GDPR Compliance
HubNest HRM is fully committed to protecting your personal data and ensuring compliance with the General Data Protection Regulation. Your privacy is not just a legal obligation — it's a core value.
Your Data Protection Rights
Under the GDPR, you have extensive rights over your personal data. Here's how HubNest HRM empowers you to exercise them.
Data Protection Officer
Our dedicated DPO oversees all data protection activities, ensures compliance with GDPR, and serves as your point of contact for all privacy-related matters.
Right to Access
You have the right to request a copy of all personal data we hold about you. We provide easy-to-use tools for submitting and fulfilling access requests within 30 days.
Right to Erasure
Request the deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw your consent.
Data Portability
Export your personal data in a structured, commonly used, and machine-readable format. Transfer your data to another service provider seamlessly.
Consent Management
We collect explicit, informed consent before processing your data. You can review, modify, or withdraw your consent at any time through your account settings.
Breach Notification
In the unlikely event of a data breach, we notify affected individuals and supervisory authorities within 72 hours, as required by the GDPR.
Data Processing Principles
All processing of personal data by HubNest HRM adheres to the six fundamental principles laid out in Article 5 of the GDPR.
Lawfulness, Fairness & Transparency
We process personal data lawfully, fairly, and in a transparent manner. You are always informed about how your data is used.
Purpose Limitation
Personal data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
Data Minimization
We only collect and process personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
Accuracy
We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is rectified or erased without delay.
Storage Limitation
Personal data is kept only for as long as necessary to fulfill the purposes for which it was collected, and securely deleted thereafter.
Integrity & Confidentiality
We implement appropriate technical and organizational measures to ensure data security, including protection against unauthorized processing and accidental loss.
Our Compliance Measures
We have implemented comprehensive technical and organizational measures to ensure and demonstrate that processing is performed in accordance with the GDPR.
Privacy Impact Assessments (PIAs) conducted for all new features and processing activities
Data Protection by Design and by Default integrated into our software development lifecycle
Regular staff training on data protection principles and GDPR compliance requirements
Comprehensive data processing records maintained as required by Article 30 of the GDPR
Standard Contractual Clauses (SCCs) in place for all international data transfers
Annual third-party security audits and GDPR compliance assessments
Dedicated incident response team for rapid breach detection and notification
Encryption of all personal data in transit (TLS 1.3) and at rest (AES-256)
Legal Basis for Processing
Contractual Necessity
We process personal data that is necessary for the performance of our service agreement with your organization, including employee management, payroll processing, and attendance tracking.
Consent
For non-essential processing activities such as marketing communications and analytics, we obtain explicit, informed, and freely given consent that can be withdrawn at any time.
Legitimate Interest
In certain cases, we process data based on our legitimate interests, such as improving our services, preventing fraud, and ensuring network security, balanced against your rights and freedoms.
Legal Obligation
We process certain data to comply with legal obligations, such as tax reporting, employment law requirements, and responding to lawful requests from public authorities.
Contact Our Data Protection Officer
If you have any questions about how we process your personal data, wish to exercise your data protection rights, or want to lodge a complaint, please contact our Data Protection Officer.
You also have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.