×
Content Marketing Nearshore Software Development Shopify Careers Our Community Our Client Stories
Book a call

Privacy Policy

Data Privacy and Protection Policy pertaining to Integriti Group Pvt. Ltd., Pakistan & Integriti Group Inc., Canada.

SECTION 1: Employer and Employee Privacy Responsibilities

1.1) Employer Rights

  1. Any type of work or product created or derived from assets of the employer is the exclusive Intellectual Property (IP) of the employer.
  2. Employee must follow and oblige to all the protocols and policies established in the company’s intranet.
  3. No move shall be made by the employee to offload the company’s data to a personal network or device, including, but not limited to, USB flash drives, External hard drives, Solid state drives, Personal Google Drive, Personal Dropbox, or any other type of personal physical storage or personal cloud storage. Employer has the autonomy to set in place all lawful technical procedures to counteract such actions.
  4. Employer has the right to deploy and pursue all necessary litigation and prosecution in case of evident malfeasance committed by employee(s).
  5. All physical and intangible assets granted by the employer must be returned and submitted by the employee at the time of resigning.
  6. Rightful owner of the data can request a change of update to the data should there be any inaccuracy found.
  7. Due to security reasons, there are CCTV cameras installed all over office and employees should know that the employer reserves the right to refer to the recordings in matters demanding such an action.
  8. Office premises is integrated with biometric verification. Employer can ask for new hires’ fingerprints to enable their access.

1.2) Employee Rights

  1. The employer cannot monitor employees chats unless there is a discrepancy to be investigated. In such case, the employer can revoke the privacy of the employee and notify the person of concern.
  2. The employer must protect the Personally Identifiable Information (PII) of all its employees. This includes but not limited to email address, mailing address, social security number, phone number and pictures. Also included are the technological factors like IP address, log in ID, social media post, biometric, geolocation and behavioural data.
  3. Employer offered benefits like medical insurance and its data should be strictly guarded by the insurance company and the employer. Under no circumstances should this data be used or shared in anyway without the consent of the employee.
  4. Performance record of the employee can only be accessed by the authorized personnel. Employees may ask to see their performance summary.
  5. Financial record and payslips are all managed by the employer’s respective finance department and should not be disclosed to anyone unless there is a need by law to report such information to the government.
  6. Employee has the right to access his/her data and data controller must comply with such a request within 30 days of the time request was made.
  7. Any data breach should be reported within 72 hours of the breach to all the concerned entities.
  8. Any data that employer collects from employees, for example fingerprints for office access or picture for employee card is the sole property of employee and is not shared with anyone. In case an employee leaves the company, such data is permanently deleted.
  9. Any sort of media (e.g., pictures, videos) taken at company events etc., should not be taken, posted or shared without the consent of the employee(s).
  10. If the employees believe that their privacy has been encroached, they have the right to lodge a complaint with the company’s Privacy Official.

SECTION 2: Business Data Privacy

The business scope of Integriti Group Pvt. Ltd., Pakistan & Integriti Group Inc., Canada is as following:

2.1) Talent Acquisition Services (TAS)

Under this scope, the company works in a partnership with vendors that help facilitate the talent acquisition operations.All employees using services of these vendors fall:

  1. under the vendors respective data privacy and protection policy as outlined in the table below
  2. under clauses of 1.1 (Section 1)

Vendor Service
Sterling Required for background check of candidates. Corporate Services department of Integriti Group Pvt. Ltd. shares candidate information for the purpose of validation. Such information comprises of candidate name, address, date of birth and work visa/immigration details. All information is dealt under the terms and conditions of data privacy set forth by this document and Sterling Privacy Policy.
Manatal Provides applicant tracking system and stores all information of present and past candidates whether they were offered job or rejected by Integriti Group Pvt. Ltd and Integriti Group Inc. clientele. Integrated with Secured Signing to inscribe signatures on official documents. The signed documents automatically become a part of candidate’s profile on the ATS. Their respective Data privacy policy can be found at Manatal Privacy Policyand Secured Signing Privacy Policy.
Zoom Phone Provides medium of correspondence between the acquisition specialists and the candidates. All messages and calls done by specialists are monitored by Zoom. Their privacy policy can be found at Zoom Privacy Policy.
Beeline Used for onboarding of candidates and relevant affairs. Beeline (Contractor Depot) are for contractors who are on our payroll. They fill their timesheets on Beeline which are approved from their managers on a weekly basis. Once approved Integriti pays them depending on their pay schedule. Their privacy policy can be found at Beeline Privacy Policy.
LinkedIn Sales Navigator by LinkedIn LinkedIn premium sales tool used for candidate sourcing by the acquisition specialists. Their privacy policy can be found at LinkedIn Privacy Policy.

2.2) eCommerce Solutions

Working as a service provider, the company will follow strict privacy rules (mentioned under section 4) regarding website hosting and any data/information exchanged in the process of platform development between the company and the client.

However, the client itself is responsible for implementing specific data privacy and protection policy for its store according to its scope of operation and geolocation. This may include maintenance of user privacy online, information collection methods, unauthorized access resulting from data breaches, intellectual property re-selling, auditing and log files etc. For information on these or anything else, contact with the client should be made.

Integriti Group Pvt. Ltd. & Integriti Group Inc. shall not be considered liable or responsible for any issue, problem, accident or complaint originating or caused from the client’s data privacy and protection policy.

SECTION 3: Data Protection Safeguards

Financial data is managed in the following ways and falls under the privacy and protection policies mentioned in this document:

  1. Wagepoint is used for salary history, tax record of people on Integriti’s payroll and transfer of wages. Wagepoint is for transfer of salaries and funds to contractors (placed at clients’). Only the company’s Finance department, the company Partners and Corporate Services department has access to Wagepoint.
  2. Quickbooks is used for accounting and bookkeeping. Financial statements are generated through Quickbooks. Only the company’s Finance department, the company Partners and Corporate Services department has access to QuickBooks.
  3. For incorporated contractors and referral vendors we transfer them funds through bank.
  4. For payments made in Canada all funds transferred and received are shown automatically in QuickBooks. We have to match them with the bills and invoices.
  5. For payments made in Pakistan to internal employees and vendors the transfer is made through local bank. The accounting is done on QuickBooks as well but the funds transferred and received do not show automatically on QuickBooks. We have to manually record those and reconcile with the bank statement at the end of every month.
  6. SharePoint stores the various internal financial transactions (invoices/pdfs).

Various technical safeguards are put into place, including but not limiting to the following:

  1. Company has deployed automatic software patches and updates for all devices connected to its network.
  2. All users are required to create complex passwords conforming to strong security standards set by the administrator. Change of password would also be required periodically.
  3. All user devices are encrypted using Bitlocker.
  4. Fully integrated Windows Defender Anti-Virus is installed to detect and correct threats or anomalies.
  5. Two Factor Authentication is in place using Microsoft Authenticator to stop any unauthorized sign ins.
  6. Fortinet Firewall is deployed to safeguard the company’s network from external threats and infiltrations.
  7. Malwares like spyware, ransomware, trojans, DDoS are dealt with placing various policies on user devices and the firewall.
    1. SPF record that helps prevent spoofing and phishing by verifying domain names from which email is sent.
    2. DKIM records help authenticate emails through cryptographic keys.
    3. Baseline spam configuration which can restrict activity from unidentified domain or email ID.
  8. Cybersecurity training for all employees would help users identify safe practises against threats via email and internet.

SECTION 4: Compliance to Data Laws

4.1) Pakistan

All business done by Integriti Group Pvt. Ltd. in Pakistan shall fall under the rules and regulations of Pakistan’s data privacy and protection laws. The law in effect comprises of but not limited to data protection provisions of the Prevention of Electronic Crimes Act 2016. Any actions not explained thereunder this law may get its meaning derived from Pakistan Penal Code, 1860 (Act XLV OF 1860), Code of Criminal Procedure, 1898 (Act V of 1898) and the Qanoon-e-Shahadat Order, 1984 (P.O.No.X of 1984) as the case may be.

Any entity as applicable, employer or the employee, may not:

  1. have unauthorized access to data or information
  2. commit unauthorized transmission or copying of data
  3. interfere with information or data with dishonest or harmful motive

Other clauses include:

  1. Any electronic forgery or fraud would be treated with zero tolerance by the employer.
  2. There should be no illegal possession or usage of identity information.
  3. There should be no data interception via wrongful ways for example obtaining data illicitly from electromagnetic emissions from an information system.
  4. Sabotaging infrastructure or system using malicious code would be punishable as per law confined to it.
  5. There should be no attempt of spamming or spoofing and the employer has the right to enforce all systems checks and revoke privacy privileges to address these issues.

Source: http://www.na.gov.pk/uploads/documents/1462252100_756.pdf

4.2) Canada

All Integriti Group Inc. and Integriti Group Pvt. Ltd.employees assent to the following terms:

  1. Any data or information attained or derived from the client shall be considered the sole property of the client. Concerned employees only use it under the scope of the agreement signed between Integriti Group Pvt. Ltd. and the client or between Integriti Group Inc and the client.
  2. All second party and third-party vendors engaged with Integriti Group Inc. and Integriti Group Pvt. Ltd. for business services and with whom data is shared must adhere to the data privacy and information disclosure policies mentioned in this document.

Personal Information Protection and Electronic Documents Act (PIPEDA)

Integriti Group Inc and Integriti Group Pvt. Ltd. must obtain an individual’s consent before they collect, use or disclose their personal data. Personal information or data, under PIPEDA, is justified as:  

  1. Age, name, ID numbers, income, ethnic origin, blood type
  2. Opinions, evaluations, comments, social status or disciplinary actions
  3. Employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (to acquire goods or services or change of job etc.)

Integriti Group Inc. and Integriti Group Pvt. Ltd. follows and abides by the 10 fair information principles enlisted under PIPEDA legislation.

Accountability

  1. Company will assign and declare a privacy official for at least a one-year term every year.
  2. Privacy official’s information will be available on the company’s portfolio and communication.
  3. A privacy management program will be constituted under the privacy official.
  4. Privacy assessment and threat analysis (covered in section 6) will be accounted and shared by the company.
  5. All information collected under TAS falls under the policies of the vendors mentioned in 2.1 of Section 2.
  6. Candidates who are screened and contacted are made aware that their information will be shared to match them with employers. Their consent is acquired before any sharing happens.
  7. All data remains indefinitely in the servers of Manatal and subjected to its privacy laws.
  8. All data that TAS personnel handle is strictly confined to the purpose of hiring and no disclosure is done outside this scope.
  9. Company shall implement policies and procedures to respond to complaints, inquiries and requests to access personal information.
  10. Company shall design, document and implement breach and incident-management protocols.
  11. Company shall document and implement risk assessments.
  12. If the company shares data with third parties, then it shall develop, document and implement appropriate practices to be used by third-party service-providers.
  13. Privacy training for employees should occur time to time to keep them updated to all changes and requirements.
  14. Privacy management program should be reviewed often with solutions to any shortcomings.
  15. Company shall be always prepared to demonstrate that it has specific policies and procedures in place to protect personal information.
  16. Privacy policies and procedures should be available to customers and employees (e.g., in brochures and on websites).

Identifying Purposes

  1. All information holdings (like name, tax file numbers, date of birth, immigration status proof, bank account information, identity information etc.) should be specified and collected for a reason. No unnecessary information should be acquired.
  2. When personal information is taken from someone, there should be a verbal or written coherence so the person giving the information knows the purpose of the data collection.
  3. Keep record of all purposes of data collection and consents attained from the data owners.
  4. It should be ensured that the purposes are limited to what a reasonable person would consider appropriate under the circumstances.

Consent

  1. While getting consent, these four should be relayed to the owner of the data by the company:
    1. What personal information is being collected and for what purpose
    2. With whom is the information being shared or disclosed with
    3. If there are any risks or consequences related with sharing of a person’s data, they should be made aware beforehand
    4. Provide information in manageable and easily accessible ways
  2. Consent could be implied or express. Company must ensure that the consumer knows where a certain consent is implied and where an express consent needs to be taken.
  3. The company shall provide a consent form (for implied and express consent) that is easy to understand and signed by the consumer.
  4. Express consent is generally required when:
    1. the information being collected, used or disclosed is sensitive.
    2. the collection, use or disclosure is outside of the reasonable expectations of the individual; and/or,
    3. the collection, use or disclosure creates a meaningful residual risk of significant harm.
      1. If a privacy policy is changed at any given time or the usage of collected data is to be used for newer purposes, consent should be taken again from the consumer.
      2. The company should allow individuals to withdraw consent at any given time, albeit this will be subject to legal or contractual restrictions.
      3. The company shall obtain consent from a parent or guardian for any individual unable to provide meaningful consent themselves like being underage etc. Different regions may have different laws defining underage therefore check with local authorities.

Limiting Collection

  1. Company should document what kind of personal information was collected in the information-handling policies and practices.
  2. Company must limit the data to the scope of the purpose.
  3. Company staff should be able to explain why certain information was acquired and for what purpose.

Limiting Use, Disclosure and Retention

  1. The company should monitor employee access to personal information, and take appropriate action when information is accessed without authorization.
  2. All data that is no longer of use or does not institute fulfilment of official objective should be disposed safely. Disposal of information could be an effective delete of electronic record or shredding of paper record.
  3. If information is to be kept for analytical or statistical purposes, render the data anonymous and place it under retention policy and rules.
  4. Company should ensure that all user information is deleted before disposing off the electronic paraphernalia or reassigning it to a new user.
  5. There should a training program regarding protection of data and all employees should have standard knowledge on this subject. This helps mitigate malicious attacks targeted towards naïve users/non-technical workforce.

Accuracy

  1. All data that is kept should be accurate, complete and updated from time to time if needed.
  2. When updating, it should be determined who updates the data and protocols should be followed as this could be a confidential process.

Safeguards

  1. Company would implement ways of protecting personal information (see Section 3)
  2. Security is provided by the company in multifaceted ways, including but not limiting to:
    1. physical security (e.g., locked filing cabinets, restricting access to offices, and alarm systems)
    2. up-to-date technological tools (e.g., passwords, encryption, firewalls and security patches)
    3. organizational controls (e.g., security clearances, limiting access, staff training and agreements)
  3. Data would be provided increased layers of security depending on factors like:
    1. the sensitivity of the information and the risk of harm to the individual
    2. health and financial information
    3. the extent of distribution
    4. the format of the information (e.g., electronic or paper)
    5. the type of storage
    6. the types and levels of potential risk your organization faces
  4. Security protocols would be reviewed and monitored by the company often to check if everything is working fine.
  5. Reviews must address any known vulnerabilities through regular security audits and/or testing.
  6. Company would make the employees aware of the importance of maintaining the security and confidentiality of personal information, and hold regular staff training on security safeguards.

Openness

  1. Company should deploy clear guidelines on obtaining consent.
  2. It should be ensured that company’s front-line staff is familiar with the organization’s procedures for responding to people’s inquiries about their personal information.
  3. Company should have the following assigned:
    1. the name/title and contact information of the person who is responsible for the privacy policy i.e., Privacy Official.
    2. the name/title and contact information of the person to whom requests of access should be sent
    3. procedure to how individuals can gain access to their personal information
    4. procedure to how an individual can complain to the company
    5. documents that provide organization’s policies, standards or codes
    6. description of what personal information the company discloses to other organizations or third parties.

Individual Access

  1. The company shall help people prepare their request for access to personal information in case, they are confused how to initiate the process.
  2. Requests should be taken up with priority. Response to the query should be no later than 30 days after receiving it.
  3. The normal 30-day response time limit for access requests can be extended if:
    1. responding to the request within the original 30 days uniquely interferes with the business activity
    2. The company needs additional time to conduct consultations with respect to the query
    3. The company needs additional time to convert personal information to an alternate readable format. Data may be heavily encrypted and may require time for decryption.
  4. If it turns out to be the case that process time is extended, the company shall notify the individual and advise them of their right to reach out to the company’s privacy official for further detail.
  5. Data retrieval should be at minimal or no cost to the individual. If there is a cost to it under a given company policy, then the company shall notify the requestor of the approximate cost before processing the request. Confirm that the individual still wants to proceed with the request.
  6. An average person may not be knowledgeable towards acronyms, abbreviations and codes. Company shall ensure they understand everything.
  7. If there are any data amendments made, the updated parts should be relayed to any third parties that have access to the information in cases where doing so is appropriate.
  8. If the company refuses to grant access to personal information, explain in writing the reasons and inform the requestor of any recourse available to them. Recourse includes the option to complain to the company’s privacy official.
  9. If the company holds no personal information on the requestor, tell them so.

Challenging Compliance

  1. Company should be open to receiving complaints or disputes. The date and nature of complaint should be recorded.
  2. A receipt should be sent out to the person of concern and any questions or clarification be addressed by both sides.
  3. Company should assign a person-in-charge who can review the dispute fairly and impartially. There should be no conflict-of-interest scenario.
  4. Person-in-charge would have the authority to access to all relevant records, employees or others who handled the personal information.
  5. Outcome of disputes/complaints should be relayed at the earliest opportunity.
  6. It is possible that certain cases expose loopholes in the system or elsewhere. If this holds true, all necessary changes should be implemented promptly, and workforce should be made aware of official changes.

Canada’s Anti-Spam Legislation (CASL)

The following two overlap with the section 3.  1) Policies to counteract spam  Outlined in section 3.    2) Policies for other electronic and cyber threats

  1. The device of the employee is to not be left unattended or lent to anyone for any amount of time. Physical security of the device is the responsibility of the employee at all times.
  2. Security tools for identity theft protection are to be deployed by the employer.
  3. The employee must keep the device up to date (see software patches section 3.)
  4. Employee is required to change password(s) periodically.
  5. No remote connectivity of device should be done unless doing so fulfils job obligations and is configured securely by the company’s IT department.
  6. Encryption should be present at all mediums to make any data indecipherable to external threats.
  7. Joining the company’s device to any public network should always be taken up with proper precautions comprising but not limited to the following:
    1. Use sites that only begin with “ https:// “.
    2. Do not conduct any sensitive work on public network (like shopping, banking etc.)
    3. Always connect to the network after confirming the name and login procedure with appropriate staff that is providing the network.

SECTION 5: Privacy Policy

  1. All data should be used per the accord signed between Integriti Group Inc. and the vendor or Integriti Group Pvt. Ltd. and the vendor.
  2. Allowance for the usage of data in a way not mentioned in the accord must be gained in the form of a written approval from the concerned party.
  3. Under no circumstances should there be a disclosure or transfer of the data. If such an action is a need of business operation or adherence to a law, a written approval should be gained and discussion be held to ensure all parties are aware and on the same page. All this procedure is to be documented.
  4. In case of an enquiry where a rightful owner of the data requests a change, issues a complaint or brings forth misuse of data, such request should be pipelined to the issuer from whom data was legally attained.
  5. Integriti Group inc. and Integriti Group Pvt. Ltd. shall have information security guidelines to implement strict physical, technical and organizational measures to safeguard the data. Such measures are outlined under section 3.
  6. A written set of security policies should be deployed by Integriti Group Inc. and Integriti Group Pvt. Ltd.
  7. Implemented security measures shall protect against data loss, data damage, unauthorized access, data theft, data leak and any other damage thereto.
  8. Policies governing access rights should be present to curb any misuse by the internal users.
  9. There should be a systematic oversight on transmittal of data, how data was changed, by whom and when, what was deleted if in case it was.
  10. There should be full access for either party to obtain records for auditing, examination and inspection as long as it concerns the scope of business between them.
  11. There should be confidentiality to any electronic or paper communication which holds personal, private or sensitive information.
  12. All devices connected to the company network should be secured and have all the safety measures in place.
  13. All the mediums of data storage, like servers, operating system, computers and so forth should comply with industry grade security protocols.
  14. No subcontracts or sublease should be made without the consent of the other party.
  15. All the data is exclusive property of the rightful owner and cannot be shared, sold, leased, saved or configured in anyway by the second- or third-party vendor.
  16. Confidential Information, where appropriate and lawful, is applied to employees, customer, contractor, client, vendor and any entity involved in business with Integriti Group Inc. and Integriti Group Pvt. Ltd.
  17. Confidential Information would pertain to any or all data, applications, operating systems, database, communication, software whether now or thereafter existing, derived or developed from.
  18. Financial information, disclosure procedures, any research and development, technical equipment and operations shall all fall under confidential information where deemed appropriate.

SECTION 6: Security Policy

  1. System Failure / Backup
    1. Power back up has been deployed for the entire office.
    2. 2 ISP’s (including back up ISP) to ensure smooth running of business operations.
    3. If a user’s device is affected, spare devices are kept to manage work alternatively.
    4. Device data backup is done on Microsoft’s OneDrive.
    5. Retention policy is in place which stores all emails for 63 years in cloud. Similarly, all SharePoint data and Team’s data (attachment/documents/pdf’s) is saved to OneDrive.
  2. Securing devices connected to company network
    1. Fortinet Firewall monitors incoming and outgoing network traffic and blocks malicious activity based on the configured security protocols. Firewall firmware updates keep the network defence in check of all latest threats.
    2. WPA2 is enabled in the network router
    3. VPN is used where needed (like Zoom Phone).
    4. File sharing is enabled on file servers only.
  3. Physical Security
    1. Fingerprint Scanners allow only authorized personnel in the office premises.
    2. There are CCTV Cameras installed all over office for security purposes.
    3. Server room is always locked and only IT Department has access to it.

SECTION 7: Penetration Testing

  1. Integriti Group Inc. and Integriti Group Pvt. Ltd. shall perform a security penetration test at least once every year from a professional vendor.
  2. The vendor should be an endorsed industry provider of the penetration test and an independent one to ensure that there is no conflict of interest.
  3. The penetration test should conform to the latest standards of the time and a security report should by generated entailing any vulnerabilities or risks found and the remedies to them.
  4. The security report should be put forth, with full transparency and honesty, to the company’s clients and discussed in a general nature.
  5. Integriti Group Inc. and Integriti Group Pvt. Ltd. reserves the right to redact any sensitive information or broader disclosure of content deemed proprietary under the company’s name.
  6. The vendor should not engage with a third party nor should any data be hosted on the third-party server unless the third party is compliant to the testing obligations.
  7. Vendor should permanently delete from its servers or handover the data back to rightful owner once the test has been finished and delivered. Such action could also be unilaterally demanded by the rightful owner at any given time should there be any reason or risk involved. Vendor should provide in writing the completion of these tasks when asked.

All you have to do
is say hey!

Contact: +1 (289) 401-3699
Canada
United States
Pakistan
HomeServicesAbout UsBlogContact Us
© 2023 Integriti Group. All rights reserved