At Keka Technologies Private Limited, together with its subsidiaries and affiliated companies (collectively, “Keka,” “we,” “us,” or the “Company”), we understand that you entrust us with Personal Data, and that you have a right to understand how that information is collected, processed, used, disclosed, accessed, and corrected when you use our Keka Services or otherwise interact with us.
Keka provides software-as-a-service human resources management (“HRMS”) accessible through our website at www.keka.com (the “Site”), our mobile applications (the “Mobile Apps”), and related services delivered through our technology platform (collectively, the “Services” or the “Keka Services”).
This Privacy Policy is designed to comply with the General Data Protection Regulation (“GDPR”), the Digital Personal Data Protection Act, 2023 of India (“DPDP Act”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable data protection laws that are required to render the Keka Services. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.
Keka operates a software-as-a-service business model. This means we do not sell any Personal Data, and we do not monetise that data by selling advertising. Our Subscribers control the Personal Data they and their Authorised Users put into the Keka Services.
1.Definitions.
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
a. “Authorised User”. An individual authorised by a Subscriber to access and use the Keka Services, including the Subscriber’s employees, contractors, consultants, agents, or other personnel explicitly authorised by the Subscriber, whether such authorisation arises directly or through Keka’s authorised partners or distributors.
b. “Subscriber”. An entity that has entered into an agreement with Keka, whether directly or through Keka’s authorised partners or distributors, to access and use the Keka Services, together with its affiliates (for example, an employer that uses Keka to manage its workforce).
c. “Personal Data” / “Personal Information”. Any information relating to an identified or identifiable natural person, including but not limited to name, identification details, contact information, job title, employment records, HR data, attendance and time-tracking data, biometric attendance data, payroll information, location data, online identifiers (such as IP address, cookie identifiers, or device identifiers), and any data uploaded or provided by a Subscriber, an Authorised User, or a website visitor. Where applicable, “Personal Data” carries the meaning given to “personal data” under the GDPR, “personal information” under the CCPA/CPRA, and “personal data” under the DPDP Act.
d. “Data Fiduciary”. Under the DPDP Act, the person who alone or in conjunction with others determines the purpose and means of processing personal data — equivalent in function to a “Data Controller” under the GDPR.
e. “Data Principal”. Under the DPDP Act, the individual to whom the personal data relates — equivalent in function to a “Data Subject” under the GDPR.
f. “Data Processor”. A person who processes personal data on behalf of a Data Fiduciary or Data Controller, pursuant to a contract and the Data Fiduciary’s or Controller’s instructions.
g. “Processing”. Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure or transmission, dissemination, alignment or combination, restriction, erasure, or destruction.
h. “Services” / “Keka Services”. The software-as-a-service HRMS and payroll platform made available through the Site and the Mobile Apps, including all related functionality, modules, and support.
i. “Third-Party Services”. Third-party applications, platforms, integrations, or services accessible through or connected to the Keka Services, including external applicant tracking systems, social media platforms, partner websites, and OAuth-based integrations such as Google Workspace.
j. “Sub-Processor”. A third party engaged by Keka to process Personal Data on behalf of the Subscriber (as Data Fiduciary or Data Controller) in connection with the Services.
k. “Data Processing Addendum” or “DPA”. The contractual addendum entered into between Keka and a Subscriber that governs Keka’s processing of Personal Data as a Data Processor on the Subscriber’s behalf.
Subscribers and Authorised Users are collectively referred to in this Privacy Policy as “users,” “you,” or “your,” as the context requires.
2. Scope and Applicability.
This Privacy Policy applies to the Processing of Personal Data by Keka when individuals interact with us through the Site, the Mobile Apps, marketing channels, recruitment processes, customer support, or as Subscribers or Authorised Users of the Services. It also applies to Personal Data provided to Keka in connection with marketing communications, promotional activities, and Subscriber support relating to the Services.
This Privacy Policy does not apply to: (a) Third-Party Services that may be accessed through the Site, the Services, or the Mobile Apps, including external applicant tracking systems, social media platforms, or partner websites. The privacy practices of Third-Party Services are governed by their own privacy notices, and Keka is not responsible for those practices. (b) Personal Data processed by a Subscriber outside the Keka Services, including any separate internal privacy policy that a Subscriber (for example, your employer) maintains for its own workforce.
If you access the Keka Services as an Authorised User, your employer or organisation (the Subscriber) may maintain its own internal privacy notice describing how it processes your Personal Data and your rights in relation to that processing. We encourage you to review that notice alongside this Privacy Policy.
3. Controller versus Processor Roles.
Keka’s role in relation to Personal Data depends on the context of Processing and the purpose for which the data is handled. Under applicable data protection laws, Keka may act either as a Data Controller / Data Fiduciary or as a Data Processor, as described below:
Keka acts as a Data Controller (under the GDPR) or Data Fiduciary (under the DPDP Act) when it determines the purposes and means of Processing for its own business activities, including:
(i) Operation, security, and improvement of the Site and Mobile Apps;
(ii) Direct Marketing, sales, and promotional communications (including without consent for name and emails);
(iii) Recruitment and hiring for Keka’s own workforce;
(iv) Subscriber relationship management, billing, and support communications; and
(v) Compliance with Keka’s own legal and regulatory obligations.
In this capacity, this Privacy Policy directly governs Keka’s Processing, and individuals may exercise their rights directly with Keka.
Keka acts as a Data Processor when it Processes Personal Data strictly on behalf of, and under the instructions of, a Subscriber in connection with the Subscriber’s use of the Services. In this capacity:
(i) The Subscriber (for example, your employer) is the Data Controller or Data Fiduciary, and determines the purposes and means of Processing, including which modules are enabled and how your data is used within them;
(ii) Keka Processes Personal Data only in accordance with the Subscriber’s instructions, the terms of the Subscription Order Form, applicable law, and the governing Data Processing Addendum (“DPA”); and
(iii) Requests relating to access, correction, deletion, or other rights over data Processed in this capacity are directed to the Subscriber in the first instance.
Where Keka acts as a Processor, this Privacy Policy describes Keka’s general privacy and security practices applicable to such Processing, and the Data Processing Addendum between Keka and the relevant Subscriber governs Keka’s specific contractual obligations as Processor. In the event of any conflict between this Privacy Policy and a Subscriber’s DPA with respect to Processing carried out as Processor, the DPA shall prevail.
4. Categories of Personal Data.
The categories of Personal Data Keka collects depend on how you interact with us. The principal categories are set out below:
(i) Full name, display-name, date of birth, gender, nationality, and marital or family status;
(ii) Residential address, city, state/province, country, and postal code;
(iii) Phone number(s) and email address(es);
(iv) National identification numbers, social security or national insurance numbers, and government-issued identification details, where required for employment, payroll, or statutory compliance; and
(v) Emergency contact details, including name, relationship, phone number, email address, and address of the emergency contact.
(i) Job title, department, employee ID, employment start date, probation end date, and employment status;
(ii) Reporting structure, designation history, and organisational role;
(iii) Termination date and termination reason, where applicable;
(iv) Right-to-work documentation and credentials confirming eligibility to work in the applicable jurisdiction;
(v) Performance, appraisal, and disciplinary records, where the Subscriber has configured such modules; and
(vi) Any other employment-related information the Subscriber chooses to configure and collect through the Services.
(i) Bank account details, including bank name, account number, and branch address, for the purpose of salary disbursement;
(ii) Salary details, including pay period, payment frequency, base salary, gross salary, overtime, bonuses, commissions, and statutory payments such as sick leave or maternity/paternity leave pay;
(iii) Salary payment currency and tax codes;
(iv) Tax declaration and withholding information; and
(v) Reimbursement, expense, and benefits-related data, where applicable modules are enabled.
Where a Subscriber enables the optional Time and Attendance module, Keka Processes attendance records to calculate attendance and payroll according to rules configured by the Subscriber. Where a Subscriber deploys biometric attendance devices (such as fingerprint or facial-recognition terminals), Keka receives only the resulting attendance event data necessary to compute attendance and payroll and does not independently collect raw biometric images or templates through the Services.
Keka does not request, access, or track location-based information from your mobile device by default at any time while downloading or using the Mobile Apps. Certain optional features involve location data, including attendance verification configured by your employer (the Subscriber).
Keka automatically collects device and technical information when you use the Mobile Apps, including hardware and operating system identifiers, IP address and browser information, and app usage and diagnostic data.
(i) Contact details and the content of support tickets, chat transcripts, emails, and call records submitted to Keka’s support team;
(ii) Information provided when requesting a product demo, submitting feedback, or subscribing to communications; and
(iii) Records of communications between Keka and Subscriber administrators relating to account configuration or troubleshooting.
(i) Cookie identifiers and similar tracking technologies;
(ii) Pages visited, features used, and session duration on the Site; and
(iii) Aggregated analytics and performance metrics.
5. Children’s Personal Data.
Keka’s Services are designed for businesses and working professionals and are not directed at, or intended for use by, children. Keka does not knowingly collect Personal Data directly from a child otherwise than as permitted under applicable law. Under the DPDP Act, a “child” means an individual who has not completed the age of eighteen (18) years, and Keka does not knowingly Process a child’s Personal Data without the verifiable consent of the child’s parent or lawful guardian, and does not carry out tracking, behavioural monitoring, or targeted advertising directed at children. Where a Subscriber’s benefits, insurance, or emergency-contact modules involve the Personal Data of an Authorised User’s dependants (including minor children), Keka Processes that data strictly as a Data Processor on the Subscriber’s instructions, and it is the Subscriber’s responsibility to obtain any parental or guardian consent required before providing such data to Keka.
6. How Information Is Collected.
Keka collects Personal Data that you, a Subscriber, or a Subscriber’s administrator voluntarily provide — for example, when you contact us, request a demo, sign up for communications, submit a support request, apply for a job, or input data into the Keka Services in the course of using the Services.
When Subscribers use the Services, Keka Processes Personal Data relating to Authorised Users to the extent necessary to provide the modules the Subscriber has subscribed for. This Processing is carried out strictly on the Subscriber’s instructions, and Keka does not use such data for its own independent purposes.
Keka automatically collects certain technical, statistical, and usage information when you access the Site, the Mobile Apps, or the Services.
Keka also receives Personal Data directly from Subscribers, through business documents such as the Subscription Order Form, Master Subscription Agreement and related contractual exhibits, and through Subscriber support points of contact (SPOCs).
7. Location Information (Attendance-Related Location Tracking).
Where your employer (the Subscriber) enables location-tracking functionality within the Mobile App for timekeeping or attendance-verification purposes, you acknowledge that your location may be captured at the time of clock-in/clock-out events. The legal basis for this Processing is the performance of a contract and legitimate use necessary for employment purposes, subject to the Subscriber’s notice obligations to you. You may control location permissions for the Mobile App at any time through your device’s operating system settings. Disabling location access may affect the availability of location-dependent attendance features configured by your employer.
8. Attendance and Biometric Data.
Where a Subscriber elects to use the optional Time and Attendance module, Keka retains and Processes attendance logs consisting of an employee or attendance identifier together with timestamps of punches (clock-in and clock-out entries), for the purpose of calculating attendance and payroll according to rules configured by the Subscriber.
Where a Subscriber deploys biometric attendance hardware (such as fingerprint scanners or facial-recognition terminals), the resulting attendance event — a match confirmation and timestamp — is transmitted to and Processed within the Keka Services to record attendance. Keka does not, through the Services, independently collect or retain raw biometric images, fingerprint scans, or facial-recognition templates; any such raw biometric capture occurs at the Subscriber-controlled device or third-party hardware, outside the Keka Services, in accordance with the Subscriber’s own configuration and consent practices. Subscribers deploying biometric attendance devices are solely responsible for:
(a) providing Authorised Users with clear notice of biometric data collection;
(b) obtaining any consent required under applicable law, including the DPDP Act, GDPR, and any sector- or jurisdiction-specific biometric privacy statutes; and
(c) configuring retention and deletion of biometric data in accordance with such law.
9. Mobile App Permissions.
The Keka Mobile Apps may request the following device permissions, depending on the modules your employer has configured and the features you choose to use:
Permission
Purpose
User Control
Camera and Photo Storage
To allow you to take and upload photographs — for example, a profile picture or an expense receipt — only in ways you choose to initiate.
May be revoked at any time through device settings; the App will not access camera or photo storage without your permission.
Location
To support attendance and time-keeping features where enabled by your employer.
May be controlled through device settings; certain attendance features may be unavailable if disabled.
Notifications (Push)
To deliver alerts such as approval requests, attendance reminders, and announcements configured by your employer.
May be disabled through device or in-app notification settings.
Storage
To allow upload and download of documents, such as payslips or HR forms, within the App.
May be controlled through device settings.
Keka also uses mobile analytics software to better understand how the Mobile Apps function on your device. This software may record information such as how often you use the application, the events that occur within the application, aggregated usage and performance data, and the source from which the application was downloaded. This analytics data is not linked to the Personal Data you submit within the Mobile Apps.
10. Device Information.
When you download and use the Mobile Apps or access the Services through a browser, Keka automatically collects device and technical information, including operating system version and type, device model, hardware identifiers, IP address, browser type and version, and hardware usage statistics. The legal basis for this Processing is the performance of Keka’s contractual obligation to your employer (the Subscriber) to deliver the Services; this information is also used to support security, fraud prevention, troubleshooting, and product improvement.
11. Multi-Factor Authentication Information.
Where Keka or a Subscriber enables multi-factor authentication (“MFA”) to protect access to the Services, Keka may collect additional information to verify your identity when you sign in, such as a mobile number, email address, or a verification code generated by an authentication application or device. This information is used solely to secure your account and is not used for any other purpose.
12. Recruitment Information.
Keka collects Personal Data from individuals who apply for positions at Keka directly, and Processes candidate data on behalf of Subscribers who use the Services for their own recruitment activities.
(i) When you apply for a position with Keka, we collect your name, contact details, resume/CV, education and employment history, and any other information you choose to submit during the application process;
(ii) We use this information to evaluate your application, communicate with you about the recruitment process, and comply with applicable employment and record-keeping laws.
(i) Where a Subscriber uses Keka’s recruitment and applicant-tracking functionality to manage its own hiring, Keka Processes candidate Personal Data — including resumes, application responses, interview notes, and evaluation records — strictly as a Data Processor, on the Subscriber’s instructions;
(ii) Resume content submitted through such modules may be parsed using a third-party resume-parsing Sub-Processor to extract structured candidate data; and
(iii) Candidates applying through a Subscriber’s careers page or recruitment module should refer to that Subscriber’s own privacy notice for information about how their data is used, and should direct rights requests to that Subscriber.
13. Purposes of Processing.
Keka Processes Personal Data for the following purposes, with the applicable lawful basis varying by jurisdiction:
Nature of Processing
Purpose
Provision and operation of the Services
Contractual obligation / Legitimate use / Consent / Business purpose
Account creation and administration
Contractual obligation / Legitimate use / Business purpose
Subscriber support and communications
Legitimate interests / Legitimate use / Business purpose
Security, fraud prevention, and abuse detection
Legal obligation
Billing, invoicing, and payments
Legal / Contractual obligation / Legal obligation
Product improvement, analytics, and development
Legitimate interests / Business purpose
Marketing and promotional communications
Contractual obligation / Notice
Recruitment and hiring (Keka’s own workforce)
Consent / Legitimate interests / Business purpose
Compliance with applicable law
Legal obligation
14. Lawful Bases of Processing.
(i) Contractual obligation: Processing necessary to perform Keka’s contract with a Subscriber, or to provide a Service you have requested;
(ii) Legal obligation: Processing necessary to comply with applicable law, such as tax, employment, or financial-reporting requirements;
(iii) Legitimate interests: Processing necessary for Keka’s legitimate business interests (such as security, fraud prevention, or Subscriber communications), balanced against your rights and interests; and
(iv) Consent: Processing based on your freely given, specific, informed, and unambiguous consent, such as for optional location features.
(i) Consent: Processing based on free, specific, informed, unconditional, and unambiguous consent, obtained through clear affirmative action, in accordance with Section 6 of the DPDP Act;
(ii) Legitimate Use: Certain Processing permitted under Section 7 of the DPDP Act without consent, including where the Data Principal has voluntarily provided their data for a specified purpose and has not indicated they do not consent, for employment-related purposes in specified circumstances, or for compliance with a judgment or legal obligation; and
(iii) Legal Obligation: Processing necessary to comply with any law in force in India.
The CCPA/CPRA does not require a specific lawful basis in the manner of the GDPR or DPDP Act but instead requires that Processing be conducted for a disclosed “business purpose” or “commercial purpose,” with transparency obligations and consumer rights.
15. Data Sharing and Disclosure.
Keka does not sell Personal Data and does not share Personal Data for cross-context behavioural advertising, except where expressly permitted by applicable law and disclosed to you. We may disclose Personal Data to the following categories of recipients, subject to appropriate contractual and security safeguards:
(i) Affiliates and Group Companies. Keka’s subsidiaries and affiliated companies, for the purposes described in this Policy.
(ii) Sub-Processors. Third parties engaged to support delivery of the Services, such as cloud hosting, email and SMS delivery, push notifications, customer support tooling, resume parsing, data enrichment, and payment processing.
(iii) Professional Advisors. Auditors, legal counsel, insurers, and other consultants, where necessary for Keka’s legitimate business operations.
(iv) Government Authorities and Regulators. Where required by applicable law, regulation, legal process, or governmental request.
(v) Successors and Acquirers. In connection with a merger, acquisition, financing, or other corporate transaction.
(vi) Service Providers for Marketing and Mapping. Providers of email marketing, mapping, and similar services used in connection with the Site and Services.
(i) Third parties receiving Personal Data from Keka are contractually required to respect the security of such data and to treat it in accordance with applicable law;
(ii) We do not permit third-party service providers or Sub-Processors to use Personal Data for their own independent purposes; they may Process Personal Data only for the specified purposes and in accordance with our instructions;
(iii) Except as described in this Policy, you will be notified when your Personal Data is shared with new categories of third parties for materially different purposes; and
(iv) We do not knowingly sell the Personal Data of minors under 16 years of age and have not sold the Personal Data of California or Nevada residents in the preceding twelve (12) months.
We may access, preserve, and disclose Personal Data where we reasonably believe it is necessary to satisfy legal obligations, enforce this Privacy Policy, address fraud or security issues, respond to support requests, or protect the rights, property, or safety of Keka, our users, or the public.
Where you visit the Site, certain cookies and similar tracking technologies may allow third parties to display advertisements that are more relevant to you on their own websites. Under some data protection laws, this type of disclosure may be treated as a “sale” or “share” of Personal Data. Please see Keka’s cookie policy for details of the cookies used for this purpose, or use the cookie-management tool on the Site to opt out. Keka does not have actual knowledge that it sells or shares the Personal Data of individuals under sixteen (16) years of age.
16. International Data Transfers.
Personal Data may be transferred to, and processed in, countries other than the country in which you reside. Keka stores and Processes Personal Data in data centre regions selected for the Subscriber’s tenant, which may include Central India, North Europe, Central US, Southeast Asia, and the UAE, and as applicable, other locations outside the European Union or your home jurisdiction.
Where Personal Data is transferred from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with cross-border transfer restrictions, Keka implements appropriate safeguards, which may include:
(a) Adequacy decisions issued by competent authorities, where applicable;
(b) Contractual Clauses approved by the European Commission, incorporated into the applicable DPA; and
(c) Other lawful transfer mechanisms recognised under applicable law, including the UK International Data Transfer Addendum where relevant.
Where your Personal Data is transferred outside the EEA, we take reasonably necessary steps to ensure that it is subject to an appropriate and recognised legal adequacy mechanism, and that it continues to be treated securely and in accordance with this Privacy Policy. Keka’s headquarters is based in India, from which customer support services are provided; no customer data is stored at Keka’s headquarters, with the exception of customer support call recordings and related metadata. Before transferring Personal Data outside the EEA, the UK, or Switzerland, Keka conducts a transfer risk assessment to evaluate whether the safeguards described above provide a level of protection appropriate to the recipient jurisdiction.
17. Data Retention.
Keka, acting as a Data Processor, retains Personal Data Processed on behalf of a Subscriber only for so long as necessary to provide the Services to that Subscriber and as required to comply with applicable law, resolve disputes, and enforce our agreements. De-identified and aggregated data may be retained for longer periods for legitimate analytical and business purposes.
Data Processed within the Keka Services is backed up for system continuity and disaster-recovery purposes. Backup files are retained for not less than ninety (90) days and are not accessible for standard production operations, except for disaster recovery, security incident response, or maintaining system integrity, unless a longer period is required by applicable law or a specific Subscriber agreement.
Upon termination or expiry of a Subscriber’s services agreement with Keka, Keka provides the Subscriber limited access to the Platform for up to thirty (30) days, at no additional cost, solely to enable retrieval of Subscriber Data. Following the expiry of this thirty (30) day retrieval period, an automated, irreversible deletion process commences that permanently deletes the Subscriber’s data, subject to the Backup Retention period and any statutory retention obligations, unless a different period is specified in the applicable DPA or required by law. Once this deletion process has commenced, it cannot be reversed, and the deleted data cannot be recovered. Subscribers seeking to export their data should do so within the thirty (30) day retrieval period described above.
Keka may retain audit, statutory, and compliance records for the period required under applicable law, independent of the deletion cycle described above. Contract and billing information is retained for the period required under applicable tax, financial-reporting, and limitation-period laws (including the Limitation Act, 1963, where applicable), and in any event for at least five (5) years from the termination or expiration of the relevant Subscriber or vendor relationship.
Keka collects and retains usage data which includes metadata and statistical information concerning use of the Services that is not subject to the deletion procedures described above, and that may be retained for as long as reasonably required to conduct Keka’s business. You will not be identifiable from such retained usage data. Some data may also be retained on third-party Sub-Processor systems in accordance with each Sub-Processor’s own retention policies, as disclosed under the applicable DPA.
To support a Subscriber’s legal and regulatory obligations, Keka will, on request and not more than once in any twelve (12) months, provide the most recent independent third-party assurance reports and/or certifications (including SOC 2 Type II and ISO 27001), together with reasonable supporting security documentation, and will provide access to Keka’s Trust Vault (or equivalent trust/security portal) for review of applicable security documentation and attestations. Where these materials do not reasonably address a specific discrepancy or legal requirement, the Subscriber may submit a reasonable written security questionnaire limited to the Services and its use case, and Keka will respond within a reasonable timeframe. Where the Subscriber has a demonstrable legal right under applicable law to audit Keka in its capacity as a Data Processor, and the assurance materials and clarifications provided are insufficient to meet that legal requirement, the Subscriber may request an audit (an “Audit”); Keka may require the Subscriber’s relevant personnel to execute a non-disclosure agreement prior to such Audit. Any Audit shall be conducted virtually by default, limited to once every twelve (12) months, conducted at the Subscriber’s cost, and treated as Confidential Information.
18. Security Measures.
Keka maintains robust Technical and Organisational Measures (“TOMs”) to protect Personal Data throughout its lifecycle. These measures may include access controls, prevention of unauthorised product use, data transfer controls, encryption in transit and at rest, continuous monitoring, and incident response procedures. Keka may update its Security Safeguards from time to time at its discretion, provided that it continues to maintain a security programme consistent with industry-standard practices, including to address evolving threats, newly identified vulnerabilities, and changes to Keka’s services or infrastructure.
Keka maintains ISO/IEC 27001:2022 certification and SOC 2 Type II or comparable industry-standard attestations covering the Keka Services, reflecting Keka’s commitment to internationally recognised information security management practices.
(i) Keka limits access to Personal Data to personnel who require such access to fulfil Keka’s obligations under this Privacy Policy and applicable agreements;
(ii) Personnel with access to Personal Data are appropriately and periodically trained on requirements applicable to the Processing, care, and handling of Personal Data; and
(iii) Such personnel are bound by confidentiality obligations as required under applicable law, and Keka takes steps to ensure that staff with access to Personal Data are reliable, competent, and properly vetted.
(i) Keka maintains internal policies to notify the affected Subscriber without undue delay, and in any event within seventy-two (72) hours, in the event that Personal Data Processed by Keka on the Subscriber’s behalf is lost, stolen, or subject to unauthorised access, subject to applicable law and any instructions from a competent agency or authority;
(ii) Keka will cooperate with the affected Subscriber in investigating and remedying any such security incident;
(iii) Where a security incident involves Personal Data, Keka will promptly take remedial measures, including reasonable steps to restore the security of the affected Personal Data and to limit unauthorised or unlawful dissemination of that data; and
(iv) Keka maintains documentation regarding compliance with applicable legal requirements, including documentation of any known security incidents, and maintains reasonable insurance coverage in connection with data security risk.
19. External Links.
The Services may, from time to time, contain links to external sites. Keka is not responsible for the operation, privacy practices, or content of such external sites.
20. Data Subject Rights.
Your rights in relation to your Personal Data depend on who controls the data, the purpose and context of Processing, and your jurisdiction. This section explains the rights generally available to you and how to exercise them.
(i) Access: Request confirmation of whether your Personal Data is being Processed and obtain a copy of that data.
(ii) Correction / Rectification: Request correction of inaccurate or incomplete Personal Data.
(iii) Deletion / Erasure: Request deletion of Personal Data that is no longer required for the purpose it was collected, or where Processing is unlawful.
(iv) Restriction: Request that Processing be limited in certain circumstances.
(v) Withdraw Consent: Withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing carried out before withdrawal.
(vi) Lodge a Complaint: Where applicable local law provides such a right, lodge a complaint with your local data protection authority. Data Principals located in India, for example, may lodge a complaint with the Data Protection Board of India.
(vii) Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of the rights described in this Section.
The following rights are available under the GDPR and are not separately provided under the DPDP Act or the CCPA/CPRA:
(i) Objection: Object to Processing based on legitimate interests, or to direct marketing.
(ii) Data Portability: Receive your Personal Data in a structured, commonly used, machine-readable format, and transmit it to a third party.
If your Personal Data is Processed through the Services as an Authorised User of a Subscriber: Your employer or organisation (the Subscriber) is the Data Controller / Data Fiduciary in relation to that Processing. Requests relating to access, correction, deletion, restriction, or other rights over your employment-related data must be directed in the first instance to your employer. Keka will assist the employer in responding to such requests where the request is reasonable and as required under the applicable DPA. If your Personal Data is Processed directly by Keka (for example, as a website visitor, a prospective customer, or a candidate applying directly to Keka), you may submit your request directly to Keka using the contact details provided here.
Where you are an Authorised User, requests should be raised with your employer (the Subscriber), who will, as appropriate, contact Keka’s Data Protection Officer to action the request in accordance with the applicable DPA. Where you interact with Keka directly, you may submit requests to grievances@keka.com or to the Data Protection Officer at DPO@keka.com.
To protect the privacy and security of Personal Data, Keka may verify your identity (or, where applicable, the identity of the Subscriber raising a request on your behalf), request additional information to clarify the scope of a request, and decline or limit requests where legally permitted to do so. Keka will contact you (or the relevant Subscriber) if additional information is required to honour a request and will endeavour to respond within the timeframe required by applicable law, and in any event not more than thirty (30) business days, except where a shorter statutory period applies.
Where required or permitted under applicable law, including the DPDP Act, you may nominate another individual who may, in the event of your death or incapacity, exercise the rights available to you under this Privacy Policy and applicable data protection law. A nomination request may be submitted by raising the request with your employer, who will contact Keka’s Data Protection Officer, or directly to Keka where you interact with us outside the Authorised User context. Keka may request reasonable information or documentation to verify the identity of the nominee and the validity of the nomination. A nominee is entitled to exercise only such rights, and to such extent, as is permitted under applicable law.
Keka does not make decisions based solely on automated processing that produce legal or similarly significant effects on you in connection with the activities covered by this Privacy Policy.
21. DPDP Act Rights. Data Principals Located in India.
a. It has the following rights under the Digital Personal Data Protection Act, 2023:
(i) Right to Access Information: Obtain a summary of Personal Data being Processed and the Processing activities undertaken in relation to that data.
(ii) Right to Correction and Erasure: Request correction of inaccurate or misleading Personal Data, completion of incomplete data, updating of Personal Data, and erasure of Personal Data that is no longer necessary for the purpose for which it was Processed, unless retention is required for a legal purpose.
(iii) Right to Grievance Redressal: Raise a grievance regarding the Processing of your Personal Data and have that grievance addressed in a reasonable timeframe.
(iv) Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.
Requests to exercise these rights may be submitted by raising the request with your employer (where you are an Authorised User), who will contact Keka’s Data Protection Officer, or directly to Keka’s Data Protection Officer at DPO@keka.com where you interact with Keka directly. Keka will respond to verified grievances in accordance with the timelines prescribed under the DPDP Act and its implementing rules.
22. California Privacy Notice.
This Section applies to residents of California, Nevada, and Delaware, and supplements the rest of this Privacy Policy. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA/CPRA”), Nevada Revised Statutes Chapter 603A.300 et seq., and the Delaware Online and Personal Privacy Protection Act require certain disclosures regarding Keka’s privacy practices, set out below.
For purposes of this Section only, “personal information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. “Personal information” does not include publicly available information lawfully made available from federal, state, or local government records. This Section applies to personal information that Keka collects, uses, and discloses on the Site and in connection with the Services; it does not apply to Keka’s own employees, who are subject to a separate internal privacy policy.
(i) Identifiers: name, postal address, online identifier, IP address, email address, phone number.
(ii) Commercial information: products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
(iii) Internet or other electronic network activity: browsing history, search history, and interaction with our website, application, or advertisements.
(iv) Geolocation data: where enabled.
(v) Audio and video: if you visit a Keka facility equipped with CCTV, your likeness may be captured on video as you pass through secured areas.
(vi) Professional or employment-related information: where collected in connection with recruitment or the Services.
(i) Right to Know: You may request that we disclose the categories of personal information we have collected about you in the preceding twelve (12) months, the categories of sources of that information, our business or commercial purpose for collecting or selling it, the categories of third parties with whom we share it, and, where applicable, the specific pieces of personal information collected.
(ii) Right to Request Deletion: You may request that we delete personal information we have collected about you, subject to certain exceptions, such as where retention is necessary to comply with a legal obligation or for our legitimate business purposes.
(iii) Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
(iv) Right to Opt Out of Sale or Sharing: We do not sell personal information and have not sold the personal information of California or Nevada residents in the preceding twelve (12) months, nor do we sell the personal information of minors under sixteen (16) years of age. We also do not share personal information for cross-context behavioural advertising. You may nonetheless submit a request to opt out of any future sale or sharing by contacting grievances@keka.com.
(v) Right to Limit Use of Sensitive Personal Information: Where we Process sensitive personal information (such as precise geolocation or government identifiers), you may request that we limit its use to purposes necessary to provide the Services.
(vi) Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of your rights under the CCPA/CPRA.
The rights described in this Section apply in full to California residents under the CCPA/CPRA. Nevada residents are entitled under Nevada law (NRS Chapter 603A.300 et seq.) to the Right to Opt Out of Sale or Sharing described above; Keka extends the remaining rights in this Section to Nevada residents on a voluntary basis only, and not as a matter of Nevada law. Delaware residents are entitled to the rights described in this Section to the extent provided under the Delaware Online and Personal Privacy Protection Act.
To exercise your rights as a California resident, you may contact us at grievances@keka.com. When you submit a request, we will verify your request and identity, which may involve requesting additional information that we can match with records we hold. If we determine that requests are repetitive, excessive, or unfounded within a calendar year, we may decline to act on them; we ask that you submit requests thoughtfully. You may designate an authorised agent to submit a request to know or a request to delete on your behalf by providing that agent with written permission to do so, and by separately verifying your own identity with us. We will deny requests from agents who do not submit proof of authorisation, and requests submitted through an authorised agent are subject to the same verification process as direct requests. If you wish to exercise rights pertaining to personal information that Keka holds as a service provider or processor to a Subscriber (your employer), please direct your request to that Subscriber in the first instance.
You may also opt out of the sale or sharing of your personal information for targeted advertising by using the “Cookie Preferences” link in the footer of the Site, or by enabling the Global Privacy Control (“GPC”) signal in a supporting browser or browser extension.
23. Cookies and Similar Technologies.
Keka uses cookies and similar technologies on the Site to ensure functionality, security, analytics, and a seamless user experience.
(a) Strictly Necessary Cookies: required for the Site and Services to function, such as session and authentication cookies.
(b) Performance and Analytics Cookies: used to understand how visitors interact with the Site, enabling us to improve functionality and performance.
(c) Functional Cookies: remember your preferences to provide a more personalised experience.
(d) Marketing Cookies: where applicable and consented to, used to measure the effectiveness of marketing campaigns.
You may manage cookie preferences through your browser settings or through cookie-management tools provided on the Site. Please refer to our separate cookie policy, available on the Site, for further details regarding the specific cookies used, their purposes, and retention periods.
24. Business Transfers.
Keka may, from time to time, buy or sell business assets. In such transactions, user information is typically one of the business assets transferred. If Keka, or substantially all of its assets, is acquired, or if Keka undergoes a merger, reorganisation, or insolvency proceeding, Personal Data may be one of the assets transferred to or acquired by a third party. You acknowledge that such transfers may occur and that any acquirer of Keka or its assets may continue to use your Personal Data as set out in this Privacy Policy.
Where such a transfer occurs, we will notify affected individuals via email and/or a prominent notice on the Site of any change in legal ownership or in the uses of their Personal Data, together with any choices that may be available to them regarding their Personal Data.
25. Legal Requests and Law Enforcement.
In certain situations, Keka may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Keka reserves the right to access, read, preserve, and disclose information that we reasonably believe is necessary to:
(a) Satisfy any applicable law, regulation, legal process, or governmental request;
(b) Enforce this Privacy Policy, including investigation of potential violations;
(c) Detect, prevent, or otherwise address fraud, security, or technical issues;
(e) Respond to user support requests; or
(f) Protect the rights, property, or safety of Keka, our users, or the public.
Keka does not provide direct, unmediated access to Subscriber-controlled Personal Data to any government authority except where compelled by valid legal process, and, to the extent permitted by law, Keka will notify the affected Subscriber of such a request before complying, unless prohibited from doing so by the legal process itself or by a binding confidentiality obligation. Where Keka is legally permitted to do so, it will also assess and challenge requests it reasonably believes to be overbroad, unlawful, or improperly issued.
26. Contact Information.
If you have any queries regarding this Privacy Policy or Keka’s privacy practices, please contact us using the details below. We will make reasonable efforts to respond within a reasonable timeframe, and in any event not more than thirty (30) business days, except where a shorter statutory period applies.
Contact
Purpose
Email
Grievance Officer
General privacy questions, comments, and grievances under this Privacy Policy and applicable law.
The terms of this Privacy Policy govern the use of the Services and any information collected in connection with them. Keka may amend or update this Privacy Policy from time to time. The most current version will always be posted at https://www.keka.com/privacy-policy. Unless otherwise agreed with a Subscriber, Keka will endeavour to provide notice of material changes on the homepage of the Site. Such material changes will take effect seven (7) days after notice is provided on the Site. All other, non-material changes to this Privacy Policy take effect as of the stated “Last Revised” date, and your continued use of the Services following such changes constitutes your acceptance of, and agreement to be bound by, the updated Privacy Policy.
Looking for a modern HR platform?
See how Keka makes HR, payroll, and compliance effortless
Login
Payroll Suite
HR Suite
Talent Suite
Project Services Suite
