Gloibox Privacy Policy Draft

Your employer or other subscribing organization determines which employee records it submits and how it uses Gloibox for workforce management. For that information, Gloibox acts on the organization's instructions under its contract and Data Protection Addendum. Direct employment-record requests should be made to your organization's administrator; we assist the organization as required.

For our own account administration, customer communications, service operations, and security activities, Gloitel Consulting Pvt. Ltd. acts as the controller for its own business information and as a processor for the Customer's employment and operational data under the relevant contract. This distinction does not limit rights provided by applicable law.

Depending on the modules and configuration used, information may include:

• Account and identity details, contact information, sign-in information, and organization membership.
• Employee identifiers, department, role, work location, shifts, attendance, leave, and payroll records.
• Location information when an enabled attendance or location-verification feature requires it, and device registration information used by the service.
• Support requests and any records or screenshots you choose to provide.
• Technical information associated with service access, plus the cookies and preferences described in the Cookie Policy.

Gloibox may process attendance records, location information, device identifiers, employee profile data, and payroll-related data where enabled by the Customer. This processing is carried out for workforce operations and compliance purposes as instructed by the subscribing organization. Device permission alone does not explain or authorize every employer use of information.

Information comes from you, your organization's administrators, enabled integrations, and use of the service. It is used to operate accounts, record and report workforce activity, administer purchased modules, respond to support requests, and protect service access. The organization determines the employment purposes of its records.

For Gloibox's own business purposes, the Company relies on contractual necessity, legal and regulatory obligations, legitimate business interests, and consent where required by law. We do not sell personal information for advertising. Where the Customer uses analytics or operational reporting features, those uses are subject to the Customer's own instructions and applicable law.

Authorized organization users can access records according to their assigned permissions. Service providers may process information to operate the contracted service, subject to appropriate contractual restrictions. The main service providers are AWS, Firebase, Google Workspace, Stripe, and SendGrid. Information may also be disclosed where legally required or in connection with a corporate transaction involving Gloitel Consulting Pvt. Ltd.

Hosting and support locations are primarily in India, with backups maintained in the same region unless otherwise required. Where information crosses borders, the Company uses contractual safeguards, vendor controls, and lawful transfer mechanisms as applicable. No particular residency guarantee is made by this draft.

Customer records follow the organization's instructions and the agreed retention schedule. Account, support, and operational records are retained for the periods described in the DPA and service terms: employee records as required by the customer's policy or applicable law; operational logs for 90 days; backups for 30 days; deleted records are purged after backup expiry.

On contract termination, export, deletion, and backup expiry follow the DPA. Records retained because of a legal requirement remain restricted to that purpose.

Gloibox uses access controls, secure infrastructure, encrypted transport, logging, backup controls, and incident-response procedures appropriate to the service and risk profile. Do not submit passwords or unnecessary employee records in support requests.

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent where processing relies on it. Contact your organization for its employment records or privacy@gloibox.com for information we control. We may request proportionate identity verification. You may also contact the competent regulator where the law provides that right.

Browser storage and device permissions can be managed through their respective settings. Disabling a required permission may prevent the associated feature from working. Gloibox does not intentionally process the personal data of minors beyond what is required for the applicable workforce-management service, and any such use must comply with the Customer's lawful employment policies and local law. Material policy changes will be communicated through the service or by email to the relevant customer contact.