Draft prepared 10 October 2026. This is not a legally approved or effective policy. Its effective date remains subject to company and legal approval. Existing customer agreements and applicable law are not replaced by this draft.
1. Service and responsibilities
Mentrox OneHR is the HR and workforce management application developed by Mentrox Digital Solutions. No company registration number, registered office or separate legal entity details have been verified for this draft; those details require business approval before adoption.
Employer customers provide employee information and configure their company’s use of the service. The allocation of data-fiduciary/controller and processor responsibilities must be confirmed in the customer agreement and assessed under applicable law. This draft does not assume that every processing activity has the same legal basis.
2. Information the service handles
Business enquiries and demo requests can include a contact name, company name, work email, phone, industry, employee range, location, selected modules and a message. Account information includes user identity, credentials stored as password hashes, company association and access status.
Depending on enabled modules and customer entries, employee records may include contact and identity information, employment details, organization assignments, attendance, leave, salary, bank and statutory identifiers, documents, goals, review contributions, project/task records, expenses and assistant conversations. Customers should avoid unnecessary sensitive information and determine what is lawfully needed.
3. Purposes and lawful handling
The service uses configured records to support company and employee accounts, workforce administration, employee self-service, attendance/leave review, payroll records, documents and enabled operational workflows. Enquiry information supports evaluation and company-request administration.
Identity, access and selected audit information support authentication, authorization and investigation of relevant actions. Each employer must determine the lawful basis and notices needed for its workforce processing. Any additional marketing use or consent wording requires separate business/legal approval; it is not established by this draft.
4. Sessions, cookies and usage information
The application uses a sealed session cookie to maintain authenticated web access. The session cookie is configured as HttpOnly, SameSite=Lax and Secure in production. Mobile access uses its supported token mechanism. Browser storage and infrastructure logs may vary by deployed features and hosting.
No approved non-essential analytics or advertising cookie inventory has been established by this review. Before adopting this notice, confirm the live cookie/storage inventory, any trackers and whether additional consent controls are required. Do not describe this draft as a completed cookie-compliance assessment.
5. Sharing and service providers
Authorized company users may access records according to their role, enabled modules and permissions. Selected staff or service providers may need access for agreed support and operations, subject to the applicable arrangements. No sale of personal data or broad unrestricted sharing is authorized by this draft.
The inspected application includes PostgreSQL database access, configured SMTP email delivery and an Ollama-based AI response integration. These code paths do not establish a live subprocessor list or provider contracts. The hosting, storage, email and AI-provider inventory, recipients and purposes must be verified and approved before the policy becomes effective.
6. Retention, deletion and account closure
No fixed retention period or guaranteed deletion deadline has been verified. Retention should reflect agreed service needs, employer instructions, legal obligations and the need to preserve authorized financial records. The approved schedule must address employee documents, audit logs, financial history, assistant conversations and backups separately.
Account access expiry is not equivalent to deletion. Customers should confirm export, closure, deletion and backup treatment in their agreement. This draft does not promise a public export tool or irreversible deletion process that has not been verified.
7. Security and international transfers
The Security page describes implemented application access mechanisms and the infrastructure controls that still require deployment evidence. No certification or absolute security guarantee is offered in this draft.
Hosting regions, AI/email destinations and any international transfer arrangements have not been verified. Confirm whether cross-border processing occurs and assess applicable restrictions, contracts and disclosures before adopting this notice. The product’s India-facing content alone does not establish data residency.
8. Rights and requests
For employee record questions or corrections, contact your employer’s authorized HR team first. For a service privacy enquiry, use support@mentrox.in or mentroxdigitalsolution@gmail.com. Requests must be assessed under applicable law and the customer’s responsibilities after appropriate identity verification; avoid emailing passwords or unnecessary identity documents.
The final policy must confirm the responsible contact/grievance process and the rights, escalation routes and response obligations that apply when each provision is in force. No invented response deadline or appointed data-protection officer is published here.
9. Indian data protection commencement
The DPDP Act and Rules require provision-specific commencement and applicability review. The 2025 Rules bring some provisions into force on publication, Rule 4 after one year and specified substantive rules after eighteen months. As of this draft’s 10 October 2026 preparation date, it would be inaccurate to treat all provisions as already commenced.
Legal reviewers should check the Act’s separate commencement notification, the Rules, corrigenda and any later official changes against the actual service/data roles. This draft makes no claim of DPDP certification or completed compliance.
10. Updates and approval before adoption
Company and legal reviewers must approve service identity, actual purposes/lawful bases, cookie/provider inventory, retention/deletion, transfer arrangements, grievance contact and applicable legal notices. If adopted, publish an approved effective date and a clear change-notification process. Until then this page remains a review draft and is excluded from search indexing.