Privacy Policy

DORT Asia Pte. Ltd. (“DORT Asia”, “we”, “us”, or “our”) operates Xentra, a cloud-based Human Resource Management System (“Xentra” or the “Service”).

This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal data in connection with the Xentra website, web application, mobile application, customer accounts, employee management features, customer support, and related services provided by DORT Asia.

By using Xentra or providing personal data to us, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable law.

Xentra is designed to help businesses manage employee information, lifecycle records, attendance, leave, payroll workflows, documents, work-pass records, workforce administration, employee self-service, reporting, and compliance workflows.

Xentra is designed around a central employee record. Other workforce modules use this information to provide connected operations.

This Privacy Policy applies to:

1. 1.Visitors to the Xentra website;
2. 2.Customers and prospective customers;
3. 3.Authorised users of Xentra;
4. 4.Administrators, HR personnel, managers and employees using Xentra;
5. 5.Individuals whose information is entered into Xentra by a customer;
6. 6.Individuals who communicate with DORT Asia;
7. 7.Billing and account contacts; and
8. 8.Other individuals whose personal data is processed in connection with Xentra.

Where a customer uses Xentra to process workforce data, the customer is responsible for providing appropriate privacy notices to their employees and workforce members.

The personal data processed through Xentra depends on the features used by the customer and the information provided.

3.1 Account and User Information

• Name, email address, phone number, username or account identifier;
• Authentication information, user role, company or organisation;
• Account status, login and security audit information.

3.2 Employee and Workforce Information

• Employee name, employee ID, contact details, date of birth, nationality, identification information, residential address;
• Employment type, status, joining date, probation, confirmation, department, designation, team, reporting manager;
• Work-pass information, education and qualifications, emergency contacts, employee documents;
• Bank and payment details, compensation information, salary history, attendance records, leave records, payroll information, claims or expenses, and assigned company assets.

3.3 Attendance and Location Information

3.4 Payroll and Financial Information

• Salary information, allowances, deductions, compensation history;
• Bank account numbers, payroll records, CPF-related information, SDL contributions, IRAS tax reporting records, and payslip data.

3.5 Documents

Customers may upload employment contracts, offer letters, identity documents, passports, work passes, education certificates, salary letters, medical certificates, and related HR files.

3.6 Technical and Usage Information

• IP address, browser type, device information, operating system;
• Authentication events, security logs, timestamps, error records, and service usage telemetry.

Personal data is collected through account registration, onboarding, employee imports, employee self-service check-in/out, leave applications, payroll workflows, document uploads, support requests, mobile app interactions, integrations, and automated security audit systems.

5.1 Providing Xentra Services

To administer accounts, maintain employee records, process attendance and leave, compute payroll workflows, generate payslips, provide reporting, store documents, and run customer-configured workforce automations.

5.2 Authentication and Security

To authenticate users, protect accounts, detect suspicious activities, prevent unauthorized access, investigate incidents, and maintain tamper-evident audit trails.

5.3 Transactional Communications

To send verification emails, authentication messages, password resets, plan expiry alerts, billing invoices, and security notifications.

5.4 Customer Support & Billing

To respond to technical enquiries, process subscription payments, manage renewals, and handle billing administration.

Xentra is primarily a business-to-business (B2B) HRMS. When a customer uses Xentra to process workforce data:

• The customer determines the purpose and lawful basis for collecting employee information;
• The customer is responsible for providing appropriate privacy notices under the Singapore PDPA;
• Xentra processes the information strictly to provide the subscribed software services;
• Access is strictly partitioned by customer tenant boundaries and role-based permissions.

When GPS attendance is configured by a customer: the mobile app captures the device location exclusively at the exact moment of check-in or check-out to validate customer geofence boundaries.

Xentra uses essential cookies and local session storage necessary for authentication, session persistence, security, and preference preservation.

The Xentra HRMS application does not employ employee-level advertising or third-party behavioural ad tracking. On the public marketing website, privacy-preserving web analytics (e.g. Google Analytics) may be enabled.

We partner with trusted infrastructure and service providers to operate Xentra:

9.1 Supabase (Database & Storage)

Provides PostgreSQL database hosting, file storage, authentication, and backend infrastructure. Xentra’s production environment is hosted in the Singapore AWS region (ap-southeast-1).

9.2 Stripe (Payment Processing)

Handles subscription billing and payment processing. Credit card details are securely vaulted directly by Stripe and never stored on DORT Asia servers.

9.3 Brevo (Transactional Email)

Delivers authentication emails, password resets, verification codes, and service notices.

9.4 Firebase Cloud Messaging (FCM)

Delivers push notifications to mobile devices.

9.5 WhatsApp

Sends service alerts such as plan expiry and subscription renewal reminders.

Where customers enable third-party software integrations, data is exchanged strictly according to configured permissions. Customers are responsible for reviewing third-party terms and privacy policies.

We enforce rigorous technical and organizational security controls designed to safeguard personal data:

• Multi-factor authentication & role-based access control (RBAC);
• Row Level Security (RLS) and database tenant logical isolation;
• Encryption in transit (TLS 1.3) and encryption at rest (AES-256);
• Least-privilege access enforcement and automated audit logging;
• Regular automated backups and disaster recovery verification;
• Server-side validation for all external API events and webhook signatures.

Xentra enforces strict multi-tenant data partitioning at both the application and database levels. A user from one customer organisation cannot access or query another customer’s data.

13.1 Customer Workforce Data

Data remains accessible throughout the active subscription. Following cancellation, data is retained for a reasonable transitional window to facilitate customer export, compliance, and continuity before secure deletion.

13.2 GPS Attendance Data

Location coordinates are retained only as long as necessary for attendance dispute resolution, statutory payroll audits, and operational records.

13.3 Account Deletion (7-Day Workflow)

Customers can export their workforce data, employee records, attendance logs, and payroll summaries during their subscription or transitional retrieval period prior to account closure.

Xentra’s primary production database and storage environment is located in Singapore (AWS ap-southeast-1). Where auxiliary third-party processors handle transactional data globally, DORT Asia ensures comparable protections in alignment with the Singapore Personal Data Protection Act (PDPA).

Individuals may request access to or correction of personal data held by DORT Asia. For workforce records controlled by an employer customer, individuals should submit requests directly to their employer organisation.

Where processing relies on consent, individuals may withdraw consent at any time. Withdrawal does not affect lawful processing conducted prior to withdrawal, nor does it override statutory obligations.

We rely on customers and users to provide accurate and up-to-date workforce records. Authorised users can update and verify their information through Xentra self-service portals.

Xentra is an enterprise workforce management system and is not directed at children. Customers must not submit children’s personal data unless lawful under applicable employment regulations.

Xentra communications are strictly transactional and operational (e.g. security alerts, invoices, verification codes). Optional marketing updates can be unsubscribed from at any time.

Customer organisations remain responsible for obtaining required employee consent, issuing privacy notices, configuring role permissions appropriately, and complying with the Employment Act and Singapore PDPA.

DORT Asia maintains an incident response protocol to contain, investigate, and remediate security events. Affected customer administrators and regulatory bodies will be notified in compliance with statutory requirements.

We may update this Privacy Policy as new features, integrations, or regulatory standards evolve. Updated versions will be published with a revised “Last Updated” date.

This Privacy Policy should be read in conjunction with the Xentra Terms and Conditions and any applicable Data Processing Addendum (DPA).

Xentra provides software tools and automation workflows. Nothing provided through Xentra constitutes legal, tax, accounting, or employment advisory services.

For questions regarding this Privacy Policy or data protection inquiries, contact:

• Xentra is a B2B HRMS; customer organisation controls workforce data.
• Zero background location tracking; GPS recorded only at check-in/out.
• Primary database & storage hosted in Singapore AWS (ap-southeast-1).
• Stripe processes all payments securely; card credentials never stored on DORT Asia servers.
• Brevo handles transactional email; FCM delivers push alerts.
• Verified account deletion requests processed within 7 business days.
• Full support for data export prior to account closure.