Introduction
NSCSPL ("we", "our", "us") provides a secure HRMS mobile app. This Privacy Policy explains what personal data we collect, how it is used, and how we protect it — in accordance with Google Play's User Data and Permissions policies.
We limit data collection to what is strictly necessary for core features like attendance, payroll, and leave management.
Information We Collect
- Personal Information: Name, Employee ID, Contact details, Department, Designation, Employment records.
- Location Data: Collected only during office hours when attendance or journey tracking is active. No background location access without explicit permission.
- Camera Access: Used only for face recognition during attendance verification.
- Files & Media: We use MediaStore API to enable uploads (attendance justifications) and downloads (salary slips). We do not scan unrelated files.
- App & Device Info: Device model, OS version and logs for debugging and performance improvement.
Permissions — Disclosure & Justification
Below table lists app permissions and why they are required.
| Permission | Purpose | Justification |
|---|---|---|
| ACCESS_FINE_LOCATION | Geo-fencing for attendance & journey tracking | Used only during duty hours with a visible notification; ensures on-site attendance. |
| CAMERA | Attendance verification via face recognition | Triggered only during attendance; no background captures. |
| READ_MEDIA_IMAGES / DOCUMENTS | Upload attendance justification (images/documents) | Uses MediaStore API; does not scan unrelated files. |
How We Use Your Information
Data is used strictly for HRMS functions: attendance verification, payroll, leave management, document uploads, and secure notifications.
Face Data & Biometric Information Policy
- Purpose: Face data is collected only to verify identity at the time of attendance marking to prevent proxy attendance.
- Scope: Only a captured image or derived facial encoding is used; no continuous scanning occurs.
- Storage & Retention: Face data is encrypted (AES-256) and stored on organization-controlled servers in India. Retention is limited to business/audit needs and deleted or anonymized after no longer required.
- Sharing: Face data is not sold or transferred. Access limited to authorized HR admins and bound third-party services under NDA when necessary (e.g., cloud backup).
- Consent: Explicit camera permission is requested before capture. Users can withdraw consent and request alternative attendance methods.
- Security: HTTPS for transmission, AES-256 for storage, role-based access control, and regular security audits.
Data Security & Rights
We use end-to-end encryption, secure APIs (HTTPS), enforced authentication, RBAC and periodic security audits. Users can access, update or request deletion of their data (subject to legal retention rules).
Updates & Regional Policy
We may update this policy; users will be notified in-app for significant changes. The app is intended for use within India and employs geo-fencing to restrict access to Indian networks.