Orbigo HCM - Privacy Policy

Last Updated: June 10, 2026

Blue Rose Technologies ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you use the Orbigo HCM mobile application.

Note: User registration and employee onboarding are managed by your organization's HR system outside of this app. The app accesses your existing employee data (name and email) solely for authentication and app functionality purposes.

---

1. Information We Collect

1.1 Personal Information

• Name and email address
• Employee ID and professional information
• Bank account details for payroll purposes
• Work-related information (department, designation, location)
• Profile photos

1.2 Authentication Data

• Authentication tokens for secure login
• Microsoft Azure AD authentication credentials (stored securely)

1.3 Device Information

• Device model and operating system version
• Unique device identifiers
• Mobile network information

1.4 Usage Data

• App usage patterns and features accessed
• Timesheet entries and attendance data
• Leave requests and approval history
• Ticket submissions and support requests
• Document uploads and downloads

---

2. How We Use Your Information

We use your personal data for the following purposes:

• Providing and maintaining the Orbigo HCM application
• Authenticating users and securing access to the application
• Managing employee records and workforce operations
• Processing leave requests and timesheet submissions
• Managing support tickets and asset assignments
• Tracking employee deployments and project assignments
• Improving our services and user experience
• Communicating with you about important updates

---

3. Data Security

We implement appropriate security measures to protect your personal data:

• Secure authentication using Microsoft Azure AD OAuth 2.0
• Encrypted storage of sensitive data using flutter_secure_storage
• Secure HTTPS/TLS communication with our servers
• Regular security audits and updates
• Access controls and authentication for our systems

---

4. Data Sharing and Third Parties

4.1 Microsoft Azure AD

We use Microsoft Azure AD for authentication. When you sign in with your Microsoft account, certain information is shared with us as part of the authentication process.

4.2 No Sale of Personal Data

We do not sell, trade, or rent your personal identification information to others.

4.3 Authorized Personnel

Your data may be accessed by authorized personnel within Blue Rose Technologies who need access to perform their job duties.

---

5. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. When you delete your account, we will delete your personal data within 30 days, except where required by law.

---

6. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Object to processing of your personal data
• Withdraw consent at any time

To exercise these rights, please contact us at the email address provided below.

---

7. Children's Privacy

Orbigo HCM is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.

---

8. Changes to This Privacy Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page.

---

9. Contact Us

If you have any questions about this privacy policy, please contact us:

---

10. App Permissions

Orbigo HCM requests the following permissions:

• Internet: Required for API communication and data synchronization
• Storage: Required for downloading documents and file uploads