Data processing addendum

This addendum forms part of the terms of service between the customer and Hostspica, a sole proprietorship registered in India (GSTIN 09KGCPK3156D1ZE). It applies to personal data that the customer, its team members and its employees put into PunchMe ("customer personal data").

For customer personal data, the customer is the data fiduciary (controller) and Hostspica is the data processor, as those terms are used in the Digital Personal Data Protection Act, 2023 (DPDP Act). If the terms and this addendum conflict on data protection, this addendum applies.

Details of processing

Data principals

• The customer's employees, interns, contractors and other staff added to PunchMe.
• The customer's owners, HR and other team members using the dashboard.
• People whose details the customer records, such as clients in field visit notes or nominees in employee profiles.

Categories of data

• Identity and employment: name, work email, phone, employee code, department, designation, manager, office, shift, dates of joining and leaving.
• Attendance and leave: punch times, statuses, corrections, leave records.
• Location: GPS position, accuracy and mock-location flag at punch; field-tracking location while on duty, where enabled and consented; client visit notes and photos.
• Face templates: numeric embeddings computed on the device. No face photos are stored.
• Device data: random device identifiers, public keys, push tokens, Play Integrity verdicts, IP addresses.
• Documents and files: uploaded documents, receipts, helpdesk attachments, letters, payslips.
• Payroll and financial: salary, deductions, statutory numbers, bank account, PAN, UAN and ESI details, loans, expenses.
• Other HR records: onboarding and exit tasks, performance reviews, goals, surveys, notices, helpdesk tickets.

Hostspica's obligations

Instructions

Hostspica processes customer personal data only on the customer's documented instructions. These terms, this addendum and the customer's settings and actions in PunchMe are the customer's instructions. If Hostspica is required by law to process data otherwise, it will tell the customer first unless the law forbids it.

Confidentiality

Hostspica keeps customer personal data confidential and makes sure anyone it allows to access the data is bound by confidentiality.

Security

Hostspica maintains reasonable security practices, including:

• HTTPS for all connections;
• AES-256-GCM encryption of face templates, and AES-GCM encryption of bank, PAN, UAN and ESI details, at rest in the application;
• salted PBKDF2 hashing of passwords;
• device-bound signing of punches with single-use, short-lived challenges;
• role and permission based access in the dashboard, with an audit log of actions;
• automatic deletion of field-tracking location pings after 90 days.

Sub-processors

The customer authorises Hostspica to use these sub-processors:

Hostspica will give notice of any new sub-processor by updating this page and informing account owners by email before the new sub-processor starts processing customer personal data. The customer may object on reasonable data protection grounds. If we cannot resolve the objection, the customer may close its account. Hostspica remains responsible for its sub-processors' processing.

Cloudflare's infrastructure is global, so customer personal data may be stored or processed outside India.

Helping with requests

Taking into account the nature of the processing, Hostspica will help the customer respond to data principals exercising their rights (access, correction, erasure, grievance, nomination). Much of this can be done by the customer directly in the dashboard. If Hostspica receives a request directly from a customer's employee, it will pass it to the customer and will not respond itself unless the customer asks or the law requires.

Personal data breaches

Hostspica will notify the customer without undue delay, and within 72 hours, of becoming aware of a personal data breach affecting customer personal data. The notice will describe what is known about the breach, the data and people affected, and the steps taken. Hostspica will provide the information the customer reasonably needs to meet its own obligations to inform the Data Protection Board of India and affected data principals.

Deletion and return

When the customer's account is closed, the customer may export its data using the dashboard reports and CSV exports, and may ask Hostspica to delete customer personal data. Hostspica will then delete it, except where the law requires it to be kept.

Information and audits

On reasonable written request, and no more than once a year unless a breach or a regulator requires it, Hostspica will provide information reasonably needed to show that it meets this addendum, such as written answers to security questionnaires. Requests should go to security@punchme.online.

Customer's obligations

The customer must:

• have a lawful basis for all customer personal data it puts into PunchMe;
• give employees clear notice of the data collected and its purposes before using PunchMe with them;
• obtain employee consent where required, especially for face check and field tracking, and act on withdrawal of consent (for example by resetting face data or turning field tracking off);
• not add anyone under 18 without meeting the DPDP Act's requirements for children's data;
• configure PunchMe settings, roles and permissions appropriately and keep its account secure;
• respond to data principal requests and grievances about its own use of the data.

Contact

• Data protection questions: support@punchme.online
• Security and breach matters: security@punchme.online
• Complaints: our Grievance Officer