Privacy Policy

HRFlow.my ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our HR management platform.

1. Information We Collect

We collect information you provide directly to us:

• Account Information — Company name, admin name, email address, and password
• Employee Data — Names, identification numbers, contact details, employment records, salary information
• Usage Data — Attendance records, leave applications, expense claims, payroll data
• Payment Information — Billing details processed securely via ToyyibPay (we do not store card numbers)

2. How We Use Your Information

• To provide, operate, and maintain the HRFlow.my platform
• To process payroll, attendance, and leave management functions
• To send transactional emails (password resets, plan notifications)
• To improve our services and user experience
• To comply with legal obligations under Malaysian law

3. Data Storage & Security

Your data is stored on secure servers. We implement industry-standard security measures including encryption in transit (SSL/TLS), access controls, and regular security audits. Employee data is isolated per company — no cross-tenant data access is possible.

4. Data Sharing

We do not sell, trade, or rent your personal information. We may share data with:

• Service Providers — Payment processors (ToyyibPay), email delivery services, hosting providers
• Legal Requirements — When required by Malaysian law or government authorities

5. Employee Data & PDPA Compliance

HRFlow.my is designed to assist companies comply with Malaysia's Personal Data Protection Act 2010 (PDPA). As the data processor, we handle employee personal data on behalf of your company (the data controller). You remain responsible for obtaining proper consent from your employees.

6. Data Retention

We retain your data for as long as your account is active. Upon account termination, data is retained for 30 days before deletion, unless longer retention is required by law.

7. Your Rights

You have the right to access, correct, or delete your personal data. To exercise these rights, contact us at privacy@hrflow.my.

8. Cookies

We use essential cookies for session management and authentication. No third-party advertising cookies are used.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification.

10. Contact Us

For privacy-related enquiries, please contact us at privacy@hrflow.my or visit our Contact page.