1. Scope & Legal Framework
This Biometric Data Privacy Policy governs the processing of facial biometric identifiers through ServeSaaS HR, an enterprise workforce management system provided by ServeSaaS Technologies, having its corporate head office in Pune, Maharashtra, India.
We strictly adhere to the provisions of India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and statutory guidelines mandated under the Factories Act, 1948.
2. Zero Raw Photo Storage Architecture
The bedrock of our industrial biometric architecture is the absolute refusal to store raw facial photographs on server disks or cloud infrastructure:
- Temporary Memory Capture: When a worker stands before the tablet kiosk, the camera feed is processed transiently in the tablet's volatile memory (RAM).
- Mathematical Vectorization: Our deep-learning engine extracts nodal geometric distances between facial landmarks, transforming them into a 512-dimensional encrypted numerical vector.
- Zero Reconstruction Capability: It is mathematically impossible to invert, decompile, or reconstruct a human face photo or likeness from this numerical array.
- Immediate Image Discard: The physical photograph frame is permanently wiped from memory the millisecond extraction completes. No raw pictures are written to storage drives or transmitted across networks.
3. Purpose Limitation & Statutory Utility
Biometric embeddings are collected and processed solely for legitimate operational purposes within manufacturing plants:
- Identity Verification: Eliminating buddy-punching, ghost workers, and fraudulent overtime claims at plant entry gates.
- Muster Roll Compliance: Recording accurate shift in-punch and out-punch timestamps to maintain statutory registers under the Factories Act, 1948.
- Statutory Wage Calculation: Generating audit-compliant salary slips based on verified working hours and approved overtime.
Biometric identifiers are never used for behavioral profiling, surveillance beyond shift gates, marketing, or credit scoring.
4. Data Subject Rights & Right to Erasure
In full accordance with Section 12 of the DPDP Act 2023:
- Right to Erasure: When an employee resigns, completes their contract, or is discharged, the employer marks their profile inactive. Upon request, all associated mathematical vector embeddings are permanently and irreversibly purged from active databases.
- Data Portability: Plant administrators can export complete historical attendance muster rolls, overtime logs, and salary registers in CSV/Excel formats at any time.
- Grievance Redressal: Any factory worker or contractor employee can register biometric data queries through their HR desk or directly via our Data Governance desk.
5. Bank-Grade Security Safeguards
ServeSaaS Technologies enforces multi-layered technical safeguards:
- Encryption in Transit: All communication between factory tablet kiosks and our cloud backend utilizes TLS 1.3 cryptographic protocols.
- Encryption at Rest: All database records, attendance timestamps, and mathematical embeddings are encrypted using AES-256 standards.
- Zero Third-Party Monetization: We do not sell, rent, license, or monetize employee or factory data to any third-party advertisers, insurance providers, or external entities.
6. Corporate Data Protection Officer
Corporate Office: Pune, Maharashtra, India
Privacy & Data Governance Desk: info@servesaas.in
Technical Escalations: support@servesaas.in