Orbit

Orbit is an internal employee app used exclusively by staff of Chughtai Lab. It is not a public consumer app — accounts are created and managed by HR, and you cannot sign up from inside the app. Employees use it to:

• Mark daily check-in and check-out (manually or automatically via geofencing)
• View personal attendance, leave balance, payslips, and HR letters
• Apply for leave, loans, work-from-home, outdoor duty, and other workflow requests
• Receive HR notifications and announcements

Chughtai Lab is the data controller for personal data processed through this app. For any privacy question or request, contact:

Email: arslan.10530@cll.edu.pk

We collect only the data the app needs to perform its HR and attendance functions. The categories below match the Google Play Data Safety form.

We use your data only for purposes related to your employment at Chughtai Lab:

1. Verify your identity when you log in.
2. Record attendance accurately and prevent attendance fraud.
3. Compute leave balances, deductions, payroll, taxes, and other statutory items.
4. Route approval workflows (leave, loans, outdoor duty, etc.) to the correct supervisor / HR officer.
5. Send HR notifications (new payslip, leave approved, urgent announcement).
6. Improve app stability via crash reports and performance metrics.
7. Comply with Pakistan labour, tax, and statutory record-keeping requirements.

We do NOT:

• Sell your data to third parties.
• Use your data for behavioural advertising.
• Profile you outside of HR-related decisions you are notified about (e.g., probation outcomes, leave approvals).

Your data is shared only with the recipients below — never with marketers, social networks, or analytics brokers.

• All network traffic between the app and our servers is encrypted with HTTPS (TLS 1.2+).
• Passwords are stored hashed with bcrypt (10 salt rounds). The app never stores your password locally.
• The authentication token issued at login is stored in the app's local encrypted storage (Hive box). It expires after 12 hours.
• The backend database is encrypted at rest by AWS.
• Access to the database is restricted to a small set of HR-authorised admin accounts.
• Payslips and PDF documents are streamed from the backend on each view — they are not cached on the device.
• Login endpoints are rate-limited to prevent brute-force attacks.

If we become aware of a personal-data breach that is likely to result in a risk to you, we will notify you and the relevant regulator without undue delay, in line with applicable law.

We retain your data for as long as you are an employee of Chughtai Lab plus the periods required by law:

• Attendance, payroll, and tax records: 6 years after your separation date (FBR requirement)
• Letters and personnel records: 7 years after separation
• Approved leave records: 6 years after separation
• Crash and performance logs (Sentry): 90 days
• Authentication tokens: cleared on logout or after 12 hours, whichever is sooner

When you leave the company, HR initiates a Final Settlement and your portal access is automatically locked. Personal data is then retained only for the statutory periods above.

You can at any time:

• Access your data — the app already exposes your full profile, attendance history, payslips, letters, and request history under "Profile" and the relevant menus.
• Correct mistakes — contact HR; corrections are propagated automatically and a full audit trail is maintained.
• Request deletion of data that is not required by law — submit a request to HR. Statutory records (payroll, tax, attendance for the retention windows above) cannot be deleted while their retention period is active.
• Withdraw consent for optional features:
  • Turn off background location at any time in Android Settings → Apps → Orbit → Permissions. Automatic geofence attendance will stop; manual check-in continues to work (uses foreground location only at the moment of the tap).
  • Revoke notification permission in Android Settings → Apps → Orbit → Notifications.
• Object to a specific use of your data — contact HR. We respond within 30 days.
• Lodge a complaint with a data-protection regulator.

Orbit is an employee-only app and is not designed for or directed at children under 18. We do not knowingly collect data from anyone under 18.

The app requests the following Android permissions. Each is used only for the stated purpose.

If we change this policy materially (e.g., a new data type is collected, a new third-party processor is added), we will notify you in-app and update the "Effective date" at the top of this page. The latest version is always available at https://orbit.chughtailab.com/privacy.

For any privacy question, request, or complaint:

Email: arslan.10530@cll.edu.pk