Privacy Policy

1. Scope

This Policy explains how [Legal Entity Name], operating as "SugamSuraksha" ("we", "us", "our"), handles personal data in two contexts: (a) this marketing website, and (b) the SugamSuraksha platform used by subscribing organizations ("Customers") and their users. It applies to visitors of this website, to Customers and their Teammates, and — through our Customers — to the employees, students, residents, visitors, or other individuals whose data a Customer manages on the platform ("End Users").

For platform data about End Users, the Customer organization decides what data is collected and why; we process it on the Customer's behalf and instruction, as described in our Terms & Conditions.

2. Information We Collect

• Account & organization data: organization name, registration details, address, and the account Owner's and Teammates' name, email, phone, and role.
• Profile data (optional): date of birth, personal address, emergency contact, preferred language, and a profile photo, if a user chooses to add them.
• Attendance & access data: check-in/check-out times, location (for mobile self-service check-ins, only when the user actively uses that feature), shift and roster assignments, and leave records.
• Identification data, including biometric data: where a Customer enables face or fingerprint-based attendance, we store a provider reference and (for face recognition) an enrollment image — never the raw biometric sample in reusable form outside that purpose. Employee ID numbers and other identification references are encrypted at rest. Biometric data is treated as sensitive personal data and is collected only where the Customer has configured that method and obtained the necessary consent from the individual.
• Visitor & guest data: name, contact details, photo, and visit details for visitors hosted by a Customer organization.
• Communications data: content and metadata of in-app notifications, and your consent choices for email, SMS, or WhatsApp communications.
• Payment & billing data: subscription plan, billing cycle, and transaction references — processed through our payment provider; we do not store full card or bank details ourselves.
• Technical data: device identifiers for push notifications, IP address, and basic request logs for security and troubleshooting.
• Contact form data: if you write to us through this website's Contact Us page, the name, email, and message you provide.

3. How We Use Information

• To provide, operate, and maintain the platform — attendance processing, visitor and gate management, workforce and roster management, notifications, and reporting.
• To authenticate users and secure accounts.
• To process payments and manage subscriptions.
• To send transactional communications (for example, approval requests, attendance notices, and account notices) and, where you have consented, other communications by email, SMS, or WhatsApp.
• To respond to support and contact requests.
• To comply with legal obligations, and to detect, prevent, and investigate fraud, abuse, or security incidents.

4. Legal Basis & Consent

Where we or our Customers rely on your consent — in particular for biometric identification methods and for marketing or non-essential communications — that consent is recorded and can be withdrawn at any time; withdrawing consent for a communication channel does not affect transactional messages necessary for the service to function. Where processing is necessary to perform our contract with a Customer, or to comply with a legal obligation, we rely on that basis instead of consent.

5. How We Share Information

We do not sell personal data. We share it only as follows:

• Within a Customer organization — with the Customer's own administrators and authorized users, according to the roles and permissions the Customer configures.
• Infrastructure & hosting: Amazon Web Services (AWS), for application hosting, database storage, and file storage, primarily in AWS's India (Mumbai) region.
• Email delivery: Amazon Simple Email Service (SES).
• Push notifications: Google Firebase Cloud Messaging, to deliver mobile app notifications.
• Payments, SMS, and WhatsApp (where a Customer enables these channels): the relevant payment gateway or messaging provider, solely to carry out that transaction or message.
• Legal & safety: where required to comply with law, a valid legal process, or to protect the rights, property, or safety of SugamSuraksha, our Customers, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to the transferred data.

6. Security Measures

We maintain technical and organizational measures appropriate to the sensitivity of the data involved, including:

• Encryption at rest (AES-256-GCM) for identification data such as biometric provider references, employee ID numbers, and other sensitive profile fields, using keys scoped separately from other application secrets.
• One-way hashing for credentials such as QR/RFID tokens, so a stored value cannot be reversed into the original credential.
• Role- and permission-based access control within each Customer organization, so only authorized users can view or manage a given category of data.
• Encrypted connections (TLS/HTTPS) for all data in transit between your device, this website, and the platform.
• Primarily India-region (Mumbai) hosting for platform data.

No system is completely secure. If you become aware of a security issue affecting your data, please contact us using the details in Section 13.

7. Data Retention & Deletion

We retain personal data for as long as your account or your organization's account is active, and afterward only as needed to comply with legal, accounting, or regulatory obligations, resolve disputes, and enforce our agreements.

Individual users can request deletion of their own account at any time from within the platform. A deletion request has a grace period during which it can be cancelled; once processed, we permanently remove personally-identifying fields from the account (name, contact details, photos, identification data) and permanently disable sign-in, while records that a Customer organization needs for its own business or legal purposes (for example attendance or leave history) are kept, now associated with an anonymized record rather than your identity.

A Customer organization's designated Owner can separately request termination of the entire organization's account; this deactivates the account and cancels billing, and is reviewed by our team before it takes effect — it does not, by itself, delete the organization's stored data.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you — available directly in the platform (your profile), or on request.
• Correct inaccurate personal data — most profile fields are self-editable; others are managed by your organization's administrator.
• Export a copy of your own personal data — available as a self-service download directly from the platform.
• Delete your own account and personal data — available as a self-service request directly from the platform, described in Section 7 above.
• Withdraw consent for a given communication channel or, where applicable, an identification method, at any time.
• Lodge a complaint with our Grievance Officer (Section 13) or with the competent data protection authority.

If you are an End User of a Customer organization rather than a direct SugamSuraksha Customer, we recommend contacting that organization first, since it controls what data is collected about you and why; we will still assist directly on request.

9. Children's Data

The platform is not directed at children, except where an educational institution (a Customer) uses it to manage attendance or access for enrolled students under the institution's own authority and, where required by law, with appropriate parental or guardian consent obtained by that institution. We do not knowingly collect children's personal data directly from this website.

10. International Data Transfers

Platform data is primarily hosted in India. If any data is processed or stored outside India by a sub-processor listed in Section 5, we require appropriate safeguards consistent with applicable data protection law, including, where relevant to users in the European Economic Area or United Kingdom, safeguards consistent with the General Data Protection Regulation (GDPR).

11. Cookies & Tracking on this Website

This marketing website does not use tracking or advertising cookies. It stores a single, non-tracking preference in your browser's local storage — your choice of light or dark theme — which is never transmitted to us and can be cleared at any time by clearing your browser's site data.

12. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy on this page with an updated "Last updated" date, and for material changes we will make reasonable efforts to notify account Owners by email.

13. Grievance Officer & Contact

For privacy questions, data subject requests, or grievances under applicable Indian law (including the Information Technology Act, 2000, its rules, and the Digital Personal Data Protection Act, 2023), contact our Grievance Officer:

• Name / Designation: [Grievance Officer Name], Grievance Officer
• Email: contact@sugamsuraksha.com
• Phone: +91 76888 11146
• Address: [Registered Office Address]