Privacy Policy

1. Introduction

Ayavue Enterprise ("we," "us," or "our") operates the Employee Management System ("EMS" or the "Service"). This Privacy Policy explains how we collect, use, share, and protect information when you use our Service.

We take your privacy seriously. This policy reflects our commitment to transparency and to complying with applicable data protection laws, including the Turks & Caicos Data Protection Ordinance and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Our Roles: Controller vs Processor

EMS is a business-to-business (B2B) platform. This distinction matters for privacy:

• We act as a Data Controller for your account information — things like your name, email, company name, and payment information when you sign up for EMS.
• We act as a Data Processor for the employee and payroll data you upload into the Service. In that role, we process data strictly on your instructions. You (the Customer) are the Data Controller for that data and are responsible for obtaining proper consent and complying with applicable data protection laws.

3. Information We Collect

3.1 Information You Provide

• Account information: Your name, work email, phone, company name, position, and password (which we store hashed)
• Billing information: Payment method details (processed by our payment provider; we do not store full card numbers)
• Customer Data: Data you or your users upload — employee records, contracts, payroll information, work permits, documents, attendance, leave requests
• Communications: Messages you send us through contact forms or support channels

3.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, pages visited, and access times
• Device information: Screen size, device type
• Cookies and similar technologies: For sessions and preferences (see section 10)

3.3 Information From Third Parties

• Payment processors: Confirmation of payment status
• Email providers: Delivery status of transactional emails

4. How We Use Information

We use the information we collect to:

• Provide the Service: Run payroll, track attendance, manage employees, generate reports
• Authenticate you: Verify identity, prevent unauthorized access
• Send transactional emails: Verification links, password resets, notifications, salary slips
• Bill you: Process subscription payments and send invoices
• Provide support: Respond to your questions
• Ensure security: Detect fraud, abuse, or suspicious activity
• Improve the Service: Analyze usage patterns, fix bugs, add features
• Comply with law: Meet legal obligations, respond to valid legal requests

We do not sell your data. We do not use employee data you upload for marketing or advertising purposes.

5. When We Share Information

We share your information only in these limited situations:

5.1 With Your Consent

When you explicitly ask us to share data (e.g., integrating with an external system).

5.2 With Service Providers (Subprocessors)

We use trusted third parties to operate the Service. These providers only access data as necessary to perform their work and are contractually bound to keep it confidential. Current subprocessors:

• Cloud hosting & databases: for storing your data securely
• Email delivery providers: for sending transactional emails
• Payment processors: for handling subscription payments
• Error monitoring: for detecting and fixing bugs

5.3 For Legal Reasons

If required by law, subpoena, or court order — or if necessary to protect the rights, safety, or property of our users or the public.

5.4 Business Transfers

If we are acquired or merged with another company, your data may be transferred as part of that transaction. We'll notify you before any material change in ownership.

6. Data Retention

We retain your data for as long as your account is active. Specifically:

• Active accounts: Data is retained while you have an active subscription
• Cancelled accounts: Data is retained for 30 days post-termination to allow export, then permanently deleted
• Backups: Automated backups are kept for 30 days, then purged
• Legal holds: Some data may be retained longer if required by law or for outstanding legal matters
• Audit logs: Kept according to your plan's retention period (30 days to unlimited)

7. How We Protect Your Data

We use industry-standard security measures to protect your information:

• Encryption in transit: HTTPS/TLS on all connections
• Password hashing: Passwords are never stored in plain text
• Tenant isolation: Each customer's data is logically isolated from others
• Access controls: Role-based permissions and multi-factor authentication for internal access
• Backups: Daily automated backups
• Monitoring: Continuous monitoring for unusual activity
• Employee training: Staff who access data are trained and bound by confidentiality

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing
• Restriction: Request we limit processing in certain cases

To exercise any of these rights, contact us at privacy@yourcompany.com. We will respond within 30 days.

If you are an employee of a Customer: Your employer (the Customer) is the Data Controller for your data. Please contact your employer's HR department first — they control your data. We process it only on their instructions.

9. International Data Transfers

Our primary servers are located in the United States and/or the European Union, depending on your region. If you are accessing the Service from outside those regions, your data may be transferred to, stored, and processed in those locations.

Where required (e.g., for EU customers), we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Cookies & Tracking

We use cookies (small text files) to:

• Keep you logged in: Session cookies maintain your authentication
• Remember preferences: Such as theme or language
• Ensure security: CSRF tokens protect against cross-site attacks

We do not use third-party advertising cookies. We don't track you across other websites. We don't sell anonymous analytics to advertisers.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from logging in.

11. Children's Privacy

EMS is a business tool designed for adults. It is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify active account administrators by email at least 30 days before the change takes effect
• Post a notification in the Service dashboard

We encourage you to review this page periodically. Continued use of the Service after changes take effect constitutes acceptance.

13. How to Contact Us

For privacy questions, concerns, or requests:

• Email: privacy@yourcompany.com
• Security incidents: security@yourcompany.com
• Mailing address: Ayavue Enterprise, Providenciales, Turks & Caicos Islands

If you are in the EU/UK and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.