Payroll Privacy & Information Security Notice

(For SaaS Vendor / Sub-Processor Perspective)

1. Who We Are

This payroll application (“Platform”), PayComply is a Software-as-a-Service (SaaS) solution provided by Valueance Technology Solutions LLP.
PayComply act as a Data Processor / Sub-Processor on behalf of our client organizations (“Customers”) for the purpose of payroll processing and related statutory compliance.

2. Scope of Processing

We process personal data of employees, contractors and authorized users strictly on documented instructions of our Customers and solely for payroll and employment-related purposes.

3. Categories of Personal Data Processed

Depending on Customer configuration, we may process:

• Identity and contact information
• Employment and payroll data
• Bank and payment details
• Statutory identifiers (e.g., PAN, PF, ESIC)

We do not independently determine the purpose or means of processing.

4. Lawful Basis

Processing is carried out under:

• Contractual necessity
• Legitimate employment purposes under applicable law
• Customer instructions in compliance with the Digital Personal Data Protection Act, 2023

5. Information Security Controls

We maintain a risk-based information security program aligned with:

• ISO/IEC 27001 (ISMS)
• SOC 2 Trust Services Criteria

Key controls include encryption of personal data, RBAC enforcement, secure authentication, audit logging and secure software development practices.

6. Data Retention & Deletion

Personal data is retained only for the duration instructed by the Customer or as required by applicable law. Upon termination or instruction, data is securely deleted or returned.

7. Data Sharing & Sub-Processing

Personal data may be processed using approved infrastructure and service providers under confidentiality, security and compliance requirements. We do not sell or use personal data for independent purposes.

8. Data Principal Rights

Requests related to access, correction, deletion or grievances must be raised through the Customer (employer), who acts as the Data Fiduciary. We assist Customers in fulfilling such requests as required by law.

9. Incident Management

We maintain a formal incident response process and notify Customers without undue delay in the event of a personal data breach, enabling regulatory and user notifications as required.

10. Contact

For privacy or security queries:
Privacy / Security Contact:
Email: connect@valueance.com

Compliance Statement

This Platform operates in alignment with:
Digital Personal Data Protection Act, 2023
ISO/IEC 27001
SOC 2 Trust Services Criteria