Privacy Policy

1. Introduction

Tymbly Inc. ("Tymbly," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our HR management platform, website, mobile applications, and related services (collectively, the "Services").

Tymbly Inc. is headquartered at 25-375 Cook Rd, North York, ON M3J 3T6, Canada. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

2. Information we collect

We collect information in the following categories:

a) Personal identification information

When you register for an account or are added as an employee by your organization, we may collect your full name, email address, phone number, date of birth, home address, profile photograph, and government-issued identification numbers where required by your employer for HR administration purposes.

b) Employment data

Our platform processes employment-related information on behalf of your employer, including job title, department, work location, hire date, employment status, shift schedules, leave balances, attendance records, expense reports, performance data, and organizational hierarchy information.

c) Usage data

We automatically collect certain information when you access or use our Services, including your IP address, browser type and version, operating system, device identifiers, pages visited, features used, time and date of access, referring URLs, and clickstream data.

d) Cookies and tracking technologies

We use cookies, web beacons, and similar tracking technologies to collect information about your interactions with our Services. For more details, please refer to Section 7 (Cookies) of this Privacy Policy.

3. How we use your information

We use the information we collect for the following purposes:

Service delivery: To provide, operate, and maintain our HR management platform, including employee management, shift scheduling, leave tracking, expense management, access control, surveys, and AI-powered analytics.
HR management: To process and manage employment-related data on behalf of your employer, including attendance tracking, payroll support, approval workflows, and organizational reporting.
Analytics and improvement: To analyze usage patterns, monitor the performance of our Services, and develop new features and functionality to improve your experience.
Communication: To send you service-related notifications, respond to your inquiries, provide customer support, and send administrative messages regarding your account or the Services.
Security: To detect, prevent, and address technical issues, fraud, unauthorized access, and other illegal or harmful activities.
Legal compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. Data storage and security

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

Our Services are hosted on secure cloud infrastructure provided by reputable third-party hosting providers. We employ industry-standard security practices including:

Encryption of data in transit (TLS/SSL) and at rest
Regular security assessments and vulnerability scanning
Role-based access controls and multi-tenant data isolation
Regular data backups and disaster recovery procedures
Employee security awareness training

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to continuously improving our security posture.

5. Data sharing and disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information in the following circumstances:

With your employer: As a multi-tenant HR platform, we process employee data on behalf of your employer (the data controller). Your employer determines what data is collected and how it is used within the platform.
Service providers: We may share information with trusted third-party service providers who assist us in operating our platform, such as cloud hosting providers, email delivery services, analytics providers, and payment processors. These providers are contractually obligated to protect your data and use it only for the purposes we specify.
Legal obligations: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government agency request).
Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
With your consent: We may share your information for any other purpose with your explicit consent.

6. Your rights

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy legislation, you have the following rights regarding your personal information:

Right of access: You have the right to request access to the personal information we hold about you and to receive a copy of that information.
Right to correction: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
Right to deletion: You may request the deletion of your personal information, subject to certain legal and contractual exceptions. Please note that as an HR platform, certain data retention may be required by your employer or by law.
Right to withdraw consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Right to complain: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

If you are an employee whose data is managed through Tymbly by your employer, please direct your data access, correction, or deletion requests to your employer's HR department in the first instance, as they are the data controller for your employment data.

To exercise any of these rights directly with Tymbly, please contact us using the details provided in Section 11 below.

7. Cookies

Our Services use the following types of cookies:

Essential cookies: These cookies are strictly necessary for the operation of our platform. They enable core functionality such as authentication, session management, and security features. You cannot opt out of these cookies.
Functional cookies: These cookies allow us to remember your preferences (such as language settings) and provide enhanced, personalized features.
Analytics cookies: These cookies help us understand how visitors interact with our website and platform by collecting and reporting information anonymously. We use this data to improve our Services.

You can manage your cookie preferences through your browser settings. Most web browsers allow you to control cookies through their settings, including blocking or deleting cookies. Please note that disabling certain cookies may affect the functionality of our Services.

8. International data transfers

Your personal information may be transferred to and processed in countries other than Canada, including countries where our cloud infrastructure providers maintain data centers. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer your personal information internationally, we take appropriate safeguards to ensure that your information receives an adequate level of protection, including entering into data processing agreements with our service providers that include appropriate data protection clauses.

By using our Services, you consent to the transfer of your information to countries outside of your country of residence, including Canada and other jurisdictions where our service providers operate.

9. Children's privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected personal information from a child under 16, we will take reasonable steps to delete such information promptly. If you believe that we may have collected information from a child under 16, please contact us immediately using the details provided in Section 11.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes to this Privacy Policy, we will notify you by posting the updated policy on our website with a revised "Last updated" date. We may also notify you through the platform or via email for significant changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of those changes.