connects a biometric terminal, it is worth being clear about the division of responsibility. Fingerprint and face templates stay on the employer's device. Nexa People does not receive, store or process them. What we receive is a numeric punch code and a timestamp, which we map to an employee record. The daily attendance result is what we retain. The terminal itself is the employer's hardware, under the employer's control and their vendor's terms.

The Android app is the employee's own surface of the same platform: their attendance, leave, payslips and requests, governed by the same employer-configured permissions as the browser. It collects nothing the sections above do not already describe, but three things are specific to a phone and worth stating plainly.

• The camera, for an attendance selfie — where an employer turns photo verification on, the app captures a single photograph at the moment you press check in or check out and stores it against that attendance record. It is never taken in the background, never without that press, and the camera is not used anywhere else in the app. Who can see it afterwards follows the attendance record's own visibility rules: you, and the HR roles your employer has granted access to.
• Location, only at a punch — where geo-fencing is on, the app reads the device's coordinates at the moment of the punch so the check described in section 5 can run. The app asks for no background location permission and cannot read your position while it is closed.
• Unlocking the app— you can lock it behind your phone's own fingerprint or face unlock. That check happens entirely on the device, which answers only yes or no. We never receive, see or store fingerprint or face data. This is separate from the employer's punch terminals in section 6.

Some data rests on the phone itself. Your sign-in session is held in the device's secure keystore. If you punch with no connection, the punch — including its selfie, where one was required — is kept in the app's private storage until it can be sent, and is cleared once it has been. Uninstalling the app removes both.

The app carries no advertising, no advertising identifier, and no third-party analytics or tracking software. Nothing in it profiles you, and nothing in it is sold or shared for advertising.

Your employer creates your account, so there is no sign-up in the app and nothing is collected before you sign in. To correct or delete what the app shows, use the routes in sections 12 and 13 — the records are your employer's, and requests go through them.

The in-app help assistant answers questions about how to use Nexa People. It is powered by Google's Gemini API, which means:

• What is sent — the question you type, the recent turns of that chat, and matching entries from our help documentation.
• What is not sent — your HR records. The assistant has no access to employee data, salaries or attendance; when asked about them it points you to the right screen instead.
• Please do not paste employee data into the chat, since it will then leave our systems along with your question.

We do not use HR data to train AI models, and we do not permit our providers to train theirs on it.

We do not sell personal data, and we do not share HR data with anyone for their own purposes. We rely on a short list of service providers, each bound to act only on our instructions:

• Cloud hosting and infrastructure, where the platform and its backups run.
• Email delivery (SendGrid), for notifications, approvals and password resets.
• Google Gemini, for the help assistant described above.

Separately, our public marketing pages use the Meta (Facebook) Pixel to measure our advertising. Meta is not a processor acting on our instructions here — it uses what it receives for its own purposes too, which is why we keep it strictly off the product: it is not loaded anywhere inside the signed-in platform, and it never sees HR data. Exactly what it receives, and the cookies it sets, are set out in our Cookie Policy.

Beyond those, we disclose data only where an employer instructs us to — for example an export or an integration they configure, such as pushing payroll journals to their accounting system — or where the law compels us. If we are ever legally required to hand over customer data, we will tell the affected customer unless we are prohibited from doing so.

Villaex Technologies is registered in the United States. Our team and some of our providers may be outside the country where an employer's employees are based, and data may be accessed from or stored in another jurisdiction. Where a transfer needs a legal safeguard, we put appropriate contractual protections in place. Employers with data-residency requirements should raise them with us before onboarding rather than after.

The controls that matter most in a multi-tenant HR system are these: every organization's data is isolated so that one customer's users cannot reach another's; access inside an organization is governed by role-based permissions the employer configures; traffic between you and the platform is encrypted in transit using TLS; and privileged actions are written to an audit log. Our own access to customer data is limited to what support and operations genuinely require.

If you have a specific requirement around encryption at rest, key management or data residency, ask us before onboarding and we will tell you exactly what is and is not in place today. We would rather scope that honestly than answer it with a checkbox.

Accounts are yours to look after. Credentials should not be shared, and suspected compromise should be reported to us quickly — most incidents we see start with a shared or reused password rather than a broken control. No system is perfectly secure, and we do not claim otherwise; if a breach affects personal data we will notify affected customers without undue delay and support their own reporting duties.

• During the subscription — HR data is retained for as long as the employer needs it, because payroll, tax and gratuity records have to remain available and auditable for years. The employer decides what to delete and when.
• After it ends — we make the data available for export, then delete it from production within 30 days unless a written agreement or the law says otherwise. Backups age out on their own cycle, after which the data is gone from those too.
• Our own records — billing and correspondence are kept for as long as tax and limitation periods require. Website and demo enquiries are deleted once they are stale.
• On request — a deletion request that we can act on is honoured within 30 days, and we will tell you if we cannot act on it and why.

Depending on where you live you may have the right to access your data, correct it, delete it, object to or restrict how it is used, and receive a copy in a portable form. How to use those rights depends on the two roles in section 1:

• If you are an employee, contact your own HR team. Your record is theirs, and much of it you can already see and correct in the self-service screens. If they need our help to fulfil your request, we will support them.
• If it concerns our own data about you — your account, an enquiry, our emails — write to us directly using the details below. We will not charge you for a reasonable request or make you justify it.

We may need to verify your identity first, which is a protection for you rather than an obstacle. You can also complain to your local data protection authority, though we would rather you gave us the chance to put it right first.

Nexa People is a workplace tool that is not directed at children and we do not knowingly collect their data. Employers who lawfully employ young workers are responsible for the additional protections their local labour law requires.

We update this policy as the product changes. The date at the top always reflects the current version. When a change materially affects how we handle personal data, we will tell customers at least 7 days before it takes effect, so nothing important changes quietly.

Privacy questions, requests and complaints can go to [email protected], and we aim to respond within 30 days.