GDPR Compliance

The General Data Protection Regulation (EU) 2016/679 (GDPR) governs how organisations collect, process, and protect the personal data of individuals in the European Union and European Economic Area. FabHR is committed to full GDPR compliance — both as a data controller for our own marketing and operational data, and as a data processor when handling HR data on behalf of our customers.

FabHR relies on the following lawful bases under GDPR Article 6:

• Contract — processing necessary to deliver the subscribed Service (e.g., storing employee payroll data to run payroll)
• Legal obligation — processing required to comply with applicable law (e.g., statutory payroll filings)
• Legitimate interests — product analytics, fraud prevention, and security monitoring
• Consent — marketing communications and non-essential cookies (opt-in, withdrawable at any time)

As a processor, FabHR processes customer HR data solely on the documented instructions of the customer (controller) in accordance with our Data Processing Agreement.

FabHR's platform is designed to help controllers fulfil data subject rights under GDPR Articles 15–22:

• Right of access (Art. 15) — employees can view their own HR records via the self-service portal at any time
• Right to rectification (Art. 16) — HR admins and employees (where permitted) can update personal data directly in the platform
• Right to erasure (Art. 17) — data can be anonymised or deleted through admin controls; FabHR assists with technical deletion on request
• Right to portability (Art. 20) — structured CSV/JSON exports are available for all HR data sets
• Right to restriction (Art. 18) — data processing can be restricted at the record level pending a dispute resolution
• Right to object (Art. 21) — automated profiling features can be disabled per employee on request

For DSR requests not resolvable through self-service, contact privacy@fabhr.in. We respond within 30 days (extendable by 2 months for complex requests with notice).

EU and EEA customers can select Frankfurt (EU-Central) as their primary data region. Customer personal data stored in this region will not be transferred outside the EU/EEA without appropriate safeguards.

Where cross-border transfers are unavoidable (e.g., certain sub-processor infrastructure), FabHR relies on the EU Standard Contractual Clauses (2021) as the transfer mechanism, supplemented by technical measures such as encryption-at-rest with customer-held keys for Enterprise customers.

All sub-processors engaged by FabHR to deliver the Service are subject to GDPR-compliant data processing agreements. A current, full list of sub-processors is available at privacy@fabhr.in. We provide 30 days' advance notice of any changes to the sub-processor list, giving customers the opportunity to object before processing begins.

In the event of a personal data breach affecting customer data, FabHR will notify the customer without undue delay and within 72 hours of becoming aware of the breach, as required by GDPR Article 33. We include all information required under Article 33(3) — nature of the breach, categories affected, approximate records impacted, likely consequences, and remediation steps. We also maintain a register of all security incidents as required by Article 33(5).

FabHR maintains records of all processing activities carried out as both a controller and a processor, as required by GDPR Article 30. Extracts of processing records relevant to your subscription are available on written request to dpa@fabhr.in.

FabHR conducts Data Protection Impact Assessments (DPIAs) for all new features that involve high-risk processing of personal data (e.g., AI-based profiling, biometric attendance). Summaries of relevant DPIAs are available to Enterprise customers under NDA on request. We are prepared to assist customers who need to conduct their own DPIAs for their use of FabHR.

FabHR has appointed a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance programme. You can contact the DPO directly:

Email: privacy@fabhr.in

Postal: FabHR DPO, Bengaluru, Karnataka, India

Our full standard Data Processing Agreement (DPA) is available online and applies automatically to all FabHR customers. Enterprise customers who require a countersigned DPA should contact legal@fabhr.in. We aim to return executed DPAs within 5 business days.