Data Processing Agreement (DPA)

1. Legal Basis & Purpose

This Data Processing Agreement ("DPA") governs the processing of Customer Personal Data by Staff Mitr Technologies ("Data Processor") on behalf of the Customer ("Data Fiduciary") pursuant to Section 8(5) and Section 8(7) of the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Processing Scope & Instructions

Staff Mitr processes workforce data strictly in accordance with documented Customer instructions configured through the SaaS portal, including:

• Facial recognition biometric matching and kiosk attendance logging.
• GPS check-in validation against designated geofence coordinates.
• Shift mapping, overtime computation, and leave deduction workflows.
• Monthly payroll calculations, statutory deductions (PF/ESIC/PT), and payslip generation.
• Storage of identity proofs, bank details, and adolescent worker health/parental consent documents.

3. Data Processor Obligations

• Technical Safeguards: Enforce AES-128/Fernet encryption on biometric facial templates at rest, TLS 1.3 in transit, and row-level multi-tenant database isolation.
• Confidentiality: Ensure all engineers and support personnel handling Customer data are bound by strict contractual non-disclosure agreements.
• Assistance with Data Principal Rights: Provide administrative portal tools enabling the Customer to fulfill employee requests to access, update, export, or erase personal data.
• Breach Notification: Notify the Customer in writing within 24 hours of confirming any unauthorized access or personal data breach.

4. Sub-Processors

The Customer grants general authorization for Staff Mitr to utilize accredited infrastructure sub-processors (e.g. MeitY-empaneled Indian cloud data centers, Google Firebase for push notifications, and certified telecom relays for transactional SMS/OTP). Staff Mitr remains fully liable for sub-processor compliance.

5. Return & Deletion of Data

Upon termination of the SaaS agreement, Staff Mitr provides a 30-day export grace window for Customer records (CSV/Excel/PDF), followed by irreversible cryptographic erasure of active tenant records within ninety (90) days, subject to mandatory statutory tax and company law retention schedules.