BOM ERP App Privacy Policy

Last updated: October 24, 2026

This Privacy Policy explains how information is collected, used, stored, and protected when authorized Bank of Mongolia employees use the BOM ERP / “Digital Office” mobile application (the “App”).

1. Purpose of the App

The App gives authorized Bank of Mongolia employees access to work-related information, attendance records, requests, official documents, tasks, the employee directory, cafeteria menus, employee bus information, and other internal services.

2. Information We May Process

Depending on the features used, the App may process:

• Authentication and security data: domain username, password transmitted during sign-in, multi-factor authentication code, a generated device identifier, session token, and trusted-device token. The App does not store the user's password on the device.
• Employee information: employee ID, name, department/unit, position, class, status, business phone and email, registration number, profile photo, system roles, and work schedule.
• Work activity data: attendance, leave and other requests, approvals, official documents, tasks, room/service/equipment orders, and descriptions or selections submitted through the App.
• Location data: with permission, precise location may be used while the App is open to show the user's current position on the employee bus map. The App does not store that location on its servers or track the user outside the App.
• Device and network data: App version, network connection status, Wi-Fi gateway address used to choose the appropriate internal or external connection, and technical error information needed to operate the service.
• Biometric authentication: when enabled, the App can use Face ID, Touch ID, or fingerprint authentication provided by the device operating system. The Bank and the App do not access or store biometric templates or raw biometric data; the App receives only the authentication result.

3. How We Use Information

Information is used to authenticate users, enforce access rights, protect accounts, provide internal services and workflows, display authorized organizational information, show maps and bus routes, diagnose errors, maintain security and reliability, and meet legal, policy, and audit obligations.

4. Sharing of Information

The App does not sell personal information and does not use it for advertising or advertising-related tracking. Information may be shared only:

• with authorized Bank of Mongolia personnel and internal systems according to job duties and access permissions;
• with service providers operating under the Bank's instructions where necessary to run the App;
• with the Google Maps platform when map features are used; Google may process technical information under its own terms and privacy policy;
• where required by law or a lawful request from an authorized public body.

5. Storage on the Device

The App stores session and trusted-device tokens in protected device storage where available. The username, employee profile, settings, and similar information may be cached on the device to improve operation. Most locally stored information is removed when the user signs out, clears App data, or uninstalls the App. Work records created in the Bank's core systems remain subject to organizational retention rules.

6. Retention

Information is retained for as long as needed to provide the service, administer employment and organizational operations, protect security, complete audits and archives, and meet legal obligations. Retention periods depend on the information type and applicable internal rules.

7. User Choices and Rights

Users may revoke location permission through device settings and disable biometric sign-in through the App settings. The related optional feature may then be unavailable, but standard sign-in remains available. Questions or requests to access, correct, or otherwise address personal information may be submitted using the contact details below. Some employment or work records may need to be retained for legal, audit, or mandatory organizational purposes.

8. Security

The Bank uses HTTPS transmission, access controls, protected device storage, and appropriate organizational and technical safeguards designed to protect information from unauthorized access, alteration, disclosure, or destruction. No electronic system can eliminate all risk.

9. Children

The App is intended only for authorized Bank of Mongolia employees and is not directed to children. The App does not knowingly collect children's information.

10. Changes to This Policy

This policy may be updated when the App, applicable law, or organizational requirements change. The updated version will be posted on this page with a revised “Last updated” date.

11. Contact