Payroll by Briltus

Privacy Policy

Last updated 22 October 2026

Effective from 22 October 2026.

This Privacy Policy explains how Briltus ("we", "us") collects, uses, shares and protects personal data through Payroll by Briltus (the "Service") and our website, in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.

Our role

  • Customer and website data (for example, the people who sign up, staff users of our customers, and visitors who contact us): we decide how this data is used, so we are the data fiduciary.
  • Employee data our customers enter (for example, salaries, PAN and bank details): our customer, the employer, is the data fiduciary, and we process this data on the employer's behalf and on their instructions. Employees should contact their employer first about this data.

Personal data we process

  • Account data: name, e-mail address, phone number and role of staff users; sign-in records.
  • Employee data entered by our customers: name, employee code, contact details, date of birth, gender, PAN, UAN, ESIC number, bank account and IFSC, designation, department, work state, salary and payroll details, attendance and leave, tax declarations and documents such as letters and Form 16.
  • Billing data: company name, GSTIN, billing address, contact e-mail and payment references. Card, UPI and net-banking details are collected by our payment gateway; we never see or store them.
  • Website and enquiry data: details you submit through our contact or demo forms.
  • Technical data: IP address, browser type, and security logs of sign-ins and important account actions.

Why we use it

  • To provide the Service: payroll calculations, payslips, reports, statutory files and the employee portal.
  • To create and secure accounts, including sign-in, two-step verification and fraud prevention.
  • To process payments and issue GST invoices.
  • To respond to enquiries and provide support.
  • To send service messages, such as payslip notifications, password resets and important changes to the Service.
  • To meet legal obligations, such as tax and accounting record-keeping.

We do not sell personal data, and we do not use employee data entered by our customers for advertising or for any purpose of our own.

Sharing

We share personal data only with:

  • service providers who help us run the Service (cloud hosting, e-mail delivery, payment processing), under contracts that require them to keep it confidential and secure and use it only for our instructions;
  • government authorities, courts or regulators where required by law;
  • a successor organisation, if our business is reorganised or transferred, subject to this policy.

Cookies

We use cookies that are needed to keep you signed in and to protect forms against misuse. We do not use advertising or third-party tracking cookies.

Security

  • All data is sent over encrypted connections (HTTPS), and each customer's data is kept logically separate.
  • Passwords are stored as one-way hashes; sign-in secrets are encrypted.
  • Accounts are locked after repeated wrong passwords, two-step verification is available, and important sign-in events are logged.
  • Access to customer data is limited by role and to what is needed.

No system is completely secure, but we work to protect personal data and will notify affected customers and authorities of a personal data breach as required by law.

Retention

  • We keep customer data while the account is active.
  • After an account is closed, we keep it for 90 days so it can be restored or exported, and then delete it.
  • We keep records we must hold by law, such as invoices and tax records, for the period the law requires.
  • Customers can download all their data at any time from Settings → Data export.

Your rights

Subject to the law, you can ask to access, correct, update or erase your personal data, withdraw consent where processing is based on consent, nominate another person to exercise your rights, and raise a grievance. Employees should send requests about payroll data to their employer, and we will help the employer respond. To contact us, write to info@briltus.com. We respond within the time required by law.

Children

The Service is meant for businesses and is not directed at children.

Changes

We may update this policy. The effective date at the top shows when it last changed, and we notify customers of significant changes.

Grievance Officer

Grievance Officer, Briltus, Hyderabad, Telangana. E-mail: info@briltus.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.