Privacy policy

1. Who processes the data

HR-ONE is an attendance and HR system delivered to companies as a service (SaaS). Every company using the system OWNS its employees’ data and decides how it is used; we store and process that data on the instructions of that company.

In practice this means: if you are an employee and you have a question about your own data, contact your company’s HR department first. If they cannot resolve it, write to the address below.

2. What data is collected

The system takes only the data required for attendance and HR work:

• Identifying data — surname, first name, position, branch and staff number; a phone number if the company enters one.
• Account data — the login and the CRYPTOGRAPHIC HASH of the password (the password itself is not stored and we cannot see it either).
• Attendance — arrival and departure times, lateness, early leaving, working days, leave and other requests.
• Images — profile photo, evidence attached to a lateness explanation, certificates and photos of completed tasks. The user uploads these THEMSELVES.
• Check-in selfie and face reference — the photo sent when checking in from the app, and a numeric vector derived from the portrait uploaded by HR. This is BIOMETRIC data; see section 3.
• Location — only if the company has enabled location recording during working hours. This is a SEPARATE feature and it is OFF by default; see section 4.
• Technical records — sign-in times, IP address and an action log. This is for security and for investigating disputes.

3. Face images: the terminal and the app are two different paths

Attendance is captured in two ways, and they treat the face image differently. Both are described openly below.

THE TERMINAL. The biometric terminal at the door (Hikvision) recognises the face ITSELF and stores the template in its own memory — the device sits inside the company’s building, on the company’s network. What reaches the server is NOT the face image but only the result: “the employee with this staff number passed at this time.”

THE APP. When an employee checks in from the app with “I have arrived”, the selfie they send DOES REACH THE SERVER and is stored there as attendance evidence. The server checks it against two questions: is this the face of that employee, and is this a live person (not a printed photo or a phone screen).

THE REFERENCE. To make that comparison, a face reference is kept for each employee. It is NOT a photograph but a numeric vector derived from one, and an image cannot be reconstructed from it. The reference is taken from the portrait uploaded by HR, NOT from the employee’s own selfie. It is stored encrypted, and it is deleted immediately when the photo is deleted.

The check runs on our own server — face data is not sent to any external artificial-intelligence service.

The result is a SIGNAL, not a verdict. The check-in has already been recorded by then and the check never cancels it; if something looks wrong, HR reviews it and a HUMAN makes the decision.

Face ID / Touch ID in the mobile app is separate from all of this: it is a feature of the phone itself and the app only receives a “yes” or “no”. Face data never leaves the phone.

4. Location: only during working hours

A company may enable location recording during working hours to confirm that an employee is at their place of work. This feature is OFF by default and each company turns it on itself.

When it is on, the app shows in full what will be collected and why BEFORE it asks for permission. If you do not grant permission, no location is collected.

• WHEN — only on working days and only during working hours (from shortly before the shift starts to shortly after it ends). Recording stops when the working day ends. It does not run at all on days off, public holidays or during leave.
• WHICH TIME WINDOW applies is calculated by the SERVER, not by the phone. The window follows your branch’s schedule and the work calendar.
• WHAT — coordinates, their accuracy, the time and the phone’s battery level. The battery level is kept so that situations such as “the phone died” can be explained.
• WHAT IS NOT COLLECTED — conversations, messages, calls, browser history, contacts or other apps. The app does not touch them at all.
• IT IS VISIBLE — a permanent notification on Android, and the location indicator at the top of the screen on iPhone. Recording is never done covertly.
• YOU CAN STOP IT AT ANY TIME — revoke the permission in your phone settings. Recording then stops and the employer sees that period as having no data.
• RETENTION — detailed points are deleted after 90 days; the daily summary (how many hours were spent at the workplace) remains.

5. Why it is used

The data is used only for the following purposes: calculating and displaying attendance; handling leave, sickness and correction requests; producing the timesheet that payroll is based on; sending notifications to employees; keeping the system secure and investigating disputes.

The data is NOT used for ADVERTISING and is not sold for profiling or automated decision-making.

The face check in section 3 is NOT an automated decision either: it is a signal for HR, and a human makes the decision.

6. Legal basis

Processing is carried out in accordance with Law of the Republic of Uzbekistan No. O‘RQ-547 “On Personal Data”.

The basis is the employment relationship: by law an employer must keep a record of working time. Where the law requires consent, it is obtained by the employer.

7. Where the data is stored

The data is stored on servers located in the Republic of Uzbekistan — this is a requirement of O‘RQ-547.

Each company’s data is isolated at the database level (PostgreSQL Row-Level Security). One company technically cannot see another company’s data.

Connections are encrypted with HTTPS, passwords are stored with a one-way algorithm, and database backups are encrypted as well.

8. Who it is shared with

The data is NOT SOLD to third parties and is not given to advertising networks. The system contains NO advertising identifiers and no tracking tools for advertising.

This is NOT THE SAME THING as the working-hours location in section 4: that location is visible only to your employer and is given to no one for advertising.

Who can see the data: authorised HR and management staff at your own company; HR-ONE specialists when it is necessary for technical support (such access is logged); and state bodies that make a lawful request.

If an employee uses the Telegram bot, messages pass through Telegram and Telegram’s terms apply to them. Using the bot is OPTIONAL.

NOTIFICATION DELIVERY. So that a notification arrives even when the app is closed, Google push (Firebase Cloud Messaging) is used. Google sees your device’s push address (token). The message ITSELF contains no data at all — no name, no time, no title: the phone only receives a “there is something new” signal, and the app fetches the text from our own server. The content of a notification therefore never crosses the border.

9. How long it is kept

Attendance and HR data is kept for the duration of the employment relationship and, after that, for the period required by labour law and accounting rules.

When an employee leaves, the company must remove their face from the terminal — the system raises a separate reminder about this in the HR panel.

Location is separate: detailed points are deleted automatically after 90 days, while the daily summary is kept.

The selfie sent when checking in from the app is attendance evidence and is kept for as long as the timesheet record it belongs to.

The face reference is deleted as soon as the employee’s photo is deleted.

Once the retention period ends, the data is deleted or brought into a form that does not allow a person to be identified.

10. Your rights

You have the right to:

• access the data held about you;
• have inaccurate or incomplete data corrected;
• have data deleted or processing blocked in the cases provided for by law;
• withdraw consent given for processing;
• complain to the competent state authority if you believe your rights have been breached.

11. Deleting your account

An employee CANNOT create an account inside the mobile app — it is opened by the company’s HR administrator. For that reason the account cannot be deleted from inside the app either.

To delete an account, contact your company’s HR department — they remove it through the panel. Or write directly to the address below: requests are handled within 30 days.

When an account is deleted, the sign-in credentials and the profile are revoked. Timesheet records that labour law requires to be kept may remain — that is a legal requirement.

12. Children

The system is intended for people in employment and does not knowingly collect data from anyone under 16.

13. Changes to this policy

This document may be updated. The “Last updated” date above changes each time, and companies are notified separately about significant changes.

14. Contact

For any question, request or complaint about privacy, please use the contact details below.

• contact@hr-one.uz
• +998 93 277 33 33