Data Processing Policy

This policy describes how FairBazaar processes personal data on behalf of customers ("Customers") who use FairBazaar SaaS products or platforms we operate for them. A Customer-specific Data Processing Agreement ("DPA") may be signed and prevails over this policy.

1. Roles

The Customer determines the purpose and means of processing its data (for example, employee records in FairBazaar HRMS) and acts as the data fiduciary/controller. FairBazaar processes that data only on the Customer's documented instructions as a data processor.

2. Scope of processing

• Categories of data: as configured by the Customer — for example employee identifiers, attendance and location at check-in, leave, payroll inputs, expense receipts, and customer or lead records.
• Purpose: providing, securing, supporting and maintaining the service.

3. Our commitments

• Process personal data only on documented instructions.
• Ensure personnel with access are bound by confidentiality.
• Apply appropriate technical and organisational security measures (see Security).
• Engage sub-processors only under written obligations at least as protective as this policy, and inform Customers of material changes.
• Assist Customers in responding to data principal requests and in meeting their obligations under the DPDP Act, 2023.
• Notify Customers without undue delay after becoming aware of a personal data breach affecting their data.
• At the end of the service, return or delete Customer data as instructed, subject to legal retention requirements.

4. Location-based attendance

Location data in FairBazaar HRMS is captured at check-in/check-out events for verification against configured geo-fences. Customers are responsible for informing employees and obtaining any required consent.

5. Contact

Customers can request a DPA or information about sub-processors via the contact page.