Privacy Policy

1. Who we are and what this covers

Humio is a cloud service for leave, expense claims, attendance and payroll, provided by Nuvio Technologies, registration no. 202602486669 (003891431-V) (“we”, “us”).

This policy explains how we handle personal data when you visit our website, sign up, or use Humio, and your rights under Malaysia's Personal Data Protection Act 2010 as amended (“PDPA”).

2. Our role: your employer decides, we process

Humio is used by companies (“Customers”) to manage their own employees. For the personal data a Customer puts into Humio about its people — employee records, leave, claims, receipts, attendance, face scans, pay and tax details — the Customer is the data controller and decides why and how that data is processed. We process it on the Customer's behalf, only to provide the service and as described in our Terms of Service.

If you are an employee and have a question about your data in Humio, or want to exercise a right over it, please contact your employer first. We will help your employer respond.

We are the data controller for our own data: the accounts of people who sign up for Humio, billing contacts, support conversations, and visitors to our website.

3. Personal data we process

Accounts

Name, work email address, company name and country, and the roles a person holds (Admin, HR, Manager, Employee). Passwords are handled by our authentication provider and stored only in hashed form; we never see them.

Employee records

What a Customer enters: employee number, job title, department, reporting manager, employment type and status, hire and exit dates, work location, phone number and which public holiday calendar applies.

Leave

Leave type, dates, reason, contact details during leave, approval decisions and notes, and supporting documents such as medical certificates, which are health data.

Expense claims

Receipt images and the details on them — merchant, date, amounts, tax and currency — including the values our receipt reader extracted, whether the employee changed them, and approval and reimbursement history.

Attendance and face scans

Clock-in and clock-out times, a face reference photo each employee registers, the photos taken at each scan, and a similarity score from comparing the two. Face images used for recognition are biometric data.

Location, for work locations and events held at a venue

A Customer can set up work locations — a site with a radius around it — and assign employees to them, and can give a training, offsite or company event a venue and a radius. When it has, the browser of an assigned employee clocking in or out, or of an employee checking in or out of that event, asks for the device's location and sends the reading — latitude, longitude, and how accurate the device says it is — to our server, which measures the distance to the site and accepts or refuses the scan on it.

That reading is not stored, and we do not keep a record of where anyone was. It is used for the distance check and discarded; what is kept is the check-in itself and, for a clock-in or clock-out, the name of the work location it matched. Location is read only at the moment of a scan, only for employees assigned to a work location or events that have a venue, and never in the background or between scans. Employees with no work location clock in and out without their location being read.

The sites themselves are kept by the Customer: for a work location, its name, address, coordinates, radius and the employees assigned to it; for an event, the name and address the Admin picked, its coordinates, the radius they set, and Google's ID for that place.

Payroll

What a Customer enters to run payroll: salary, allowances and deductions, bank name and account number, EPF, SOCSO and income tax numbers, and IC or passport number. For Malaysian income tax (PCB and Form EA): tax residence, marital status and whether a spouse works, whether the employee or their spouse has a disability, the number of children claimed for, benefits in kind, zakat deductions, and figures from a previous employer. From these we produce payslips and Form EA (C.P.8A), which record pay, contributions and tax for each month and year.

Billing

Plan, billing period, number of active employees, invoices and payment status. Card details are entered on and held by our payment processor, Stripe; we never receive full card numbers.

Technical and security data

Sign-in session data, IP addresses and request information in server logs, usage counts for features with fair-use limits, and audit records of administrative actions.

Connected Google Calendar

Only if you choose to connect it: an encrypted access token from Google, the ID of the calendar Humio created in your Google account, and when you connected it. See Google Calendar integration.

Connected Outlook calendar

Only if you choose to connect it: an encrypted access token from Microsoft, the ID of the calendar Humio created in your Microsoft account, and when you connected it. See Outlook integration.

Push notifications

Only if you turn them on, and only for the browsers you turn them on in: the notification address your browser issues for Humio (its “push endpoint”), the two keys your browser generates so that only it can read what we send, a description of the device taken from your browser (such as “Chrome on Android”) and when it last connected. See Push notifications.

Communications

What you send us through the contact form on our website — name, email, phone number, company, team size and your message — by email, or on WhatsApp, and when you contact support or billing. WhatsApp conversations are also handled by WhatsApp (Meta) under its own terms and privacy policy.

4. Sensitive personal data: health, biometrics and beliefs

Medical certificates and face scans are sensitive personal data under the PDPA and need the explicit consent of the person concerned. So is a disability recorded for tax relief, and a zakat deduction, which can reveal a person's religion.

• Customers must obtain that consent from each employee before they upload medical documents or use face attendance, tell employees how the data is used, and offer a reasonable alternative to anyone who does not consent.
• A face scan is compared only with that same employee's own reference photo, to confirm who is clocking in. It is not used to identify anyone else, not shared between companies, and not used for any other purpose.
• Scan photos are deleted automatically after 90 days. A reference photo is kept until HR resets it or the employee's record is deleted.
• Medical certificates can be opened only by the employee, their reporting manager and the Customer's HR.
• Pay and tax details can be seen only by the Customer's HR. Each employee sees their own payslips once a payroll run is finalised, and their own Form EA once HR releases it.

5. How we use personal data

We use personal data to:

• provide Humio: sign-in, routing requests to the right approver, calculating leave balances, recording attendance, and keeping approval histories;
• calculate pay, statutory contributions (EPF, SOCSO, EIS and LINDUNG 24 Jam) and monthly tax deductions, and produce payslips and Form EA;
• read receipts automatically and suggest values for the employee to confirm, and compare face scans to confirm attendance;
• measure how far an employee is from the venue when they check in or out of an event their employer has set a venue for;
• add approved leave for you and your department to your Google Calendar, if you connect it;
• add approved leave for you and your department to your Outlook calendar, if you connect it;
• run subscriptions and billing, including counting active employees and applying fair-use limits;
• keep the service secure: enforcing separation between companies, preventing abuse, investigating incidents, and keeping audit records;
• provide support and send service messages such as invitations, approval requests and decisions, payslips, trial reminders, billing notices and service announcements;
• send occasional news about Humio, which you can turn off at any time in your email preferences;
• reply to enquiries sent through our website or WhatsApp;
• meet our legal, tax and accounting obligations.

We do not sell personal data, use it for advertising, or use Customer data to train our own models.

Automated processing

Receipt reading only suggests values, which the employee confirms before submitting, and approvers can see where a scanned amount was changed. Face matching decides whether a scan counts as a clock-in; if it fails, HR can record attendance another way. The venue check works the same way: the distance decides whether an event check-in or check-out is accepted, and a device that fixes its position poorly — indoors, or on a weak signal — can be refused while the employee is genuinely there, which HR can likewise record another way. Payroll figures are calculated automatically from the data HR enters, but HR reviews each run, can change any figure, and decides when to finalise it. None of these makes a decision about pay, leave or employment on its own.

6. Google Calendar integration

If your employer turns on calendar sync for your company, you can choose to connect your own Google account so that approved leave for you and your department appears in your Google Calendar. It is optional: Humio works fully without it, and no one else — not your employer and not us — can connect your account for you.

What we access

When you connect, Google asks you to allow Humio to “make secondary calendars, and see, create, change, and delete events on them”. Humio creates one calendar in your Google account, named “Humio – Team leave”, and uses the permission only to keep that calendar up to date. We cannot see or change your other calendars or their events, your contacts, or anything else in your Google account.

What goes into the calendar

Approved leave that has not yet ended, for you and for everyone in your department in Humio: each person's name, their leave type (for example “Annual leave” or “Medical leave”), the dates, and whether a half day is in the morning or afternoon. Leave is added when it is approved and removed if it is cancelled. The reason someone gave and any attachment, such as a medical certificate, are never sent to Google. Pending and rejected requests are never included.

This means colleagues' leave is copied into the Google accounts of department members who connect, and a leave type such as medical leave can reveal something about a person's health. The calendar is not shared with anyone else unless you share it yourself, so please do not.

When your details change

• If you move department, your Humio calendar is rebuilt with your new department's leave, and your own leave moves to your new colleagues' calendars.
• If your employer suspends, offboards or deletes your account, we disconnect you as described below, so you no longer hold your colleagues' leave.
• If your employer turns calendar sync off, everyone in the company is disconnected as described below.
• You can connect one calendar at a time. Connecting a different one disconnects the first as described below.

What we store

An access token from Google, encrypted, that lets us update the Humio calendar; that calendar's ID; and when you connected. Nothing else from your Google account is stored.

How we use Google user data

Humio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• use it only to keep the Humio calendar up to date;
• do not transfer it to anyone, except as needed to provide this feature, to comply with the law, or as part of a merger or sale of our business;
• do not sell it or use it for advertising;
• do not let our staff read it, unless you ask us to for support, or it is needed for security or to comply with the law;
• do not use it to train artificial intelligence or machine learning models.

Disconnecting

You can disconnect at any time in Humio. We then delete the Humio calendar from your Google account, revoke the token with Google, and delete the token and calendar ID.

You can also remove Humio's access from your Google account at myaccount.google.com/connections. We then delete the token when we next try to use it, but we can no longer reach the calendar, so please delete the Humio calendar in Google Calendar yourself.

7. Outlook integration

If your employer turns on calendar sync for your company, you can choose to connect your own Microsoft account — a work or school account, or a personal Outlook.com account — so that approved leave for you and your department appears in your Outlook calendar. It is optional: Humio works fully without it, and no one else — not your employer and not us — can connect your account for you.

What we access

When you connect, Microsoft asks you to allow Humio to “have full access to your calendars” and to “maintain access to data you have given it access to”. Microsoft offers no narrower permission that lets an app create a calendar, so this one technically reaches all of your calendars. Humio uses it only to create one calendar in your account, named “Humio – Team leave”, and to keep that calendar up to date. We never read, change or delete your other calendars or their events, and we do not access your email, contacts, files or anything else in your Microsoft account.

With a work or school account, your organisation may require its administrator to approve Humio before you can connect.

What goes into the calendar

Approved leave that has not yet ended, for you and for everyone in your department in Humio: each person's name, their leave type (for example “Annual leave” or “Medical leave”), the dates, and whether a half day is in the morning or afternoon. Leave is added when it is approved and removed if it is cancelled. The reason someone gave and any attachment, such as a medical certificate, are never sent to Microsoft. Pending and rejected requests are never included.

This means colleagues' leave is copied into the Microsoft accounts of department members who connect, and a leave type such as medical leave can reveal something about a person's health. The calendar is not shared with anyone else unless you share it yourself, so please do not.

When your details change

• If you move department, your Humio calendar is rebuilt with your new department's leave, and your own leave moves to your new colleagues' calendars.
• If your employer suspends, offboards or deletes your account, we disconnect you as described below, so you no longer hold your colleagues' leave.
• If your employer turns calendar sync off, everyone in the company is disconnected as described below.
• You can connect one calendar at a time. Connecting a different one disconnects the first as described below.

What we store

An access token from Microsoft, encrypted, that lets us update the Humio calendar; that calendar's ID; and when you connected. Microsoft issues a replacement token as we use it, and we store the replacement in place of the old one. Nothing else from your Microsoft account is stored.

How we use Microsoft user data

We use information received from Microsoft only to provide this feature. In particular, we:

• use it only to keep the Humio calendar up to date;
• do not transfer it to anyone, except as needed to provide this feature, to comply with the law, or as part of a merger or sale of our business;
• do not sell it or use it for advertising;
• do not let our staff read it, unless you ask us to for support, or it is needed for security or to comply with the law;
• do not use it to train artificial intelligence or machine learning models.

Disconnecting

You can disconnect at any time in Humio. We then delete the Humio calendar from your Microsoft account and delete the token and calendar ID. Microsoft gives apps no way to cancel just their own token, so deleting our only copy is how we give up access.

To also withdraw the permission you gave Humio, remove it at myapps.microsoft.com for a work or school account, or account.live.com/consent/Manage for a personal account. If you do that before disconnecting in Humio, we delete the token when we next try to use it, but we can no longer reach the calendar, so please delete the Humio calendar in Outlook yourself.

8. Who we share it with

Within a Customer

People in the same company see what their role allows: approvers see the requests routed to them, HR and Admins see their company's records, and pay details are limited to HR. No one sees another company's data.

Service providers (sub-processors)

Each is bound by data protection terms and processes data only to provide their service to us. We have opted out of AWS using content processed by Textract and Rekognition to improve its services.

Venue search and the map preview run only while an Admin is setting up an event. No employee location is ever sent to Google — the distance to a venue is measured on our own servers. The Directions link shown on an event is an ordinary Google Maps link: nothing is sent until an employee chooses to follow it, and what happens after that is between them and Google.

Google, if you connect Google Calendar

When someone connects, we send Google the approved leave of everyone in their department — names, leave types and dates — as described in Google Calendar integration. Google holds it as part of that person's Google account, under Google's own privacy policy.

Microsoft, if you connect Outlook

When someone connects, we send Microsoft the approved leave of everyone in their department — names, leave types and dates — as described in Outlook integration. Microsoft holds it as part of that person's Microsoft account, under Microsoft's own privacy statement or, for a work or school account, their organisation's agreement with Microsoft.

Our own staff

A small number of authorised staff can see account-level information — company, plan, and each user's name, email, role and sign-in status — to run billing and provide support. Every such view is logged. We access other Customer data only when needed to resolve an issue you have raised, or as required by law.

Legal requirements and business transfers

We may disclose data where required by law or a lawful request from authorities, to protect rights and safety, or to a successor if our business is sold or reorganised, who must honour this policy.

9. Transfers outside Malaysia

Data is stored with Amazon Web Services in Asia Pacific (Singapore), and payment data is processed by Stripe, which may be outside Malaysia. We transfer data only where the destination has substantially similar data protection laws or adequate safeguards are in place, such as our providers' data processing terms, as the PDPA requires. Leave synced to Google Calendar is stored by Google, which may be outside Malaysia. Leave synced to Outlook is stored by Microsoft, which may be outside Malaysia. Venue searches and map previews are served by Google, which may be outside Malaysia. If you turn on push notifications, they are delivered through the push service your browser chooses — Google, Apple, Microsoft or Mozilla — which may be outside Malaysia. The contents are encrypted so that only your browser can read them; see Push notifications.

10. How long we keep it

A Customer can export its expense records at any time, including after its subscription has ended.

We keep backups so data can be recovered after a mistake or failure. Something deleted from Humio can remain in them for up to 35 days before it is gone for good. Face photos and exports are the exception: they leave the backups within a day of being deleted.

11. How we protect it

• Data is encrypted in transit and at rest.
• Every company's data is kept separate, and each request is checked on our servers against the company and role of the person making it.
• Receipts, medical certificates and face photos are never publicly accessible; they open only through short-lived links issued to people allowed to see them.
• Payslip emails carry the payslip as a PDF attachment; the email text itself contains no pay figures.
• Approval histories cannot be edited, and administrative actions are logged.

No system is perfectly secure. If a data breach affects personal data we process for a Customer, we will tell that Customer promptly and help it meet its obligations. Where we are responsible, we will notify the Personal Data Protection Commissioner within 72 hours and affected individuals where the law requires.

12. Your rights

Under the PDPA you may:

• ask for access to, and a copy of, your personal data;
• ask for inaccurate or incomplete data to be corrected;
• withdraw consent, including for biometric or health data;
• ask us to stop direct marketing;
• ask for your data to be transferred to another provider;
• complain to the Personal Data Protection Commissioner.

For data in your employer's Humio account, please ask your employer. For anything else, email xqteoh@thenuviotech.com. We respond within 21 days and may need to verify your identity first. Withdrawing consent for face scans means you will need another way to record attendance with your employer, and so does declining to share your location for a work location or an event held at a venue.

13. Push notifications

You can choose to have Humio notify you on your phone or computer when a request is waiting for your decision, when your own leave or expense claim is decided, and when a new payslip is available. This is off until you turn it on, and you turn it on for one browser at a time under Notifications in your account menu.

When you turn it on, your browser issues an address for notifications and generates a pair of keys that only it holds. We store those, a description of the device such as “Safari on iPhone”, and the time it last connected — never the contents of anything we have sent you.

Delivery goes through the push service your browser belongs to: Google's for Chrome and Android, Apple's for Safari, Mozilla's for Firefox, Microsoft's for Edge. Each notification is encrypted to your browser's keys before it leaves us, so the push service carrying it cannot read it. It does see that we sent something to your device, and when.

Notifications are deliberately brief and never carry salary figures: a payslip notification says that one is ready, not what is on it, because a notification can appear on a locked screen in front of whoever is nearby.

You can turn notifications off for the device you are using, or remove another device from the list, on the same Notifications page; blocking notifications in your browser's own settings also stops them. Doing so deletes the registration. We delete it too, without being asked, as soon as a notification cannot be delivered — which is what happens when you clear your browser's site data or uninstall the app.

14. Cookies and similar technology

We use only what the service needs to work: cookies and browser storage that keep you signed in, and remember your theme and sidebar preferences. We do not use analytics or advertising cookies.

Stripe's checkout and billing pages, which open on Stripe's own website, set their own cookies under Stripe's privacy policy.

If you connect Google Calendar, Google's sign-in and permission pages set their own cookies under Google's privacy policy.

If you connect Outlook, Microsoft's sign-in and permission pages set their own cookies under Microsoft's privacy statement.

The map shown to an Admin setting an event's venue is a Google Maps frame, which sets Google's own cookies under Google's privacy policy.

If you turn on push notifications, Humio installs a service worker — a small script your browser keeps so it can receive them. It does no tracking and stores nothing about you; see Push notifications.

15. Children

Humio is a workplace service and is not intended for anyone under 18.

16. Changes to this policy

We will post any change here with a new effective date. For material changes we will also notify Customer Admins by email or in the app before the change takes effect.

17. Contact us

Nuvio Technologies
Data Protection Officer: Teoh Xin Quan, Co-founder
Email: xqteoh@thenuviotech.com

You can also reach the founders directly:

• Alex Beh, Founder — WhatsApp +60 16-251 8214, email alex@thenuviotech.com
• Teoh Xin Quan, Co-founder — WhatsApp +60 10-241 7618, email xqteoh@thenuviotech.com

See also our Terms of Service.