1. Who we are
Jethro HR (“Jethro”, “we”, “us”) is an agentic HR operations management system offered by [Registered company name], a company incorporated in India (CIN [CIN]), with offices in Bangalore and Hyderabad. Registered office: [Street address], [City] [PIN].
This policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and, where they still apply, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. You can reach us at info@jethro.in.
2. Our two roles
We handle personal data in two different capacities, and your rights depend on which one applies.
- As a Data Fiduciary — for the data of visitors to this website, people who contact us or ask for a walkthrough, and the business contacts and administrators of our customers. We decide why and how this data is used, and this policy applies to it in full.
- As a Data Processor — for the employee, payroll and HR data our customers (employers) put into Jethro HR. The employer is the Data Fiduciary for that data: it decides what is collected and why, and its own privacy notice to employees applies. We process that data only on the employer’s documented instructions, under our contract with it.
If you are an employee of one of our customers and have a question about your HR or payroll data, please contact your employer first. We will help your employer respond to you.
3. Data we collect
Website visitors and enquiries
- Details you give us when you contact us or ask for a walkthrough: name, work email, company, company size and your message.
- Basic technical data your browser sends: IP address, browser and device type, pages viewed and the time of the visit.
Customer accounts
- Names, work email addresses, phone numbers, roles and sign-in records of the people at our customers who use Jethro HR.
- Billing and tax details of the customer business, such as GSTIN and billing address. Card or bank details for payments are handled by our payment provider; we do not store full card numbers.
- Support conversations and feedback.
Employee data processed for our customers
Depending on the modules an employer uses, this may include identity and contact details, employment and job history, attendance, leave and timesheets, salary, deductions and reimbursements, bank account details, statutory identifiers (such as PAN, UAN, ESI number and, where the employer requires it, Aadhaar-linked details), tax declarations and proofs, documents uploaded during joining and exit, and questions employees ask the HR Desk agent. We process this data only for the employer and only as section 2 describes.
4. Why we use it
| Purpose | Data | Basis under the DPDP Act |
|---|---|---|
| Reply to your enquiry and arrange a walkthrough | Enquiry details | Your consent, given when you contact us |
| Provide, secure and support the Jethro HR service | Account data, technical data | Consent and the performance of our contract with the customer; legitimate uses under section 7 where they apply |
| Billing, tax invoices and accounting | Billing details | Compliance with law (including GST and the Companies Act, 2013) |
| Run payroll, statutory filings and HR work for the employer | Employee data | As Data Processor, on the employer’s instructions; the employer determines its own basis |
| Keep the service safe and find misuse | Sign-in records, technical data | Legitimate uses, including preventing fraud and keeping our systems secure |
We do not sell personal data. We do not use employee data to market to employees, and we do not use one customer’s employee data to train models for another customer.
5. Agents and automated work
Jethro HR uses software agents to prepare payroll checks, statutory filings and answers to employee questions. These agents work only with the data the employer has made available to them, and the actions that change records, move money or file with an authority wait for approval by a person the employer has named. Agent actions are recorded in an audit log that the employer can review.
Some agent features send limited text to an AI model provider to produce a draft or an answer. Where they do, we remove or mask identifiers that are not needed for the task, and the provider is bound by contract not to use that data to train its models. [List of model providers available on request].
6. Who we share it with
- Service providers who host, secure, monitor, email or bill for the service on our behalf, under written contracts that require them to protect the data and use it only for our instructions. [Sub-processor list available on request].
- Your employer, for employee data, and anyone your employer instructs us to send it to — for example a bank for salary transfers or a government portal for a statutory filing the employer has approved.
- Authorities, when Indian law requires it, such as a lawful order of a court, a regulator or a law enforcement agency.
- A successor business, if we are involved in a merger, acquisition or sale of assets, subject to this policy.
7. Where data is stored
We store customer data on servers located in [India / region]. If any data is processed outside India, we will do so only to countries not restricted by the Central Government under section 16 of the DPDP Act, and under contracts that protect it to the standard this policy describes.
8. How long we keep it
- Enquiry data: for as long as needed to respond and follow up, and then for [period], unless you become a customer.
- Customer account and billing data: for the life of the contract, and afterwards for as long as tax, accounting and other laws require.
- Employee data: for as long as the employer instructs. When a contract ends, the employer can export its data, after which we delete or return it within [period], except where a law requires us to keep it longer. Payroll and statutory records often must be kept for several years under labour and tax laws; the employer decides the period.
9. How we protect it
We take reasonable security safeguards, as section 8(5) of the DPDP Act requires, to prevent personal data breaches. These include encryption of data in transit and of sensitive fields at rest, access by role so that people see only what their job needs, multi-factor sign-in, an append-only record of agent actions and approvals, logging and monitoring, and regular security testing. No system is completely secure, and we work to fix issues quickly when we find them.
10. Personal data breaches
If a personal data breach affects data for which we are the Data Fiduciary, we will inform the Data Protection Board of India and each affected person in the form and within the time the DPDP rules require. If a breach affects employee data we process for an employer, we will inform that employer without undue delay and help it meet its own obligations.
11. Your rights
Where we are the Data Fiduciary for your data, you have the right to:
- Access a summary of the personal data we process about you and how we process it (section 11);
- Correct, complete, update or erase your personal data (section 12);
- Withdraw consent at any time, as easily as you gave it — this does not affect processing that already took place;
- Grievance redressal through our Grievance Officer (section 13), and, if you are not satisfied, to complain to the Data Protection Board of India;
- Nominate another person to exercise your rights in the event of your death or incapacity (section 14).
To use any of these rights, write to info@jethro.in. We may need to confirm your identity before we act. For employee data we process for an employer, we will pass your request to your employer and help it respond.
12. Children
This website and the Jethro HR service are meant for businesses and are not directed at children. We do not knowingly collect personal data of a child (a person under 18) as a Data Fiduciary. Where an employer processes data of a minor employee or of an employee’s child (for example a dependant for insurance), the employer is responsible for obtaining verifiable consent of the parent or lawful guardian as the DPDP Act requires.
13. Cookies
This website uses only what is needed for it to work. It does not use advertising cookies. The Jethro HR application uses cookies and similar storage that are needed for sign-in and security. [Update this section if analytics are added.]
14. Grievance Officer
In line with the DPDP Act and the Information Technology Act, 2000, you can raise any concern about how we handle personal data with our Grievance Officer:
Name: [Grievance Officer name]
Email: info@jethro.in (subject “Grievance”)
Address: [Street address], [City] [PIN]
We will acknowledge your grievance and respond within the time the law requires.
15. Changes to this policy
We may update this policy as our service or the law changes. We will post the new version on this page with a new “last updated” date and, for material changes, tell customers by email or in the product before the change takes effect.