Privacy Policy

ECN People is a cloud service for human resources, attendance, payroll, hiring, helpdesk, sales and projects, provided by Easy Connect Private Limited ("Easy Connect", "we", "us"), a company incorporated in India and based in Jaipur, Rajasthan, India.

This policy explains how personal data is handled when you visit our website, sign up for a trial, use ECN People on the web or in the ECN People mobile app, or contact us. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

The app is for employees whose company uses ECN People. You sign in with the account your employer created. The app asks for a permission only when you use the feature that needs it, and works without any optional permission you decline (that feature is then unavailable).

What the app does not do

• It does not access your contacts, SMS, call logs, microphone or files outside what you choose to attach.
• It does not collect location in the background or when the app is closed.
• It shows no advertising, does not use the Advertising ID, and contains no third-party analytics, advertising or crash-reporting tools.
• We do not sell personal data or share it for advertising.

Attendance selfies are optional: you can withdraw your consent under Me → Privacy in the app, and check-in then works without a selfie (your company may ask your manager to confirm those check-ins).

When you sign up or administer an account

• Your name, work email address, mobile number and the password you choose (stored only as a salted hash).
• Your company's name, the industry template you choose, GSTIN and billing address if you add them, and the plan you pick.
• Sign-in records: time, IP address, device and browser.

When you use the product

• Data you or your company enter about employees, candidates, leads and projects. For this data your company is the Data Fiduciary and our DPA applies.
• Technical logs: server request logs and error reports (time, IP address, the request made, the browser or app version), so we can keep the service working and secure.
• Audit records of administrative actions, kept so that your company can see who changed what.

When you contact us or enquire

• What you send us through the Talk-to-sales form, support tickets, email, phone or WhatsApp: name, email, phone, company, role and the message itself.
• If you apply for a job with us, your application and résumé.

When you pay

• Invoices carry your company's legal name, address and GSTIN. Online payments are taken by Razorpay Software Private Limited; we never see or store your full card number, UPI PIN or bank password. We receive the payment reference, amount, status and the last four digits of a card where Razorpay provides them.

When you visit the website

• Server logs with IP address, pages requested, time and user agent, kept for security and capacity planning.
• Cookies and similar storage as described in the Cookie Policy. The website uses no advertising, analytics or cross-site tracking cookies.

We do not ask for, and you should not send us, sensitive personal data such as passwords for other services, financial account credentials, or health, caste or religious information, unless a specific feature of the product requires it and your company has configured that feature.

Where we rely on consent, you may withdraw it at any time by the means described in section 9. Withdrawing consent does not affect processing that happened before, and it may mean a feature that depends on it is not available.

We do not sell personal data. We share it only with:

• Service providers that host and run the service for us: application hosting (Render), database hosting (MongoDB Atlas), file storage for photos and documents (Amazon Web Services), email delivery, push-notification delivery (Expo and Google Firebase Cloud Messaging), server error monitoring, and payment processing. Each is bound by its terms to use the data only to provide its service to us.
• Razorpay, which processes online payments under its own privacy policy and RBI authorisation.
• Your company's administrators, who can see the data about you that sits in their workspace — that is the nature of an HR system, and it is their responsibility under the DPA.
• Government and law enforcement when the law requires it — for example a lawful order under the IT Act or BNSS, a GST or income-tax notice, or a CERT-In incident report. We disclose the minimum required and, where the law allows, tell the affected customer.
• A buyer or successor if Easy Connect is merged, acquired or sells the ECN People business, in which case this policy continues to apply and you will be notified.

Data is stored with the service providers listed in section 5. Some of them, including the file storage used for photos and documents, may store or process data outside India. Data is encrypted in transit, and we will follow any restriction the Central Government notifies under section 16 of the DPDP Act.

When the purpose for which data was collected is served and no law requires us to keep it, we delete it or anonymise it. Backups are rotated on a fixed schedule rather than edited, so deleted data may persist in an encrypted backup until that backup expires.

Data in transit is encrypted with TLS, and our database and file-storage providers encrypt data at rest. Passwords are hashed, never stored. Every record carries the company it belongs to and every request is filtered by it, so one company can never read another's data. Access by our own staff is limited to named people, requires two-factor authentication, and is logged. The Security page sets out the measures in more detail. We follow the reasonable security practices contemplated by section 43A of the IT Act and the SPDI Rules.

No system is perfectly secure. If a breach affects your personal data, it will be reported to the Data Protection Board of India and the affected people in the manner and time the DPDP Act and the CERT-In directions require, and we will tell affected customers without undue delay.

Under the DPDP Act you have the right to:

• Access — a summary of the personal data held about you and how it has been processed.
• Correction and erasure — to have inaccurate data corrected, incomplete data completed, and data that is no longer needed erased.
• Withdraw consent — as easily as you gave it.
• Grievance redressal — to have a complaint heard by a Grievance Officer and, if you are not satisfied, to approach the Data Protection Board of India.
• Nominate — a person to exercise these rights for you if you die or are incapacitated.

If you use the app through your employer, open Me → Privacy in the app to download a copy of your data, ask for a correction or deletion, nominate someone, withdraw optional consents or raise a grievance. Your employer is the Data Fiduciary for that data and replies within its response period (30 days by default); we help them answer as the DPA requires. For data we hold as Data Fiduciary, write to info@easyconnectnetwork.com from the email address on your account and we will respond within 30 days.

You also have duties under the DPDP Act: not to impersonate anybody, not to suppress material information, and not to register a false or frivolous grievance.

In the app, tap Me → Request data deletion. If you no longer have the app, email info@easyconnectnetwork.com. The request goes to your employer's HR team, who must act on it within 30 days unless your company has set a different period. Records the law requires your employer to keep, such as payroll and statutory attendance registers, are kept for the legal period. The steps, what is deleted, what is kept and the timelines are set out on Delete your ECN People account.

ECN People is a workplace product and is not directed at children. We do not knowingly collect personal data from anyone under 18 as Data Fiduciary. A customer that enters data about a minor — a school recording a student, say — does so as Data Fiduciary and must obtain verifiable parental consent as section 9 of the DPDP Act requires.

We use a small number of strictly necessary cookies and browser storage to keep you signed in and remember your theme and language. The full list, and how to control them, is in the Cookie Policy.

In accordance with the Information Technology Act, 2000, the rules under it and the DPDP Act, you can contact our Grievance Officer at:

We acknowledge grievances within 48 hours and resolve them within 30 days of receipt, or sooner where the law requires. If your grievance is about your employee records, your employer's own grievance officer is shown in the app under Me → Privacy. For anything else about privacy, write to info@easyconnectnetwork.com.

We will post any change here with a new 'last updated' date. If a change materially reduces your rights or expands what we do with your data, we will tell account administrators by email at least 30 days before it takes effect.