Privacy Policy

Introduction and Purpose: 

Zimyo is a Human Resource Management Software (HRMS) company , dedicated to providing innovative solutions for efficient HR operations . Our HRMS services encompass various aspects , such as , Employee Management , Payroll Processing, Attendance Tracking , and more. This Privacy Policy outlines our commitment to protecting the privacy and personal data of individuals who interact with our platform. 

At Zimyo , we recognise the importance of safeguarding Personal Data and maintaining the trust of our users . This Privacy Policy aims to inform individuals about how we collect , use, store , and protect their Personal Data , as well as their rights and choices regarding their information . 

Definitions: 

1. Personal Data: Any information that relates to an identified or identifiable individual.
2. Data Subject: The individual to whom the Personal Data belongs.
3. Processing: Any operation performed on personal data , such as collection , recording , organization , storage , retrieval , or disclosure. 

Scope: 

This Privacy policy applies to the Personal Data Collected , processed and stored by Zimyo’s HRMS . It covers all the platforms, applications, websites, and services provided or owned/governed by Zimyo that involve the handling of Personal Data . 

What does Zimyo’s Privacy Policy Covers? 

Some data protection laws in various jurisdictions distinguish between “Controllers” and “Processors” of Personal Information. While other jurisdictions may use different terminology, the concept typically remains the same. A Controller decides why and how to process Personal Information. A Processor only processes information on behalf of a controller based on the instructions of the controller, the Processor does not make decisions about Personal Information. Zimyo may be either a Controller or a Processor , depending on the scenario. 

1. This Privacy Statement applies when Zimyo is the Data Controller of your Personal information (unless a different Zimyo privacy statement is displayed when we collect your personal information), and explains how Zimyo collects, uses, and shares your Personal Information for its own purposes. For example, this Privacy Statement covers when you: 
2. Visit a Zimyo website that links to this Privacy Statement; 
3. Interact with Zimyo as a representative of a company that has an account with Zimyo (e.g., you are our customer or our supplier); 
4. Create or use an account offered directly by Zimyo (as opposed to an account offered by our customers); 
5. Register for or attend a Zimyo marketing, learning, or training event or webinar; 
6. Provide us with feedback about our products or services; 

Receive a sales or marketing communication from us, including emails or telephone calls. 

This Privacy Statement does not cover how we process Personal Information on behalf of our enterprise customers as a processor. 

Types of Personal Data Collected:

We may collect personal data when you visit our website, request a demo, register for events, contact us, subscribe to communications, apply for employment, or use our HRMS platform. 

Categories of Personal Data may include: 

• Identity Information: Full name, nationality, date of birth (where applicable) 

• Contact Information: Email address, phone number, business address 

• Professional Information: Job title, employer details, employment information, salary/HR data (when processed on behalf of customers) 

• Technical Information: IP address, browser type, device identifiers, operating system 

• Usage Information: Website interactions, preferences, survey responses 

• Sensitive Personal Data (where applicable): Health information, biometric data, government identification details. 

Such data is processed strictly in accordance with applicable law and customer instructions.

How We Use Personal Data 

We use personal data for the following purposes: 

• Providing access to our HRMS platform and website features 

• Delivering customer support and responding to inquiries 

• Managing employment and payroll functions (as a data processor for customers) 

• Improving our products, services, and user experience 

• Ensuring system security and fraud prevention 

• Complying with legal and regulatory obligations 

• Sending marketing communications (where legally permitted) 

• Conducting internal audits and analytics 

Where required by law, we rely on appropriate lawful bases such as consent, contractual necessity, legal obligation, or legitimate interest. Where Zimyo processes personal data on behalf of customer organizations, such processing is carried out strictly under a binding Data Processing Agreement and in accordance with documented instructions from the customer, who remains the Data Controller. 

Zimyo processes personal data only where there is a lawful basis under applicable law, including consent of the data subject, necessity for the performance of a contract, compliance with a legal obligation, protection of vital interests, or legitimate business interests that do not override fundamental rights. 

 Zimyo as Data Controller and Data Processor

Depending on the circumstances: 

• Zimyo acts as a Data Controller when collecting personal data directly from website visitors, prospects, or employees. 

• Zimyo acts as a Data Processor when processing employee data on behalf of customer organizations using our HRMS platform. 

In such cases, data is processed strictly in accordance with customer agreements and applicable data processing terms. 

Use of Artificial Intelligence (AI)

Zimyo may use AI-driven technologies to: 

• Automate HR workflows 

• Enhance analytics and reporting 

• Improve employee engagement insights 

• Personalize user experiences 

Such processing is conducted transparently, proportionately, and with appropriate safeguards to ensure fairness and data protection compliance. 

Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to: 

• Improve website functionality 
• Analyze traffic and usage trends 
• Enhance user experience 
• Support marketing and advertising efforts 

You may disable cookies via browser settings; however, some features of the Site may not function properly. 

We may use third-party analytics services (e.g., Google Analytics) to understand user interaction. These services collect anonymized statistical information. 

Disclosure of Personal Data

We may share personal data with: 

• Cloud hosting providers 
• IT service providers 
• Payment processors 
• Marketing service providers 
• Regulatory authorities (where legally required) 
• Professional advisors (legal, audit, compliance) 

All third parties are contractually bound to maintain confidentiality and implement adequate security safeguards. 

In case of a merger, acquisition, or business restructuring, personal data may be transferred as part of the transaction, subject to confidentiality protections. Zimyo reserves the right to disclose personal data where required to comply with applicable law, regulatory inquiry, court order, or lawful government request. 

Data Retention & Account Deletion

Zimyo Technologies Limited, established in the Dubai International Financial Centre (DIFC), processes Personal Data in accordance with DIFC Data Protection Law No. 5 of 2020 and applicable regulatory requirements. 

Upon termination or expiry of a Customer’s subscription, access to the platform will be disabled. Personal Data may be retained for up to thirty (30) days solely to facilitate data retrieval, unless otherwise agreed in writing. Following this period, Personal Data will be securely deleted or irreversibly anonymized, except where continued retention is required for statutory, regulatory, audit, dispute resolution, or legal compliance purposes. 

Zimyo acts as a Data Processor and processes Personal Data strictly on documented instructions from the Customer, who acts as the Data Controller. 

Data Subjects may exercise their statutory rights, including rights of access, rectification, erasure, restriction of processing, and data portability, through the relevant Data Controller. Zimyo will provide reasonable assistance to Customers in fulfilling such obligations as required under applicable DIFC law. 

Data Retention

We retain personal data only for as long as necessary to: 

• Fulfill contractual obligations 
• Comply with legal and regulatory requirements 
• Resolve disputes 
• Enforce agreements 

Upon expiry of retention periods, data is securely deleted or anonymized in accordance with our internal data retention and deletion policies. 

Data Security Measures

Zimyo implements industry-standard technical and organizational measures, including: 

• End-to-end encryption of sensitive data 
• Role-based access controls 
• Multi-factor authentication 
• Secure cloud infrastructure 
• Periodic vulnerability assessments 
• Security audits and monitoring 

To the maximum extent permitted by applicable law, Zimyo shall not be liable for any indirect, incidental, consequential, or special damages arising from unauthorized access to personal data, except where such liability arises from Zimyo’s gross negligence or willful misconduct. 

Data Breach Notification

In the event of a personal data breach, Zimyo will take appropriate remedial actions and notify affected customers without undue delay in accordance with applicable data protection laws and contractual obligations. Where required by law, notifications will be made to competent regulatory authorities. 

Payment Information

Zimyo does not store full credit or debit card details on its servers. Payment information is processed through secure, PCI–compliant third–party payment gateways. 

We do not sell, rent, or trade personal payment information. 

Your Rights Under Applicable Law

Subject to applicable data protection laws, individuals may have the right to: 

• Request access to their personal data 
• Request correction of inaccurate data 
• Request deletion of personal data 
• Restrict or object to certain processing 
• Withdraw consent (where applicable) 
• Request data portability 

To exercise these rights, please contact us using the details below. 

Children’s Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If such data is identified, it will be promptly deleted. 

Third-Party Websites

Our Site may contain links to third-party websites. Zimyo is not responsible for the privacy practices of external websites. We encourage users to review their respective privacy policies. 

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. Updates will be posted on this page with a revised “Last Updated” date. 

Continued use of the Site after updates constitutes acceptance of the revised Privacy Policy. 

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact:

Email: support@zimyo.com