Privacy Policy

1. Scope of this Policy

This Policy applies to personal data we process about: (i) visitors to our marketing websites; (ii) representatives and Authorized Users of our Customers; and (iii) employees, contractors, and other individuals whose data is processed within the Service by our Customers.

When you use FG HR as part of your employer's deployment, your employer is the controller of your personal data and FG HR acts as a processor on their behalf. Direct requests about your own data should generally be made to your employer.

2. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Account data: name, email address, phone number, job title, and login credentials.
• Customer Data uploaded by our Customers: employee records (national ID, residence permit, passport details), salary and payroll information, attendance and leave records, performance reviews, documents, and other HR-related data.
• Usage data: log data, IP address, device and browser information, pages visited, and actions taken within the Service.
• Communications: messages you send to our support team, including any attachments.
• Payment data: billing contact, transaction history. Card details are processed by our payment provider MyFatoorah and are not stored on our systems.
• Cookies and similar technologies: as described in our Cookie Policy.

3. How We Use Personal Data

We use personal data for the following purposes:

• To provide, operate, and maintain the Service.
• To process subscriptions, payments, and renewals.
• To authenticate users and secure accounts.
• To provide customer support and respond to inquiries.
• To send service-related communications, including updates, alerts, and security notices.
• To monitor and improve the performance, reliability, and security of the Service.
• To comply with legal obligations and respond to lawful requests.
• To detect, prevent, and address fraud, abuse, or unlawful activity.

4. Legal Bases for Processing

We process personal data on the following bases:

• Performance of a contract with you or your employer.
• Compliance with a legal obligation.
• Our legitimate interests in operating, securing, and improving the Service, provided these are not overridden by your rights.
• Consent, where required by law (such as for certain marketing communications).

5. Sharing and Disclosure

We do not sell personal data. We may share personal data only as follows:

• With service providers that help us operate the Service (such as cloud hosting, email delivery, and payment processing), bound by appropriate confidentiality and data protection terms.
• With your employer or its authorized representatives, when you use the Service through your employer's account.
• With competent authorities, regulators, or law enforcement when required by applicable law or to protect our rights.
• In connection with a business transaction such as a merger, acquisition, or sale of assets, subject to the same level of protection.

6. Sub-processors

We engage a limited number of sub-processors to provide infrastructure, communications, and analytics services. Current categories of sub-processors include cloud hosting (self-hosted infrastructure in Contabo), email delivery (Resend), and payment processing (MyFatoorah). We maintain contracts requiring sub-processors to apply appropriate security and confidentiality measures.

7. International Data Transfers

Customer Data is primarily hosted on infrastructure used to operate the Service. Where personal data is transferred to a jurisdiction with different data protection rules, we take reasonable steps to ensure appropriate safeguards are in place.

8. Data Retention

We retain personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Customer Data is retained for the duration of the Customer's Subscription and for thirty (30) days after termination to allow data export. After that period, Customer Data may be permanently deleted from our active systems, subject to backups that are rotated on a defined schedule.

9. Information Security

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include database-per-tenant isolation, encryption in transit, role-based access control, audit logging, and regular review of access rights.

No method of transmission or storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security.

10. Your Rights

Subject to applicable law, you have rights regarding your personal data, including:

• Access: to know what personal data we hold about you.
• Correction: to request that inaccurate or incomplete data be corrected.
• Deletion: to request deletion of personal data where there is no overriding legal or operational reason to retain it.
• Objection or restriction: to object to or restrict certain processing in defined circumstances.
• Withdrawal of consent: where processing is based on consent.
• Complaint: to lodge a complaint with the competent data protection authority.

11. Cookies and Tracking

We use cookies and similar technologies as described in our Cookie Policy. Cookies are used to operate the Service, remember preferences, and understand usage. You can manage cookies through your browser settings.

12. Children's Data

The Service is intended for businesses and their employees. We do not knowingly collect personal data directly from individuals under the age of eighteen (18). If you believe a child has provided personal data to us, please contact us so we can take appropriate action.

13. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on our website with a revised "Last updated" date. Material changes will be communicated through the Service or by email.