Privacy Policy

For employee data inside a customer workspace, the customer is the data fiduciary and Kiko is the data processor. We act on the customer's instructions.

For data we collect directly, such as a demo request or a support conversation, we are the data fiduciary.

Identity and contact data: name, work email, phone number, employee identifier and photograph where uploaded.

Employment data: role, department, location, manager, grade, joining date, employment type and exit details.

Payroll data: salary structure, bank account details, permanent account number, universal account number and statutory identifiers.

Attendance data: punches, leave requests and balances, regularisations and shift assignments.

Usage data: log records of who accessed which record and when, retained for audit.

To provide the service the customer subscribed to, including running payroll and producing statutory filings.

To keep the service secure, to investigate incidents, and to maintain an audit trail of privileged actions.

To meet legal obligations, including retention periods imposed by tax and labour law.

We share data with sub processors that host and operate the platform, and with statutory authorities where a customer files through Kiko. A current list of sub processors is available on request.

We do not sell personal data and we do not share it for advertising.

Customer data is stored in the region selected by the customer at the time the workspace is created. Indian workspaces are stored in India.

Where data moves across a border, it moves under contractual protections appropriate to the destination.

Active employee records are retained for as long as the workspace is active. After termination, customer data is retained for ninety days to allow export, then deleted.

Payroll and statutory records are retained for the longer period required by applicable tax law, typically eight financial years.

Individuals may ask for access to their data, correction of inaccurate data, erasure where no legal obligation requires retention, and a copy in a portable format.

Employees should raise these with their employer, who controls the workspace. We assist customers in responding within statutory timelines.

Data is encrypted in transit and at rest. Compensation, bank and statutory identifiers carry field level encryption. Access is role based and logged.

Our security practices are described in more detail on the security page.

Privacy questions and requests can go to privacy@kiko.co. Our grievance officer responds within the timelines set out in the Digital Personal Data Protection Act.