This policy explains how the organization operating this Financial Management System collects, uses, stores, and protects information. The organization deploying the system is the personal information controller for information processed through its installation.
1. Information we collect
- Account and profile information, including name, email address, contact number, address, employee details, department, position, and profile image.
- Authentication and security information, including password hashes, verification records, login/logout events, failed attempts, approximate IP address, browser/device information, and security logs.
- Financial and business records, including accounts, vendors, customers, invoices, bills, receipts, reimbursements, budgets, taxes, journal entries, approvals, and payment references.
- Uploaded documents, including supplier invoices, billing proof, official receipts, customer payment proof, reimbursement evidence, and support attachments.
- Support communications, notification preferences, audit history, and actions performed in the system.
2. Why we process information
Information is processed to create and secure accounts; operate accounting and financial workflows; verify transactions and supporting documents; manage approvals; provide reports and notifications; respond to support requests; prevent misuse; maintain audit trails; comply with legal, accounting, tax, and recordkeeping obligations; and protect the organization’s legitimate business interests.
3. Legal basis and responsible use
Depending on the relationship and applicable law, processing may be based on consent, performance of a contract, compliance with legal obligations, or legitimate interests. The system should collect only information that is relevant to authorized financial operations.
4. Who may access information
Access is limited by assigned role and business need. Authorized administrators, finance personnel, staff, auditors, support personnel, and service providers may access information only as necessary. Information may also be disclosed when required by law, regulation, court order, tax authority, or a valid government request.
5. Storage and retention
Records are retained only for as long as required for operational, accounting, audit, tax, contractual, security, or legal purposes. Financial entries and audit records may be retained longer than ordinary account information because they support statutory and historical records. The operating organization must define and enforce its specific retention schedule.
6. Security
The system uses role-based access, password hashing, session controls, approval workflows, audit logging, and other safeguards. No online system can guarantee absolute security. Users must protect their credentials, avoid sharing OTP codes, sign out of shared devices, and report suspicious activity promptly.
7. Browser storage and sessions
The system uses session cookies or similar technologies to keep users signed in securely. It may use browser storage for limited preferences such as theme, remembered email, or current-account display state. Passwords are not intentionally stored in browser storage.
8. Data accuracy and user rights
Subject to applicable law, individuals may request information about processing and may request access, correction, blocking, deletion where legally permitted, objection, portability, or withdrawal of consent. Some financial or audit information cannot be deleted when retention is required by law or necessary to preserve transaction integrity.
9. Uploaded documents
Users must upload only documents they are authorized to provide. Files may contain personal or confidential information and are available only within permitted workflows. Do not upload passwords, OTP codes, private keys, or unrelated sensitive information.
10. Third-party services and hosting
The operating organization may use hosting, database, email, backup, or security providers. Those providers may process limited information to deliver their services and should be bound by appropriate confidentiality and security obligations.
11. Changes to this policy
This policy may be updated when system features, practices, or legal requirements change. The revised date will appear above. Material changes should be communicated through the system or another appropriate channel.
12. Contact
For privacy questions or requests, contact the organization’s system administrator or authorized privacy contact. Signed-in users may also use Settings → Help & Support. Complaints may be raised with the appropriate data protection authority when applicable.