Privacy Notice

Two roles, two kinds of data

When an employer uses EasyHR for its employees, candidates and workers, the employer decides why and how that data is used and EasyHR processes it on the employer's behalf (see the Data Processing Terms). Questions about your own employment records should go to your employer first.

For the people who sign up for EasyHR, run a company on it, or visit our website, EasyHR decides how the account and billing data is used. That is covered here.

What we handle

• Account data: name, work email, company name, role, sign-in history.
• Employer-entered HR data: identity and contact details, employment, pay, leave, attendance, claims, permits and passport details of foreign workers, medical-check outcomes, documents and photos.
• Candidate data: details and documents a job applicant submits through an application link.
• Billing data: plan, add-ons, invoices. We do not store card numbers.
• Technical data: IP address, device and browser information, error logs.

Why we use it

• To provide the service the employer asked for: payroll, leave, attendance, compliance tracking, recruitment, onboarding and reports.
• To keep the service secure, prevent abuse and fix faults.
• To bill for the service and answer support requests.
• To meet legal duties.

Who sees it

Only people the employer authorises see its data. Each customer's data is separated from every other customer's. EasyHR staff do not read customer HR data except to give support the customer has asked for, and such access is logged.

We use a small number of service providers (sub-processors) to run the service. They are listed on the Sub-processors page.

How long we keep it

Employers control how long employee data is kept, subject to the retention periods in Malaysian law. Job applicants who are not hired are purged after the retention period the employer sets (default 12 months). After a customer ends its subscription we keep its data for the export period in the Terms, then delete it, apart from records we must keep by law.

Your rights

You may ask to see the personal data held about you, to correct it, to limit its use, or to withdraw consent. For employment data, ask your employer. For anything else, write to our support team. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia.

Security and breaches

Data is protected with access controls by role, separation between customers, encrypted connections, hashed passwords and an audit trail of changes. If a personal data breach occurs we tell the affected customer without undue delay so that it can meet its own notification duties.

Contact

Data protection contact: our support team.