Data Processing Addendum

1. Roles

Your company is the data controller for the employee data it enters into PeopleVio. PeopleVio acts as the data processor, handling that data only to provide the HR functions your company enables.

2. Scope of processing

Personal data processed includes employee profile details, attendance and geolocation-at-check-in data (when geofencing is enabled), leave and comp-off records, salary and payslip data, and uploaded documents (identity, education, certifications).

3. Sub-processors

PeopleVio uses the following categories of sub-processors to operate the platform:

• Database hosting — MongoDB Atlas, for company-scoped, tenant-isolated records.
• File storage — Cloudinary, for uploaded documents and receipts.
• Transactional email — sent via SMTP, for account credentials and notifications.

4. Security measures

Passwords are stored hashed, never in plain text. Sessions are authenticated and scoped to a single company's tenant, so authenticated requests can never read or modify another company's records.

5. Data deletion

On request, and subject to the cancellation grace period described in our Cancellation and Refund Policy, your company's data can be permanently deleted from PeopleVio and its sub-processors.

6. Contact us

For a signed copy of this addendum or questions about data processing, email hello@peoplevio.in.