Privacy Policy

This policy explains how PT Bridge Smart Link accesses, collects, uses, stores, protects, and deletes user data in the hcTech HRIS application.

Last updated: August 13, 2026

1. Identity of the Operator

hcTech HRIS is an HRIS and attendance application managed by PT Bridge Smart Link. The application supports employee administration, attendance, work schedules, requests, approvals, notifications, and other HRIS functions available within the application.

Company: PT Bridge Smart Link
Application: hcTech HRIS
Privacy / IT Contact: support@hctech.id

2. Data We May Process

Depending on the features used and the user’s access permissions, hcTech HRIS may process the following categories of data:

• Identity and employment data, such as name, employee number/code, email address, phone number, job title, department, and profile information managed within the HRIS system.
• Account and authentication data, such as login information, session tokens, security settings, PINs, and authentication information required to protect account access.
• Attendance and schedule data, such as Clock In/Clock Out times, work schedules, attendance status, lateness, overtime, attendance location, notes, and histories of related requests and approvals.
• Location data, including the device’s location when attendance is recorded, if the user has granted location permission.
• Photos and camera data, including selfies taken during attendance or when other features require camera or photo access.
• Facial verification data, in the form of mathematical representations of facial features (face embeddings/templates) used for 1:1 identity verification of the currently logged-in user.
• Device and notification data required for the application to send or receive notifications and perform application security and operational functions.

3. Use of Location Data

hcTech HRIS uses location permission to validate whether attendance is recorded at a location that complies with company policy, including validation of the permitted attendance radius or other location policies applicable to employees.

Location data is not used for advertising. It is processed for HRIS operations, security, audits, and attendance validation.

4. Camera, Selfies, and Facial Verification

The camera is used for features that require photographs, including attendance recording. For attendance that uses facial verification, the user’s selfie is compared against the facial template of the employee who is currently logged in.

hcTech HRIS uses a 1:1 facial verification mechanism. The system does not search the user’s face against the entire employee database to determine a person’s identity.

During enrollment, the system generates a face embedding/template. The template is stored in encrypted form for verification purposes. Enrollment sample photos are not intended to be retained as permanent records after the template creation process is complete.

Attendance selfies may be retained as attendance evidence according to operational requirements, audit needs, and the company’s internal policies.

5. Purposes of Data Use

User data is processed only to the extent necessary to operate hcTech HRIS, including to:

• authenticate users and secure their accounts;
• display HRIS information according to access permissions;
• record and validate Clock In and Clock Out events;
• validate attendance locations;
• verify identity using facial verification;
• manage schedules, overtime, permissions, leave, and HRIS requests;
• send work-related notifications and information;
• maintain system security and prevent misuse;
• support audits, troubleshooting, and company administration.

6. Sharing and Processing by Third Parties

PT Bridge Smart Link does not sell users’ personal data and does not use hcTech HRIS user data for interest-based advertising.

To operate the application, certain data may be processed by service providers supporting system operations, such as hosting/cloud services, object storage, notification delivery, email services, security services, and other supporting technology providers. Such providers receive only the data needed to deliver the relevant services and are subject to applicable security measures and terms.

Data may also be disclosed when required by law, regulations, valid legal processes, or requests from competent authorities.

7. Data Security

We implement reasonable technical and organizational safeguards to protect user data against unauthorized access, alteration, disclosure, or use.

Such measures may include user authentication, role-based access restrictions, HTTPS/TLS connections, private storage for documents/photos not intended for public access, and encryption of facial verification templates.

Although we strive to maintain appropriate safeguards, no electronic system can be guaranteed to be entirely free of security risks.

8. Data Retention

Data is retained for as long as needed to operate HRIS functions; meet employment administration, security, audit, and dispute resolution requirements; comply with company policies; and/or fulfill applicable legal obligations.

When data is no longer required and there is no obligation to retain it, the data may be deleted, anonymized, or otherwise processed in accordance with PT Bridge Smart Link’s data retention procedures.

9. Account and Data Deletion

Users may submit requests relating to access, correction, or deletion of personal data through their company’s HR/Admin team or the privacy contact below:

support@hctech.id

Requests will be verified to protect user accounts and data. Data that must be retained for legal, employment, audit, security, or legitimate company interests may continue to be stored for the necessary period.

10. Device Permissions

hcTech HRIS may request certain device permissions only when required by application features, including:

• Camera — for attendance selfies and features that capture photos.
• Location — to validate attendance locations.
• Photos/media — when users select or upload images through available features.
• Notifications — to deliver application and HRIS-related notifications.
• Device biometrics — when users enable device biometric authentication to secure account access.

Users can manage these permissions in their device settings. Denying certain permissions may prevent the associated features from functioning.

11. Children

hcTech HRIS is an HRIS application intended for internal workforce use and parties authorized by PT Bridge Smart Link. The application is not designed for children as general users.

12. Changes to This Privacy Policy

This Privacy Policy may be updated if application features, business processes, technology, internal requirements, or applicable regulations change. The update date will be displayed at the top of this page.

13. Contact Us

For questions about the hcTech HRIS Privacy Policy or the handling of personal data, please contact:

PT Bridge Smart Link
IT Team / Privacy Contact
support@hctech.id

By using hcTech HRIS, users understand that their data will be processed in accordance with the application’s functions, PT Bridge Smart Link’s internal policies, and applicable laws.