Privacy policy: Witnes Staff

Last updated 31 October 2026

Witnes Staff is human resource management software for Indian organisations, made by Witness Technologies OPC Private Limited ("we", "us"), 101 FF Hardik Shopping Centre, Opp Narsinhji Pole, M G Road, Vadodara, Gujarat 390001, India. This policy explains what we do with personal data on staff.witnes.in and in the Witnes Staff web and mobile apps. It follows the Information Technology Act, 2000 and the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023 and its Rules as they come into force.

Who is responsible for what

Your organisation (your employer) decides what employee, candidate and payroll data is put into Witnes Staff and why. For that data it is the data fiduciary (the "controller"). Your HR team is your first contact for any request about your own record.
We act as the organisation's data processor for that data. We process it only on the organisation's instructions, to run the service, and we never sell it or use it for advertising.
For the details of the people who sign up, sign in and contact us, and for visitors to staff.witnes.in, we are the data fiduciary and this policy is our notice to you.

What is kept in Witnes Staff

An organisation chooses which modules it uses. Depending on that, the data can include:

Core HR: name, contact details, emergency contacts, date of birth, identity documents, bank accounts, education, documents with expiry dates, job, position, grade and manager history.
Payroll and tax: salary structure, payslips, PF, ESI, professional tax and TDS figures, investment declarations and proofs, loans, advances and final settlement. Aadhaar is stored as the last four digits unless the organisation turns on full storage.
Time and attendance: leave records, shifts, punches, and the time and place of a web clock-in where the organisation limits it to its office network or a geo-fence. Punches imported from an attendance device are kept as the organisation uploads them.
Expenses, performance reviews, goals, feedback, learning records and approvals, with the history of each approval.
Recruiting: the details and documents a candidate sends through an organisation's careers page (staff.witnes.in/careers/<name>), interview scorecards and offers.

Some of this is sensitive, such as bank details, salary and identity numbers. Fingerprints or face templates are never stored by Witnes Staff unless an organisation's own attendance device does so; Witnes Staff receives only the punch time and the employee's code.

What we collect about you directly

Your account: name, email, mobile number, password (stored only as a hash) and the organisation you belong to.
Details you send through our contact form or by email.
Technical data recorded for security and reliability, such as IP address, browser and device, the pages and actions requested, and the audit trail of changes made in the app.
On the mobile app, your location only when you clock in to an organisation that uses a geo-fence, the camera or photo library only when you attach a document or receipt, and a device token for notifications. We do not read your files, contacts or messages.

How we use it

To run Witnes Staff for your organisation and keep your account safe.
To send service messages, such as one-time passwords, approvals, payslip and offer notices, by email, SMS or notification.
To answer you, fix problems and meet legal obligations.
To improve Witnes Staff using usage that is not tied to a person. We do not use your organisation's people data to train AI models.

Who else sees it

Within an organisation, people see only what their role allows: managers see the workers in the organisations they manage and below, payroll and HR see what their role grants, and every employee sees their own record. Outside the organisation we share data only with:

Service providers who run Witnes Staff for us: Microsoft Azure for hosting and storage in India (Central India), and email, SMS and notification providers that deliver messages. They may use the data only for that purpose.
Banks, the Employees' Provident Fund Organisation, ESIC, income tax and other authorities, only where the organisation uses a Witnes Staff download to make a statutory or bank filing. That filing is the organisation's, not ours.
Courts, police or regulators where the law requires it, and a buyer if our business is ever sold, who must keep to this policy.

We do not sell personal data.

How it is protected

Each organisation's data is kept in a database of its own and served over HTTPS from Microsoft Azure in India. Access is by role, every sign-in has its own session, and changes to HR and payroll records are logged. No system is perfectly secure. If a breach affects your data we will tell the organisation and, where the law requires, the Data Protection Board and the people affected.

How long we keep it

An organisation's data is kept while its account is open, because HR and payroll history has to be there for audits and statutory records. The organisation can export it, and when it leaves it can ask us to delete or return it; copies in backups are removed as the backups expire, and we keep only what the law requires us to keep. Account and contact-form details are kept while they are needed for the purpose given and for the period the law requires.

Cookies

Witnes Staff uses the cookies and browser storage needed to keep you signed in and to remember your settings. We do not use advertising cookies.

Your rights

You can ask to see the personal data held about you, to have it corrected or completed, to have it erased where the law allows, to withdraw consent, to nominate someone to act for you if you die or are unable to, and to have a grievance heard. For your employment record, ask your organisation's HR team; we will help them respond. For data we hold as fiduciary, write to us and we will reply within the time the law gives. Withdrawing consent does not undo what was done before; and some records cannot be erased while the law requires them to be kept.

Children

Witnes Staff is for working adults. We do not knowingly collect data from anyone under 18. If you think we have, write to us and we will delete it.

Changes

If we change this policy we will change the date above and, for a material change, tell account administrators by email.

Grievance officer

Grievance Officer, Witness Technologies OPC Private Limited, 101 FF Hardik Shopping Centre, Opp Narsinhji Pole, M G Road, Vadodara, Gujarat 390001, India.
Email: info@witnesstechnologies.in
Phone: +91 92840 44638