Skip to main content
Xoxoday Empuls maintains a formally documented Privacy Policy, reviewed at least annually, that is explicitly aligned with GDPR, CCPA/CPRA, the UK Data Protection Act, the Australian Privacy Act, and applicable Indian IT and data protection legislation — governing how personal and sensitive data is collected, used, stored, shared, and disposed of across all products and services.
When enterprise teams evaluate employee engagement platforms, data privacy governance is a non-negotiable checkpoint. Xoxoday Empuls addresses this directly with a formal, documented Privacy Policy that governs every stage of the personal data lifecycle — from initial collection and processing through to storage, authorised sharing, and secure disposal. The Privacy Policy is reviewed at least annually and updated to reflect changes in applicable legislation. This review cadence ensures that Xoxoday Empuls remains current with evolving regulatory requirements rather than relying on a static document written at the time of product launch.

​
Global Regulatory Coverage

Xoxoday Empuls aligns its Privacy Policy with the major data protection frameworks that enterprise customers operate under worldwide. This includes the General Data Protection Regulation (GDPR) for data subjects in the European Economic Area, the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) for US-based users, the UK Data Protection Act 2018 for organisations operating in the United Kingdom, the Australian Privacy Act 1988, and relevant Indian IT rules and data protection legislation covering domestic operations and data localisation requirements. This multi-jurisdictional alignment is critical for global organisations that deploy Xoxoday Empuls across multiple geographies simultaneously, as a single unified policy framework reduces fragmentation in vendor management.

​
What the Policy Covers

The Privacy Policy explicitly addresses how personal and sensitive data is collected, used, stored, shared with third parties, and ultimately disposed of. For organisations integrating Xoxoday Empuls with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, this means that employee data flowing into the platform — including employment metadata and engagement activity — is governed by a consistent, auditable policy framework from the moment of ingestion. Data exchanged through communication integrations with tools like Slack and Microsoft Teams falls within the same policy scope. Recognition events, reward notifications, and engagement signals are handled with the same level of care as core HR records — no separate carve-outs or reduced controls for peripheral integrations.

​
Why This Matters for Enterprise Procurement

Security and compliance teams conducting vendor risk assessments — particularly under frameworks like ISO 27001 or SOC 2 Type II — require documented evidence that a vendor’s privacy practices are formalised and periodically validated. The existence of an annually reviewed, regulation-aligned Privacy Policy gives Xoxoday Empuls customers the auditable assurance they need to satisfy internal procurement checklists, legal review cycles, and third-party audit requirements. Organisations subject to Data Protection Impact Assessments (DPIAs) or Privacy Impact Assessments (PIAs) will find that Xoxoday Empuls’s policy documentation directly supports those processes, reducing the time spent chasing vendor clarifications during due diligence. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Is Empuls ISO 27001 and SOC 2 certified?

Learn how Xoxoday Empuls’s security certifications support vendor risk assessments and enterprise compliance requirements.

Does Empuls sign data privacy agreements with subprocessors?

Understand how Xoxoday Empuls formalises data protection obligations with subprocessors and subcontractors through signed agreements.