# Corvalon HRM Privacy Practices Last updated: 2026-06-12 This document describes how Corvalon HRM collects, processes, stores, and protects personal data. It covers our compliance with GDPR, CCPA/CPRA, US state privacy laws, and our AI data governance practices. --- ## Data We Process Corvalon HRM processes personal data on behalf of our customers (employers) who act as the data controller. Corvalon acts as the data processor. Categories of personal data include: | Category | Examples | Encryption | |----------|----------|------------| | Identity | Name, date of birth, employee ID, photo | Standard (DB-level AES-256) | | Contact | Email, phone number, mailing address | Standard | | Government IDs | Social Security Number, EIN, passport | Vault Transit (per-tenant key derivation) | | Financial | Bank account numbers, salary, tax withholdings | Vault Transit (per-tenant key derivation) | | Employment | Job title, department, hire date, status | Standard | | Benefits | Plan enrollments, dependents, beneficiaries | Standard | | Health-related | FMLA records, workers' comp, ADA accommodations | Standard with restricted access | | Performance | Reviews, goals, PIP documentation | Standard | | Time | Timesheets, PTO balances, schedules | Standard | | Recruiting | Resumes, interview notes, EEO data | Standard | --- ## Legal Basis for Processing As a data processor, Corvalon processes personal data based on: - **Contractual necessity:** Processing required to provide the HRM platform services as defined in the customer agreement - **Legal obligation:** Processing required to comply with employment, tax, and benefits regulations - **Legitimate interest:** Platform security, fraud prevention, and service improvement - **Consent:** Where required for specific processing activities (e.g., AI feature opt-in) --- ## Data Retention Corvalon enforces configurable data retention policies. Default retention periods: | Data Category | Default Retention | Regulatory Basis | |---------------|-------------------|-----------------| | Active employee records | Duration of employment | Operational necessity | | Terminated employee records | 7 years post-termination | IRS, ERISA, state requirements | | Applicant data (not hired) | 2 years | EEO/OFCCP compliance | | Payroll and tax records | 7 years | IRS requirements | | Benefits records | 7 years post-plan end | ERISA | | I-9 employment eligibility | 3 years from hire or 1 year from termination (whichever is later) | USCIS | | Audit trail | 7 years | SOC 2 compliance | | Session data | 90 days | Operational | Customers may configure shorter retention periods. Data under legal hold is exempt from automatic deletion until the hold is released. The platform includes an automated retention engine that enforces these schedules and produces compliance reports. --- ## GDPR Compliance ### Data Subject Rights Corvalon HRM provides built-in tools for data controllers to fulfill GDPR data subject requests: | Right | Implementation | |-------|----------------| | **Right of access** (Art. 15) | Data export in JSON/CSV format via DSR portal | | **Right to rectification** (Art. 16) | Self-service profile editing + administrative correction workflows | | **Right to erasure** (Art. 17) | Automated erasure engine with legal hold checks; anonymization where full deletion conflicts with legal retention | | **Right to restriction** (Art. 18) | Processing suspension flag on individual records | | **Right to portability** (Art. 20) | Machine-readable data export (JSON) | | **Right to object** (Art. 21) | Opt-out of automated decision-making and AI-powered features | | **Automated decisions** (Art. 22) | AI recommendations are advisory and never auto-executed; no fully automated employment decisions. Employment-related model serving is governance-gated (production approval plus current bias audit) | ### Data Protection by Design - Privacy impact assessments for new features involving personal data - Data minimization: only data necessary for the stated purpose is collected - Pseudonymization and encryption of sensitive fields - Per-tenant data isolation (schema-per-tenant + RLS) --- ## CCPA/CPRA Compliance ### Consumer Rights | Right | Implementation | |-------|----------------| | **Right to know** | Data inventory and categories disclosure via DSR portal | | **Right to delete** | Same erasure engine as GDPR, with California-specific retention exceptions | | **Right to opt-out of sale** | Corvalon does not sell personal information. No "sale" occurs under the platform's data processing model | | **Right to non-discrimination** | No service degradation for exercising privacy rights | | **Right to correct** | Self-service + administrative correction workflows | | **Right to limit use of sensitive PI** | Field-level access controls restrict sensitive data visibility | ### CCPA-Specific Controls - **Do Not Sell:** Corvalon does not sell personal information and has no advertising or data broker relationships - **Service provider designation:** Corvalon processes data solely for the business purposes specified in the customer agreement - **Employee data:** Platform supports California employee privacy rights (AB 1281) --- ## US State Privacy Laws Corvalon HRM supports compliance with emerging US state privacy laws: | State | Law | Status | |-------|-----|--------| | California | CCPA/CPRA | Supported | | Virginia | VCDPA | Supported | | Colorado | CPA | Supported | | Connecticut | CTDPA | Supported | | Utah | UCPA | Supported | | Other states | As enacted | Roadmap | The platform's jurisdiction engine tracks which privacy laws apply to each employee based on their work location and adjusts available rights and retention schedules accordingly. --- ## Data Subject Request (DSR) Process 1. **Submission:** Data subjects submit requests through the platform's DSR portal or via their employer's HR team 2. **Verification:** Requests are held in a pending-verification state and must be explicitly verified by an authorized administrator before any processing occurs; automated identity-proofing (document or knowledge-based checks) is on the roadmap 3. **Legal hold check:** Automatic check for litigation holds that may prevent erasure 4. **Processing:** Automated fulfillment with manual review for complex requests 5. **SLA tracking:** Configurable response deadlines (default: 30 days for GDPR, 45 days for CCPA) 6. **Audit trail:** Complete record of request receipt, processing steps, and completion --- ## Cookie Policy ### Corvalon HRM Platform Cookies | Cookie | Purpose | Type | Duration | |--------|---------|------|----------| | Session cookie | Authentication (httpOnly, Secure, SameSite=Lax) | Essential | Session / 7 days (refresh) | | CSRF token | Cross-site request forgery protection | Essential | Session | Corvalon HRM does not use: - Advertising or tracking cookies - Third-party analytics cookies - Social media tracking pixels The platform is designed to function with only essential cookies. No cookie consent banner is required for the platform itself as only strictly necessary cookies are used. --- ## AI Data Governance Corvalon HRM includes AI-powered features with strict data governance: ### Data Handling - **Output redaction:** AI responses are automatically scanned and sensitive identifiers (SSN, EIN, bank and routing numbers, and similar patterns) are redacted before display. Input-side PII stripping before transmission to the AI provider is on the roadmap; until then, queries may contain personal data the user enters - **Opt-out enforcement:** A per-user AI opt-out is enforced at the AI gateway, the single entry point for all AI features; opted-out users' requests are refused before any data reaches the provider - **No training on customer data:** Corvalon does not use customer data to train models, and Anthropic's commercial API terms exclude API data from model training - **Processing and retention:** AI queries are processed in real time; Corvalon stores AI call metadata in the audit trail but does not retain prompts or responses outside it. Provider-side retention is governed by Anthropic's API data-retention terms - **Tenant isolation:** AI processing respects tenant boundaries; cross-tenant data mixing is architecturally prevented ### Feature Controls - **Per-tenant feature flags:** AI features can be enabled or disabled per tenant - **Model registry:** All AI/ML models are registered with version tracking, training data documentation, and approval status - **Bias auditing:** Automated bias detection across protected classes (gender, race, age, disability) - **Explainability:** AI-generated recommendations include confidence scores and contributing factors - **Human oversight:** AI outputs that affect employment decisions (hiring, compensation, termination) are advisory; the platform does not execute employment decisions automatically. Serving of employment-related ML models is additionally gated on model governance: production approval status plus a passing bias audit within the past 12 months --- ## Cross-Border Data Transfers - Customer data is stored in Corvalon's AWS US East (N. Virginia) region; production backup copies are replicated to US West (Oregon). Regional selection, including EU data residency, is on the roadmap and not yet available - For transfers outside the EEA, Corvalon offers EU Standard Contractual Clauses (SCCs) with a documented Transfer Impact Assessment and UK IDTA addendum (templates maintained in the Trust Center) - Encryption in transit and at rest provides supplementary protection for cross-border transfers --- ## Contact - **Privacy inquiries:** privacy@corvalonhrm.com - **Data subject requests:** Submit through the platform DSR portal or contact your employer's HR team - **Trust Center:** [https://corvalonhrm.com/trust](https://corvalonhrm.com/trust)