Privacy Policy

1. Introduction

This Privacy Policy describes how SRJ World of Steel (SRJ Steel) ("we", "us", or "our") collects, uses, stores, and protects personal information through Sarthi HRMS ("Sarthi", "the Application", or "the Service") — our internal management system for Directors, administrators, and authorized personnel, available via web browser at https://sarthi.srjsteel.in and the Sarthi HRMS mobile application for Android.

By accessing or using Sarthi HRMS, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

2. Scope & Applicability

This policy applies to:

• The Sarthi HRMS web portal (Admin, Director, HOD, Head, and Employee dashboards)
• The Sarthi HRMS mobile application (Android package: com.srjsteel.hrms)
• All authenticated users whose accounts are created and managed by SRJ Steel

Sarthi HRMS is intended exclusively for authorized employees and designated personnel of SRJ Steel. Access is provided through company-issued credentials. Self-registration is not publicly enabled.

3. Information We Collect

We collect only the information necessary to operate our management and organizational functions. The categories of data collected include:

3.1 Account & Identity Information

• Full name, username, email address, and contact phone number
• Employee ID, designation, role, department, and gender
• Password (stored in encrypted/hashed form — never in plain text)

3.2 Employment & Work Records

• Government and statutory identifiers where applicable: Aadhaar number
• Performance ratings, KRA (Key Result Area) scores, self-assessments, and related evaluation data
• Training feedback records submitted through the Training Feedback module

3.3 User-Provided Content & Documents

Files you upload through the Application for legitimate employee and company management purposes, including:

• Profile photographs and cover images
• Task attachments and task delay reason documents
• Kaizen (continuous improvement) submissions and supporting documents
• Standard Operating Procedure (SOP) submissions and approval records
• Complaint/grievance attachments
• Notice board images and videos (JPG, PNG, MP4, AVI, MOV)
• KRA rating attachments and performance target documents

Accepted file types include images (JPEG, PNG, GIF, WebP), PDF, and common office documents (DOC, DOCX, XLS, XLSX, PPT, PPTX). Maximum upload size is 20 MB per file.

3.4 Operational & Activity Data

• In-app notifications and read/unread status
• Notice board comments and likes
• Security audit logs including IP address and browser/device user agent for login and sensitive actions
• Daily active user records (user ID and date of activity) for internal usage analytics

3.5 Mobile App Device Data

• Expo push notification token and device platform (Android/iOS) — used solely to deliver work-related push notifications
• Authentication token (JWT) stored locally on your device via secure app storage to keep you signed in
• Temporary API response cache stored locally on your device (cleared automatically)

3.6 Optional Data

• Telegram ID — only if voluntarily configured by you or your administrator to receive optional task assignment notifications via Telegram

3.7 Information We Do NOT Collect

Sarthi HRMS does not access or collect:

• Device camera, microphone, or contacts
• Precise or approximate GPS location
• SMS messages or phone call logs
• Payment or financial card information (no payment features are implemented)

4. How We Use Your Information

We use collected information strictly for legitimate business and management operations, including:

• Authenticating users and maintaining secure sessions (web cookies and mobile JWT tokens)
• Managing employee records, organizational structure, departments, and sub-departments
• Assigning, tracking, and managing tasks across employees, HODs, and directors
• Conducting KRA and performance rating cycles
• Processing Kaizen submissions and SOP approval workflows
• Publishing and managing internal notice board announcements
• Handling employee complaints and grievances
• Recording training feedback through the Training Feedback module
• Sending password reset OTP emails to your registered email address
• Delivering push notifications for new notices and work-related updates (mobile app)
• Sending optional Telegram notifications for task assignments (when configured)
• Monitoring system security, preventing unauthorized access, and maintaining audit trails
• Generating internal dashboards and usage analytics for authorized administrators

5. Application Features Covered by This Policy

The following features are implemented in Sarthi HRMS and may process your personal data as described above:

6. Device Permissions (Mobile App)

The Sarthi HRMS Android mobile application requests the following device permission:

• Notifications (POST_NOTIFICATIONS): To deliver work-related push alerts, such as new notice board announcements. You may disable notifications through your device settings at any time.

The mobile app uses a document picker to let you select files from your device storage (for example, attaching documents to tasks, Kaizen submissions, or complaints). This does not access your camera directly and does not request camera, location, contacts, microphone, or SMS permissions.

Profile photos and documents on the web portal are uploaded through standard file selection (from your computer or device gallery/files) — not through continuous or background camera access.

7. Third-Party Services

We use the following third-party services to operate Sarthi HRMS. Each processes data only as needed to provide their respective function:

We do not use Firebase, OneSignal, Google Analytics, payment gateways, or SMS gateway services in Sarthi HRMS.

8. Data Sharing & Sale

We may share your information only in the following limited circumstances:

• Within SRJ Steel: Authorized administrators, Directors, HODs, and managers who require access to perform their official duties
• Service providers: The third-party services listed in Section 7, solely to deliver their specific function on our behalf
• Legal requirements: When required by applicable law, regulation, legal process, or government request

All data is stored on servers operated for SRJ Steel. Uploaded documents and profile photos remain on company-controlled infrastructure and are used exclusively for employee and company management purposes.

9. Data Security

We implement technical and organizational measures to protect your personal information, including:

• HTTPS/SSL encryption: All production traffic to Sarthi HRMS is served over HTTPS (https://sarthi.srjsteel.in) to encrypt data in transit between your device and our servers
• Password hashing: User passwords are stored using secure one-way hashing (bcrypt) and are never stored in plain text
• Session security: Web sessions use secure HTTP-only cookies with configurable lifetime; mobile authentication uses signed JWT tokens
• Access controls: Role-based access ensures users can only access data appropriate to their role (Admin, Director, HOD, Head, Employee)
• Login protection: Rate limiting and account lockout after repeated failed login attempts
• CSRF protection: Cross-site request forgery tokens on sensitive web form submissions
• File upload validation: Uploaded files are validated for permitted file types and size limits before storage
• Audit logging: Security-sensitive actions are logged for monitoring and investigation
• Mobile app backup disabled: Android application backup is disabled (allowBackup: false) to reduce unauthorized data extraction from device backups

While we take reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure. If you become aware of any security concern related to your Sarthi HRMS account, please contact us immediately (see Section 15).

10. Data Retention

We retain personal information for as long as necessary to fulfill the management purposes described in this policy, including:

• Active employment: Employee records, performance data, and uploaded documents are retained while you remain an authorized user of Sarthi HRMS
• After employment ends: Data may be retained as required by applicable Indian labour laws, statutory record-keeping obligations, and legitimate business needs of SRJ Steel
• Authentication data: Password reset OTPs expire within 5 minutes; web sessions expire after 30 days of inactivity; mobile JWT tokens expire after 30 days
• Push tokens: Invalid or expired push notification tokens are automatically removed from our systems
• Audit logs: Security and activity logs are retained for internal security monitoring and compliance purposes

When data is no longer required, it may be securely deleted or anonymized by authorized administrators, subject to legal and regulatory retention requirements.

11. Account Deletion

Sarthi HRMS accounts are created and managed by SRJ Steel administrators (Admin, Director, or authorized personnel). There is currently no self-service "Delete My Account" button within the Application.

To request deletion of your account and associated personal data, please use our Account Deletion Request page at https://sarthi.srjsteel.in/account-deletion, or contact us directly at steel.analyticshq@gmail.com.

You may also request deletion or correction through the following steps:

1. Contact your designated company administrator
2. Submit a written request specifying the data you wish to have deleted or corrected
3. Authorized administrators may delete employee accounts through the admin panel, which removes associated user records from the system

Upon authorized deletion of an employee account, associated database records are removed. Some uploaded files and audit log entries may require separate administrative action for complete removal. Certain records may be retained where required by law or for legitimate business record-keeping.

To stop receiving push notifications without deleting your account, you may disable notifications in your device settings or log out of the mobile application, which removes your push token from our servers.

12. Your Rights

Depending on applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you through your designated company administrator
• Correction: Request correction of inaccurate or incomplete personal information via your profile page or company administrator
• Deletion: Request deletion of your data subject to legal retention requirements (see Section 11)
• Restriction: Request restriction of processing in certain circumstances
• Withdraw consent: Disable push notifications or remove optional Telegram ID configuration at any time

To exercise any of these rights, please contact your designated company administrator or use the contact details in Section 15. We will respond to legitimate requests within a reasonable timeframe as required by applicable law.

13. Children's Privacy

Sarthi HRMS is an internal workplace application intended exclusively for authorized adult employees and personnel of SRJ Steel. It is not directed at, designed for, or intended for use by individuals under the age of 18.

We do not knowingly collect personal information from children. If you believe a minor's information has been inadvertently collected, please contact us immediately so we can take appropriate action.

14. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, application features, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically. Continued use of Sarthi HRMS after changes are posted constitutes your acknowledgment of the updated policy.

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

• Organization: SRJ World of Steel (SRJ Steel)
• Application: Sarthi HRMS
• Website: https://sarthi.srjsteel.in
• Privacy Policy URL: https://sarthi.srjsteel.in/privacy-policy
• Email: steel.analyticshq@gmail.com

You may also contact your designated company administrator for account-related inquiries.