Master Privacy Policy

1. Introduction & Scope

Welcome to Staff Mitr (operated at https://staffmitr.in). Staff Mitr provides a multi-tenant cloud Software-as-a-Service (SaaS) workforce management, attendance tracking, and payroll administration platform designed for Indian businesses, manufacturing units, MSMEs, contractors, and logistics organizations.

This Privacy Policy explains how personal data is collected, used, processed, encrypted, stored, shared, and deleted under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

2. Regulatory Classification & Processing Roles

Under Section 2(i) and Section 8 of the DPDP Act, 2023, data processing roles are separated as follows:

3. Information We Collect

• Employer Profile: Company name, registered address, GSTIN, PAN, branch names, administrator names, business emails, and phone numbers.
• Employee Personal Data: Full name, employee code, mobile number, personal email, date of birth, gender, shift schedule, department, and designation.
• Biometric Information (Sensitive Personal Data): Irreversible 128D/512D facial recognition numerical embeddings and facial landmark geometry. Staff Mitr does not store raw uncompressed video streams or monetize facial images.
• Attendance & Location: Check-in/out timestamps, break intervals, overtime, and GPS coordinates captured only at the moment of an active attendance punch or authorized field-sales visit. We do not perform continuous 24/7 background location tracking.
• Payroll & Banking Details: Basic wages, HRA, statutory allowances, PF UAN numbers, ESIC IP numbers, PAN, bank account numbers, IFSC codes, salary loans, and bonus records.
• Compliance Documents: Scanned identity cards (Aadhaar, PAN, bank passbooks), contractor passes, and adolescent worker health/consent certificates where applicable.

4. Adolescent Workers & Child Labour Prohibition (DPDP Act Sec 9 & OSHWC Code 2020)

In strict compliance with the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986 and the Occupational Safety, Health and Working Conditions (OSHWC) Code, 2020:

• Child Labour Prohibition: Employment of any child below 14 years is strictly barred. The Staff Mitr platform automatically rejects onboarding of any worker whose computed age is below 14.
• Adolescents (Ages 14–17): Permitted strictly in non-hazardous occupations with: (1) Verifiable parental/guardian consent under DPDP Act Section 9, (2) Medical Fitness Certificate issued by a Certifying Medical Practitioner, and (3) Software-enforced prohibition against night shifts (7 PM to 6 AM) and overtime.

5. Biometric Safeguards & Encryption Standards

Staff Mitr implements enterprise-grade technical safeguards mandated under Section 8(5) of the DPDP Act:

• At-Rest Encryption: Biometric facial embeddings and landmark arrays are stored in PostgreSQL using AES-128-CBC with HMAC-SHA256 (Fernet specification).
• In-Transit Encryption: Enforced TLS 1.3 encryption across all web, kiosk, and mobile API endpoints.
• Private Media Gate: Payslips, identity cards, and health certificates are served strictly through an authenticated, tenant-scoped reverse proxy that rejects unauthenticated direct URLs.
• Brute-Force & Session Defense: Login rate limiting (5 attempts/min with 300s lockout) and single active mobile session ("Phone B kicks out Phone A").

6. Data Sharing & Sub-Processors

Staff Mitr does not sell, rent, lease, or monetize customer or employee data to third-party advertisers or data brokers. Data is processed solely through certified cloud infrastructure located in India, Google Firebase Cloud Messaging (for operational app alerts), and certified Indian telecom relays for transactional SMS/OTP verification.

7. Dual-Tier Retention & Erasure Policy

• Tier 1 (Immediate Privacy Purge): Biometric facial vectors and mobile session credentials are permanently purged immediately upon employee exit or consent revocation.
• Tier 2 (Statutory Compliance Archive): Salary registers, attendance aggregates, and tax documents are retained in a soft-deleted, restricted archive for 7 to 8 financial years in compliance with the Income Tax Act, 1961 and Code on Wages, 2019.

8. Data Principal Rights & Grievance Redressal

Employees and users have the right to access their attendance and payslips, request corrections to inaccurate data, and lodge grievances. In compliance with Rule 5(9) of the SPDI Rules, 2011 and Section 8(9) of the DPDP Act, 2023, you may contact our dedicated Grievance Officer: