Privacy Policy

We collect information depending on how you interact with our Services, including:

• Account & Personal Information: name, email address, phone number, employee ID, and designation of individuals using the Services, provided directly or set up by an organization's HR administrator.
• Employment Information: department, designation, attendance, leave, payroll, and other HR records processed on behalf of the organization using our Services.
• Device & Usage Information: device type, operating system, app version, and general usage patterns that help us maintain and improve the Services.
• Location Information: collected through the mobile application only where relevant to attendance features. See "Location & Geo-Fencing" below for full detail.
• Photos & Attachments: images an employee chooses to upload, such as a profile picture or a leave request attachment. See "Camera & Gallery Access" below for full detail.
• Cookies & Analytics: Google Analytics loads only if you accept our cookie consent card; some pages also include embedded content, such as YouTube videos, that may set their own cookies. See "Cookies & Analytics" below for full detail.

• To provide, operate, and maintain the HCM services an organization has subscribed to — including attendance, leave, payroll, and related HR functions.
• To verify attendance through geo-fencing and location-based check-ins, where this feature is enabled by the subscribing organization.
• To communicate with you regarding your account, service updates, and support requests.
• To maintain the security, integrity, and reliability of our Services.
• To comply with applicable legal and regulatory obligations.

The VastHCM mobile application allows employees to mark attendance, apply for leave, view payslips, and access other self-service features on the go. We apply the same data protection standards to the mobile application as we do to our web platform, including encrypted data transmission, role-based access controls, and secure storage of employment records.

The application only requests the device permissions genuinely required for the features an employee uses — such as location for attendance verification, and photo access for uploading attachments — and does not request or access data on the device that is unrelated to these features.

Where an organization has enabled geo-fencing, the VastHCM mobile application uses an employee's device location to verify that attendance is being marked from an approved location. Location access is required for this feature to work — if location permission is not granted, attendance cannot be marked through the application, as location verification is a necessary part of both the check-in and check-out process.

In some configurations, an organization may enable background location access for its employees. This is used solely to send a timely reminder in case an employee forgets to mark attendance during the day — for example, a notification prompting a check-in or check-out. Background location accessed for this purpose is not stored, retained, or used for any other purpose within the system; it exists only to trigger the reminder and is not logged, tracked, or reviewed by VastHCM or the organization beyond that.

The VastHCM mobile application requests access to the device's camera and photo gallery solely to let an employee attach a document to a leave request or upload a profile picture. We do not access, scan, or browse the full photo gallery, and we do not access other content on the device such as contacts, videos, or unrelated images and files. Only the specific photo or file an employee chooses to select and upload is used by the application — nothing else on the device is read or stored.

Employee records, attendance history, and payroll data are protected with encryption both in transit and at rest, secure cloud hosting, and access limited to authorized personnel only — access to sensitive data like salary details is further restricted through role-based permissions, so only the right people within an organization can view it. Security is built into how VastHCM works, from mobile app logins to payroll storage, because we know this system holds information your organization depends on. That said, no online system is completely risk-free, and we can't guarantee absolute security.

We do not sell personal information. Information collected through VastHCM may be shared only with:

• An organization's own HR and administrative staff, so they can manage their team using VastHCM.
• Service providers who support our infrastructure, such as hosting and cloud storage, under confidentiality obligations.
• Authorities, only where required by law or to protect the safety of VastHCM, our clients, or others.

When you first visit our website, you'll see a cookie consent card asking whether to accept or decline analytics cookies. If you choose Accept, we load Google Analytics to understand website traffic and visitor behavior — such as which pages are visited and how visitors navigate our site — so we can improve the Services. If you choose Decline, Google Analytics is not loaded on your device, and your choice is remembered for future visits so you are not asked again.

Where enabled, Google Analytics uses cookies and collects information such as your IP address, device type, and browsing activity on our website. This data is processed by Google in accordance with Google's Privacy Policy.

Some pages also include embedded YouTube videos; if you choose to play one, YouTube (Google) may set its own cookies as part of the video player's functionality, independent of your analytics choice above. You can also control or block cookies at any time through your browser settings.

We keep employee, attendance, and payroll records for as long as your organization actively uses VastHCM, and afterward only as long as needed for legal, tax, or accounting obligations — for example, payroll records that must be retained for a set period under labor law. Once that period passes, the data is securely deleted or anonymized.

• Access: request access to the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to the relevant organization's data retention requirements and applicable law.
• Objection: object to certain uses of your personal information.

To exercise any of these rights, contact us using the details below, or reach out to your organization's HR team directly — since your employment data is managed by them as part of using VastHCM. You can also delete your VastHCM mobile app account at any time, directly from the app — see how to delete your account for step-by-step instructions.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Any material changes will be reflected by updating the "Last Updated" date at the top of this page.

If you have any questions or concerns about this Privacy Policy or how your information is handled, please contact us:

Email: sales@vasthcm.com

Phone: (+92) 334 1678916

Address: Suite # 203, Saima Paari Star, Block H, North Nazimabad, Karachi, Pakistan.