Onfinity ERP by Ascot

1. Scope and responsibilities

This policy explains how Onfinity ERP by Ascot handles information. Ascot Enterprise Solutions develops and supports the app, which connects employees to the Onfinity ERP environment selected or provided by their organization.

Your employer or organization normally determines the purposes and methods of processing employment and ERP information and acts as the primary data controller. Ascot may process information as a service provider when hosting, maintaining, or supporting the app or connected services.

Questions and requests concerning a particular employment or ERP record should first be directed to your organization.

2. Information handled by the app

Depending on the modules enabled by your organization and the actions you choose, the app may access, receive, store, or transmit:

• Identity and contact information, including your name, username, employee or user identifier, email address, phone number, profile photo, company, role, and organization.
• Authentication and security information, including session tokens, Microsoft single sign-on information, an app-generated installation identifier, device name or model, push-notification token, and biometric-unlock preferences.
• Employment and ERP records, including attendance times, leave, approvals, tasks, training, assets, documents, support requests, complaints, warnings, resignation requests, expenses, claims, advances, loans, and payslips.
• Precise or approximate location and local network or IP information when required to validate an attendance action at an authorized workplace.
• Photos and files you choose to provide, including profile photos, receipts, leave evidence, employee documents, CRM files, and support attachments.
• Messages, comments, and other content submitted through enabled communication, workflow, and support features.
• Technical information needed to operate and support the app, including its version, device or operating-system type, notification-delivery information, feature-use information, and locally stored diagnostic records.

Device biometric templates are controlled by the operating system and are not received by the app.

3. How information is used

Information is used to:

• Authenticate users, protect sessions, and connect users to the appropriate company, role, and organization.
• Provide the ERP, HR, attendance, approval, document, communication, and notification functions requested by users or their organization.
• Validate attendance location or workplace network when those controls are enabled.
• Display profile photos and process user-selected attachments for their relevant business purpose.
• Investigate faults, provide support, prevent misuse, and maintain service reliability.
• Meet applicable contractual, employment, audit, security, and legal obligations.

4. Permissions and user choices

The app requests device permissions when needed for a supported function.

• Camera access is used to scan QR codes.
• Location access supports attendance-location validation.
• Notification permission allows ERP and HR alerts.
• Photo and file selection is initiated by the user.
• Optional device biometric authentication can unlock a locally protected app session.
• The app does not include NFC functionality.

You can manage permissions through your device settings. Refusing a permission may prevent the corresponding function from operating.

5. Attendance photos, facial recognition, and Face ID

Attendance-selfie capture and upload have been removed from the app version covered by this policy. The app does not capture selfies during attendance check-in or check-out, perform facial recognition or automated face matching, or create biometric face templates.

Optional Face ID is used only to securely unlock the app. Apple’s operating system handles authentication. The app receives an authentication success or failure result but cannot access Face ID images or biometric templates and does not receive, store, or transmit them.

Profile photos and attachments that users choose to provide may contain faces. They are handled as ordinary user-provided content for the relevant profile or business workflow. The app does not use them for facial recognition or automated face matching. Their use, disclosure, and retention are described in Sections 2, 3, 6, and 8.

6. Disclosures and service providers

Information is transmitted to the Onfinity ERP server configured by your organization and is accessible according to its authorized roles and access controls.

Ascot personnel may process information when specifically authorized to provide hosting, maintenance, or support. Providers supporting essential app functions may also process relevant information, including Microsoft for Microsoft sign-in and Google Firebase for push notifications and enabled chat services.

Information may be disclosed when required by law or necessary to protect users, the organization, Ascot, or the service.

Ascot does not sell personal information. The app does not use personal information for third-party advertising or cross-app advertising tracking.

7. Security

The app requires HTTPS for supported runtime connections. HTTP-only customer endpoints are not supported.

Data transmitted between the app and supported ERP, attendance, Microsoft sign-in, Firebase, and other service endpoints is encrypted in transit using TLS. The app uses secure device storage for sensitive session information.

Organizations remain responsible for the configuration, access controls, security, and backup practices of their ERP servers and networks.

No electronic storage or transmission method can guarantee absolute security.

8. Retention and deletion

Employment records, profile photos, and business attachments are retained according to the connected organization’s policies, configured retention periods, and applicable obligations. Retention periods may differ between organizations and record types. Contact your organization’s HR team or ERP administrator for the period applicable to your information.

Local app information is retained as needed for authentication, offline continuity, notifications, and app operation. Relevant information is removed or invalidated when appropriate during sign-out, app reset, or uninstall. These actions do not automatically delete records held in the organization’s ERP.

Attendance photos uploaded using previous app versions may remain in the organization’s ERP records. Removing the attendance-photo feature or updating the app does not automatically delete those historical photos. Their retention and deletion remain the organization’s responsibility.

Certain audit, security, backup, or legally required records may remain for longer periods.

The app does not create a standalone consumer account. Accounts are provisioned and managed by the user’s organization.

To request access, correction, export, restriction, or deletion of an account, photo, attachment, or employment record, contact your organization’s HR team, ERP administrator, or privacy contact. Requests are handled according to the organization’s procedures and applicable requirements. Ascot assists the organization where required.

9. International processing and children’s privacy

Information may be processed in the country where your organization hosts its ERP, where Ascot or its authorized providers operate, or where Microsoft and Google provide their services, subject to applicable safeguards.

The app is intended for enterprise workforce and ERP use and is not directed to children. Organizations are responsible for ensuring that provisioned users meet applicable eligibility and minimum-age requirements.

10. Changes and contact

This policy may be updated when the app, services, or applicable requirements change. Updated versions will be published on this page with a revised date.

For requests concerning your employment or ERP records, contact your organization first.