Last updated: August 19, 2026
This is a general template, not legal advice. Have it reviewed by a lawyer familiar with the data-protection laws of the countries you operate and hire in (e.g. Mauritius's Data Protection Act, GDPR if you have EU staff or customers) before relying on it.
ChaCha HR ("we", "us") provides a human resources management platform used by companies ("customers") to manage their own employees' data. This policy explains what personal data we process, why, and what rights you have — both if you're an administrator at a customer company, and if you're an employee whose data a customer has entered into the platform.
Depending on which modules a customer enables, this can include: name, contact details, job title and department, attendance and leave records, salary and payroll data, performance reviews, documents uploaded to the platform, and account credentials. We process this data as a processor on behalf of the customer, who remains the data controller for their employees' records.
To provide the service the customer has subscribed to (payroll runs, leave approvals, performance cycles, and so on), to secure accounts, to respond to support requests, and to meet legal or contractual obligations such as invoicing.
Each customer's data is logically isolated (multi-tenant architecture) — one company's employees, payroll, and documents are never visible to another company using ChaCha HR.
We retain data for as long as a customer's subscription is active, plus a limited grace period after cancellation to allow data export, after which it is deleted unless a longer retention period is required by law (e.g. statutory payroll record-keeping).
Depending on where you're located, you may have rights to access, correct, export, or request deletion of your personal data. Employees should generally direct these requests to their employer (the customer/data controller); administrators can reach us directly using the contact details below.
Questions about this policy can be sent via our contact page.