Privacy Policy

MOWRAM Human Resource Management System (HRMS)

Data Controller: Ministry of Water Resources and Meteorology (MOWRAM), Kingdom of Cambodia

Address: #47 Preah Norodom Bvd, Phnom Penh, Cambodia

Contact for privacy matters: info@mowram.gov.kh

Version: 1.1.1

Effective date: 15 August 2026

1. Introduction

This Privacy Policy explains how MOWRAM collects, uses, stores, shares and protects personal data within the MOWRAM Human Resource Management System ("HRMS", "the System"), including its web application and mobile application.

The HRMS is an internal administrative system used to manage the employment records of MOWRAM civil servants, contract staff, interns and other personnel ("Users", "you"). It is not a public service and is not open to general public registration.

By using the HRMS you are acting in your capacity as a MOWRAM employee or authorised user. Use of the System is subject to this Policy and to MOWRAM’s internal IT and personnel regulations.

2. Who is responsible for your data

MOWRAM is the data controller and owner of all personal data held in the HRMS.

The System was developed and is maintained by MISTEAMS, which acts as a data processor on MOWRAM’s instructions under a written service agreement. The processor may not use HRMS data for its own purposes.

3. Personal data we collect

Depending on your role and the modules enabled, the HRMS may process:

1. a) Identity and contact data

Full name in Khmer and Latin script, sex, date and place of birth, nationality, national identity card number, passport number, family book / residence details, photograph, home address, personal and official phone numbers, personal and official email addresses.

1. b) Employment and civil-service data

Employee/civil servant ID number, framework and rank, grade and step, position and job title, department or unit, duty station, date of appointment, contract type and dates, promotion, transfer, secondment and retirement records, employment history.

1. c) Education and qualification data

Diplomas, degrees, certificates, training courses attended, language and technical skills, professional licences.

1. d) Attendance and time data

Check-in and check-out records, working hours, overtime, mission and travel records, and — where the mobile app is used for attendance — GPS location and device information at the moment of check-in.

1. e) Biometric authentication

The mobile app may use your device’s built-in fingerprint or face unlock to confirm your identity when you sign in. This check is carried out entirely by your device’s own operating system.

MOWRAM does not collect, receive, transmit or store any fingerprint, facial image or biometric template. No biometric data ever leaves your device, and the app itself has no access to it. The app is only told whether the device confirmed your identity or not.

You can disable biometric sign-in at any time in your device settings and use your password instead.

1. f) Leave and absence data

Annual leave, sick leave, maternity and paternity leave, special leave, and supporting documents such as medical certificates. Health information contained in such documents is treated as sensitive data and is accessible only to authorised HR staff.

1. g) Payroll and financial data

Salary, allowances, bonuses, deductions, bank account number and bank name, tax identification number, National Social Security Fund (NSSF) number, pension contributions.

1. h) Performance and disciplinary data

Performance appraisals, objectives, evaluation scores, commendations, warnings, disciplinary proceedings and outcomes.

1. i) Family and emergency data

Marital status, spouse and dependent children (name, date of birth) for allowance purposes, and emergency contact details. Where you provide data about another person, you confirm they are aware you have done so.

1. j) System and technical data

Username, hashed password, role and permission assignments, IP address, browser or device type, operating system, app version, session times, and audit logs of actions taken in the System (records created, viewed, modified, approved or deleted).

We do not collect data on your political opinions, religious beliefs, trade union membership or sexual life, and you should not enter such information into free-text fields.

4. How we collect data

• Directly from you, when you register, complete your profile, submit a leave or mission request, or upload a document.
• From MOWRAM HR and administrative departments, from your personnel file and official appointment documents.
• Automatically from the System, through attendance devices, mobile app usage and audit logging.
• From other government institutions where required by law, for example the Ministry of Civil Service, the Ministry of Economy and Finance, or the NSSF.

5. Why we use your data, and on what basis

We do not use your data for marketing, advertising, or automated decision-making that produces legal effects on you without human review.

6. Who can see your data

Access inside MOWRAM is granted on a strict need-to-know basis through role-based access control:

• You can view and, where permitted, edit your own profile.
• Your line manager can view attendance, leave and performance data of staff reporting to them.
• HR Department staff can access the personnel records necessary for their duties.
• Payroll and Finance staff can access payroll and bank data only.
• System administrators have technical access for maintenance, subject to logging and confidentiality undertakings.

We may disclose data outside MOWRAM only where necessary and lawful, to:

• The Ministry of Civil Service / Secretariat of State for Civil Service, for civil servant registry purposes;
• The Ministry of Economy and Finance and the National Treasury, for payroll execution;
• The General Department of Taxation and the National Social Security Fund;
• The National Audit Authority, Anti-Corruption Unit, courts, or other competent authorities acting under legal powers;
• The System’s IT service provider, strictly for hosting, maintenance and support, under a confidentiality and data-processing agreement.

We do not sell, rent or trade personal data. We do not share it with commercial third parties for their own purposes.

7. Where data is stored

HRMS data is hosted on servers located at the MOWRAM data centre in Phnom Penh, Cambodia.

All HRMS data is stored within the Kingdom of Cambodia.

8. How long we keep it

• Active personnel records: for the duration of your employment with MOWRAM.
• Records after departure, retirement or termination: retained in accordance with civil service archiving rules and the Law on Archives, as these records may be needed for pension, verification and historical purposes.

When a retention period ends, data is securely deleted or irreversibly anonymised.

9. How we protect your data

Measures in place include:

• Encryption of data in transit (HTTPS/TLS) and encryption at rest for sensitive fields;
• Passwords stored only as salted hashes; enforced password complexity;
• Role-based access control and the principle of least privilege;
• Full audit logging of access to and modification of personnel records;
• Regular backups, stored securely and tested for restoration;
• Physical security controls at the hosting location;
• Confidentiality obligations for all staff and contractors with access;
• Periodic security review, patching and vulnerability testing.

No system can be guaranteed completely secure. You must keep your credentials confidential and must not share your account. Report any suspected compromise immediately to the MOWRAM IT Department at info@mowram.gov.kh.

10. Data breaches

If a security incident affects your personal data and may cause harm, MOWRAM will investigate, contain the incident, and notify affected individuals and the competent authority (including the Ministry of Post and Telecommunications, once the Law on Personal Data Protection is in force) in line with applicable requirements, in principle within 72 hours of becoming aware of the breach.

11. Your rights

Subject to Cambodian law and to MOWRAM’s obligations as a public authority, you may:

• Access the personal data held about you in the HRMS;
• Request correction of data that is inaccurate or out of date;
• Request deletion of data that is no longer necessary and that we are not required to retain;
• Object to or request restriction of a specific processing activity;
• Withdraw consent where processing is based on your consent (for example, use of your photograph in an internal directory) — this does not affect processing required by law;
• Receive a copy of data you provided, in a common electronic format;
• Complain to MOWRAM, and to the competent regulator once established.

Most corrections can be made directly in your profile or by request to the HR Department. For other requests, contact info@mowram.gov.kh. We will respond within 30 days of receiving your request. We may need to verify your identity first.

Note that we cannot delete records we are legally required to maintain, such as payroll, tax and civil-service registry records.

Account and data deletion requests

To request deletion of your HRMS account and associated data, email info@mowram.gov.kh with the subject line "HRMS Data Deletion Request", stating your full name and employee ID. We will confirm receipt and explain which data can be deleted and which must be retained under Cambodian law.

12. Mobile application

The HRMS mobile app is used by MOWRAM staff to record attendance and to view and submit HR requests. It requests the following device permissions:

• Camera — to scan the QR code displayed at your authorised duty station when you check in and check out. The camera image is read on your device to decode the QR code only. No photograph is taken, stored or sent to MOWRAM.
• Location (GPS) — to confirm that your check-in or check-out is taking place at an authorised MOWRAM site. Location is recorded only at the moment you press check-in or check-out. The app does not track your location in the background, and does not record your location at any other time.
• Fingerprint / face unlock (biometric) — to let you sign in using your device’s own security. See section 3(e); no biometric data is collected by MOWRAM.

You can refuse or revoke these permissions in your device settings. If you refuse the camera or location permission, attendance check-in through the app will not work.

The app displays no advertising and does not use your data for advertising or marketing purposes.

The app uses Google Firebase Crashlytics to collect anonymous crash reports and technical diagnostic information. This is used only to identify and fix faults in the app. It does not identify you personally and is not used for advertising.

13. Cookies and similar technologies

The web application uses strictly necessary cookies to maintain your login session and protect against cross-site request forgery. These cannot be disabled without breaking the System.

14. Children

The HRMS is not intended for use by persons under 18. Data about employees’ children is processed only for family allowance and benefit purposes and is provided by the employee.

15. Changes to this Policy

We may update this Policy to reflect changes in the System, in MOWRAM procedures, or in Cambodian law — in particular once the Law on Personal Data Protection is promulgated. Material changes will be announced within the System and by internal notice. The effective date shown at the top of this Policy indicates the current version.

16. Contact

Questions, requests or complaints regarding this Policy:

IT Department, Ministry of Water Resources and Meteorology

#47 Preah Norodom Bvd, Phnom Penh, Cambodia

Email: info@mowram.gov.kh

A Khmer-language version of this Policy is available on the Khmer-language version of this website at mowram.gov.kh. In case of discrepancy, the Khmer version prevails.

>> ឯកឧត្តមរដ្ឋមន្ត្រី ថោ ជេដ្ឋា អញ្ជើញចូលរួមកិច្ចប្រជុំលើកទី២៦ របស់គណៈកម្មាធិការជាតិសម្រាប់ការអភិវឌ្ឍតាមបែបប្រជាធិបតេយ្យនៅថ្នាក់ក្រោមជាតិ (គ.ជ.អ.ប.)

>> ឯកឧត្តម អឿង ចន្ថា អនុរដ្ឋលេខាធិការ អញ្ជើញជាអធិបតីបើកសិក្ខាសាលាស្តីពី «ការសរសេរអត្ថបទ និងការថតរូប» សម្រាប់គម្រោងកែលម្អសន្តិសុខទឹកកម្ពុជា

>> លោកជំទាវ វ៉ាន់ ចាន់ថូ អនុរដ្ឋលេខាធិការ អញ្ជើញដឹកនាំកិច្ចប្រជុំពិភាក្សាលើផែនការគម្រោងសាកល្បង PDN នៃគម្រោងគ្រប់គ្រងធនធានទឹកចម្រុះ ជំហានទី២ (SIWRM) នៅខេត្តពោធិ៍សាត់

>> ឯកឧត្តម ឈុន ពុទ្ធារិទ្ធ អគ្គនាយកកិច្ចការបច្ចេកទេស អញ្ជើញចុះពិនិត្យស្ថានភាពនៃការគ្រប់គ្រងទឹក​ និងការប្រើប្រាស់ប្រព័ន្ធធារាសាស្ត្រស្ទឹងជីនិត ស្ថិតក្នុងភូមិសាស្ដ្រខេត្តកំពង់ធំ

>> ឯកឧត្តម ចាន់ ស៊ីណាត រដ្ឋលេខាធិការ បន្តដឹកនាំគណៈប្រតិភូ ADB ចុះពិនិត្យវឌ្ឍនភាពគម្រោងកែលម្អវិស័យធារាសាស្ត្រកសិកម្ម (IAIP) ក្នុងខេត្តតាកែវ