Privacy Policy

1. Scope & Data Controller / Processor

This Privacy Policy ("Policy") describes how Shurt TechSol ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you access or use the Shurt HRMS platform.

This Policy is prepared to comply with:

• Digital Personal Data Protection Act, 2023 (DPDPA) — India
• Information Technology Act, 2000 and IT (Amendment) Act, 2008 — India
• IT (SPDI) Rules, 2011 — Sensitive Personal Data protection
• Google Play Store Data Safety Policy and Families Policy
• Apple App Store App Privacy Details requirements and Review Guidelines
• GDPR — to the extent applicable for EEA-based users

1.1 Data Controller vs. Data Processor

As Data Processor: With respect to Employee personal data, Shurt TechSol processes data on behalf of the Organisation (the data controller) per the Organisation's instructions and a Data Processing Agreement.

As Data Controller: With respect to Organisation Admin account data and data collected for the Company's own purposes (billing, security, product improvement), Shurt TechSol is the data controller.

2. Legal Bases for Processing

3. Categories of Personal Data Collected

4. Biometric Data — Special Category

4.1 What We Capture & Store

We do not store raw facial photographs in our primary operational database. The AI attendance system converts facial images into encrypted mathematical feature vectors (embeddings) — numerical representations that cannot be reverse-processed to reconstruct a recognisable photograph.

Original images may be temporarily retained as an audit record for attendance disputes, subject to the retention schedule in Section 8.

4.2 Consent & Withdrawal

Biometric enrolment is voluntary and requires explicit, informed, documented consent from each Employee prior to activation.

Consent may be withdrawn at any time by written request to the Organisation Admin or our Grievance Officer. Biometric data will be permanently deleted within 7 business days of verified withdrawal.

4.3 Storage & Access Controls

• Feature vectors are stored with AES-256 encryption under separately managed keys from other data categories.
• Biometric data is physically and logically segregated at the database level.
• Access is restricted to the automated AI inference system. No Shurt TechSol employee accesses individual biometric vectors in unencrypted form.
• All access to biometric data stores is subject to comprehensive audit logging.

4.4 No Third-Party Disclosure

Biometric data is never sold, rented, licensed, or disclosed to any third party — including advertisers, data brokers, or government authorities — except pursuant to a valid, legally enforceable court order.

Any such compelled disclosure will be notified to the Organisation to the extent permitted by law.

5. Location Data

5.1 Collection Basis & Frequency

Location data is collected only when an Employee has an active clock-in session and location tracking has been enabled by the Organisation.

Collection occurs at intervals of every 15 to 30 minutes and upon specific trigger events. No location data is collected outside active work sessions.

5.2 Permission Levels

• Foreground ("While Using App"): Captured while the app is actively open. Used for standard attendance geo-verification.
• Background ("Always Allow"): Captured while the app runs in background. Required only for field employee configurations. Employees receive a clear system-level permission dialog and must explicitly grant permission.

5.3 Purpose Limitation

Location data is processed exclusively for attendance geo-verification, field workforce monitoring, route validation, and operational compliance reporting.

It is not used for advertising, cross-app tracking, personal profiling unrelated to employment, or disclosed to data brokers.

5.4 Employee Transparency

Employees can view their own historical location data through the mobile application. Admin access is governed by role-based permissions configured at the Organisation level.

6. Purposes of Processing

• Platform Service Delivery: Providing attendance, payroll, task, expense, shift, leave, and regularisation functionality.
• Identity Verification: Running AI facial recognition for attendance marking.
• Payroll Processing: Computing salaries, statutory deductions (PF, ESI, TDS, PT), and generating payslips and compliance reports.
• Workforce Management: Enabling Organisations to manage shifts, tasks, expenses, and field operations.
• Security & Fraud Prevention: Detecting and preventing unauthorised access, attendance spoofing, expense fraud, and data breaches.
• Legal & Regulatory Compliance: Complying with labour, tax, and data protection law; responding to lawful authority requests.
• Support & Communication: Responding to support requests; sending service-critical notifications.
• Product Improvement: Using anonymised, aggregated data to improve features and AI model accuracy.
• Billing & Account Management: Processing Subscriptions, invoicing, and managing contracts with Organisations.

7. Data Sharing & Third-Party Disclosure

We do not sell personal data. We disclose it only in the following circumstances and only to the minimum extent necessary:

All third-party processors are bound by Data Processing Agreements restricting use to stated purposes and requiring equivalent data protection standards.

8. Data Retention Schedule

Upon Subscription termination, data remains available for export for 60 days. After this period, all data is permanently and irreversibly deleted from all live and backup systems.

9. Data Security

• Encryption in Transit: All data transmitted between clients and servers is encrypted using TLS 1.3.
• Encryption at Rest: All stored data is encrypted using AES-256. Biometric data has an additional encryption layer with separately managed keys.
• Access Controls: Role-based access control (RBAC) with least-privilege principles. MFA is enforced for all internal Shurt TechSol administrative access.
• Infrastructure Security: Hosted on SOC 2 Type II certified cloud infrastructure. Regular independent penetration testing is conducted.
• Audit Logging: All access to and modifications of personal data are logged in tamper-resistant logs retained for 2 years.
• Vulnerability Management: A formal programme addresses identified vulnerabilities within defined SLAs.
• Data Isolation: Biometric data is physically and logically segregated from all other data categories.

10. Your Rights as a Data Principal

• Right of Access: Request confirmation of and access to personal data.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of personal data where legally permitted.
• Right to Withdraw Consent: Withdraw consent for biometric or location processing.
• Right to Data Portability: Request a machine-readable copy of your data.
• Right to Nominate: Nominate another individual to exercise rights in the event of incapacity.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer.
• Right to Object (GDPR): Object to processing based on legitimate interests.

Requests are acknowledged within 48 hours and resolved within 30 days.

11. Children's Privacy

The Shurt HRMS Platform is exclusively for employed adults. It is not directed at or intended for use by children under the age of 18.

We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete it immediately.

12. Cookies & Tracking Technologies

12.1 Web Application

• Strictly Necessary Cookies: Authentication session tokens and CSRF protection.
• Security Cookies: Fraud detection and anomalous login detection.
• Functional Cookies: UI preferences and language settings.
• Analytics Cookies: Anonymised usage analytics for product improvement.

We do not use cookies for advertising or cross-site tracking.

12.2 Mobile Application

The app uses device-local secure storage for authentication tokens and preferences only.

13. Third-Party SDKs & Integrations

14. International Data Transfers

Personal data is primarily stored and processed on servers located within India.

Where cloud providers process data outside India, we ensure adequate safeguards are in place, including SCCs and Data Processing Agreements.

15. Policy Updates

We may update this Policy to reflect changes in data practices, legal obligations, or regulatory guidance.

For material changes, we will update the “Last Updated” date and notify Organisation Admins.

16. Grievance Officer & Contact

In accordance with applicable laws, Shurt TechSol has designated a Grievance Officer for privacy concerns and complaints.

If your grievance is unresolved, you may escalate to the Data Protection Board of India (once constituted under DPDPA 2023) or a court of competent jurisdiction. EEA-based users may also lodge a complaint with their local data protection supervisory authority.