Privacy Policy and Data Security Assurance

1Introduction

Realtime Biometrics India Pvt. Ltd. (“Realtime Biometrics”, “we”, “our” or “us”) is committed to protecting the privacy, confidentiality and security of customer and employee information processed through our Cloud Attendance and Payroll Software.

Our software helps organizations manage employee attendance, biometric device integration, shift schedules, leave records, payroll calculations, employee information and related HR activities.

We understand that attendance and payroll information is confidential. We take reasonable technical, organizational and administrative measures to protect personal data against unauthorized access, misuse, alteration, disclosure, loss or destruction.

2Scope of This Policy

This Privacy Policy applies to our cloud-based attendance and payroll software, associated web portals, mobile applications, biometric integrations, APIs and related services, where applicable.

It explains:

• What information may be collected and processed.
• How information is used and protected.
• Who may access customer information.
• How data is stored, retained and deleted.
• How customers can request assistance with privacy and security matters.

3Information We Collect

Depending on the features enabled by the customer, the software may process the following information:

A. Customer and Company Information

• Company name, address and contact details.
• Administrator name, email address and phone number.
• Account details, subscription information and renewal status.

B. Employee Information

• Employee name, employee ID and department.
• Designation, contact details and employment-related information.
• Shift assignments, holidays and leave records.

C. Attendance Information

• Employee check-in and check-out records.
• Attendance dates, working hours, late arrivals and early departures.
• Attendance corrections, overtime and attendance reports.
• Device identifiers and related attendance transaction records.

D. Biometric and Device Information

Where supported and configured, the software may process biometric attendance records, device-generated identifiers, fingerprint or facial verification results, or biometric templates transmitted by compatible devices.

The precise biometric information processed depends on the device model, integration method and software configuration. We do not claim that biometric images or templates are never transmitted or stored; this must be verified against the actual device and software implementation.

E. Payroll and HR Information

Where payroll features are enabled, information may include salary structures, allowances, deductions, loan and advance records, statutory payroll details and salary statements.

F. Technical Information

The system may process login history, IP addresses, device information, audit logs, error reports and technical usage information necessary for security, troubleshooting and service operation.

4Purpose of Data Processing

Information is processed only for legitimate, specified and authorized service purposes, including:

1. Providing cloud attendance and payroll services.
2. Synchronizing attendance records from connected biometric devices.
3. Calculating attendance, working hours and salary-related information.
4. Generating reports and maintaining employee records.
5. Authenticating users and managing account permissions.
6. Providing customer support, troubleshooting and maintenance.
7. Monitoring suspicious activity and protecting system integrity.
8. Managing subscriptions, renewals and service-related communication.
9. Meeting applicable legal obligations.

We do not use customer employee data for unrelated purposes without an appropriate lawful basis.

5Customer Data Ownership and Control

Customer organizations retain their rights over the business and employee information they submit to the software, subject to applicable law and the rights of the individuals concerned.

Realtime Biometrics provides the software service and processes customer information to deliver the agreed functionality.

The customer organization is responsible for ensuring that it has the necessary authority, notices, permissions or other lawful grounds to collect employee information and use attendance, biometric and payroll features.

Realtime Biometrics will process customer information in accordance with applicable law, contractual commitments and authorized service instructions.

6Data Security and No-Unauthorized-Disclosure Commitment

We implement or seek to implement appropriate security safeguards proportionate to the nature of the information and the risks involved.

Depending on the deployment and configuration, safeguards may include:

• Access control: User accounts and role-based permissions to restrict access to authorized users.
• Authentication: Login verification and password-protection mechanisms.
• Secure transmission: HTTPS/TLS encryption for supported connections where properly configured.
• Server protection: Appropriate server security, patching, firewall controls and restricted administrative access.
• Database protection: Appropriate database access restrictions and protection against unauthorized queries or access.
• Audit and monitoring: Relevant access logs, error monitoring and investigation of suspicious activity.
• Backup and recovery: Appropriate backup and restoration procedures to support data recovery.
• Personnel confidentiality: Restricting employee and support-team access to information based on operational need.
• Incident response: Procedures for investigating, containing and addressing suspected security incidents.

Actual safeguards depend on the hosting environment, software version, integrations and customer configuration. Only safeguards that have been implemented and verified should be represented as operational security controls.

Our assurance to customers

Realtime Biometrics does not intentionally sell, rent or disclose customer employee information to unauthorized third parties for their independent commercial use.

We will take reasonable steps to prevent unauthorized access, misuse or disclosure of information under our control.

However, no internet-based application, cloud infrastructure or electronic storage system can be guaranteed to be completely free from every security risk. Accordingly, we do not provide an absolute guarantee that a data leak or security incident is impossible.

7Confidentiality and Authorized Access

Access to customer data should be limited to authorized personnel and service providers who require it for approved operational purposes.

Authorized access may be necessary for:

• Customer-requested technical support.
• Troubleshooting attendance or synchronization issues.
• System maintenance and security investigations.
• Backup restoration and service continuity.
• Legal or regulatory compliance.

Where third-party hosting, infrastructure, messaging or other service providers are used, relevant information may be processed by them to provide the service. Appropriate contractual and security measures should be applied where required.

We will not intentionally provide customer account access to another customer or reseller without authorization.

8Customer Data Separation

Customer accounts and employee records should be protected through appropriate logical access restrictions so that users of one customer organization cannot access another organization's records.

Access to each organization's data must be limited according to its account permissions and authorized integrations.

Realtime Biometrics will take reasonable measures to maintain this separation. The effectiveness of tenant isolation depends on the deployed architecture and configuration.

9Data Storage and Retention

Customer data is retained for the period necessary to provide the contracted services, maintain attendance and payroll history, support backups, resolve disputes and meet applicable legal requirements.

Retention periods may vary according to the type of information, customer instructions, contractual requirements and applicable law.

When information is no longer required, it should be deleted, anonymized or otherwise disposed of securely, subject to lawful retention requirements and backup lifecycle limitations.

Upon termination of a customer's subscription, data export and deletion will be handled in accordance with the applicable contract, available software functionality and legal obligations.

Customers should request an export of important records before account closure or expiry where necessary.

10Biometric Data Privacy

Biometric information requires particular care because it may be difficult or impossible to replace if compromised.

Where biometric functionality is enabled:

• The customer should inform affected employees about the relevant collection and use of biometric information.
• Biometric information should be used only for authorized purposes, such as attendance verification and related access-control functionality.
• Access to biometric information should be restricted to authorized personnel and systems.
• Customers should configure compatible devices and integrations according to the manufacturer's security recommendations.
• Biometric information should not be disclosed or reused for unrelated purposes without an appropriate lawful basis.
• Retention and deletion should follow applicable law, contractual requirements and the configured device and software capabilities.

Some biometric devices store templates locally and transmit attendance events or verification results instead of raw biometric images. Other configurations may process or transmit different information. Customers should verify the specific behavior of their device model and integration.

11Sharing of Information

We may share limited information where reasonably necessary for:

• Hosting and infrastructure services.
• Authorized biometric device or software integrations.
• Customer-requested support and maintenance.
• Payment processing and subscription management.
• Legal obligations, lawful orders or regulatory requirements.
• Investigating fraud, misuse or security incidents.

We do not authorize service providers to use customer employee data for unrelated purposes merely because they support our service.

We do not sell customer employee information as a commercial data product.

12Data Breach and Security Incident Response

If we become aware of a personal data breach affecting information under our responsibility, we will take appropriate steps to investigate the incident, contain its impact, mitigate risks and prevent recurrence.

Where required by applicable law, we will notify affected customers, individuals and relevant authorities within the prescribed timelines and provide the required information.

Depending on the incident, communications may describe:

• The nature and scope of the incident.
• The types of information affected.
• The steps taken to contain and investigate it.
• Recommended protective actions.
• Measures being implemented to reduce future risk.

13Customer Responsibilities

Customers using the software should:

1. Keep administrator and employee login credentials confidential.
2. Assign permissions according to employees' job responsibilities.
3. Remove access for former employees and unauthorized users promptly.
4. Use secure devices, networks and supported software versions.
5. Obtain necessary employee notices, permissions or other lawful grounds.
6. Avoid sharing attendance or payroll reports through unsecured channels.
7. Inform us promptly if they suspect unauthorized access to their account.
8. Review employee records and exported data for accuracy.
9. Configure biometric devices and third-party integrations securely.

Customers are responsible for actions performed through their authorized accounts and for their own employee-data management practices, subject to applicable law and the circumstances of any incident.

14Employee Privacy Rights and Requests

Subject to applicable law, individuals may have rights relating to access to information, correction, completion, updating, erasure, withdrawal of consent and grievance redressal.

An employee should ordinarily contact their employer or the relevant organization that manages their attendance and payroll records.

Where Realtime Biometrics receives a request relating to information processed on behalf of a customer, we may coordinate with that customer to verify the request and take appropriate action.

Requests may be submitted to the privacy contact provided below.

15Third-Party Websites and Integrations

Our software may integrate with third-party biometric devices, payment gateways, communication providers, mobile platforms or external applications.

Those services may have their own privacy policies and security practices. Their processing of information is subject to their applicable terms and policies, as well as any agreements and legal requirements governing the integration.

Customers should review the relevant third-party terms before enabling an integration.

16Children's Data

The software is primarily intended for organizational attendance, workforce and payroll management. Customers should not submit children's personal data unless the service is appropriately configured for the purpose and the collection and processing comply with applicable legal requirements.

Where children's data is processed, additional safeguards and permissions may be required under applicable law.

17Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, security practices, legal obligations or business operations.

The latest version will be published on our designated website or software portal with an updated effective date. Where required, material changes will be communicated through appropriate channels.

18Grievance Redressal and Contact Information

For privacy concerns, data access requests, suspected unauthorized disclosure or security complaints, please contact:

Realtime Biometrics India Pvt. Ltd.

Please include your company account name, a description of the concern and relevant details. Do not send passwords, OTPs or unnecessary sensitive employee information in your complaint.

We will review privacy and security complaints and respond in accordance with applicable law and our established procedures.

19Legal Compliance

This Privacy Policy is intended to support responsible data handling in accordance with applicable Indian data-protection and information-technology laws, including the Digital Personal Data Protection Act, 2023 and applicable rules, to the extent in force and applicable.

This policy does not replace customer agreements, data-processing agreements, statutory notices or other legal documents that may be required for a particular deployment.

20Final Privacy and Security Statement

Realtime Biometrics India Pvt. Ltd. recognizes that attendance, biometric and payroll records are confidential business and personal information.

We are committed to protecting customer information through appropriate safeguards, restricting access to authorized purposes, avoiding unauthorized disclosure and responding responsibly to security incidents.

By using the software, customers should review this policy and ensure that their use of the service complies with applicable law and their contractual obligations.