PRIVACY POLICY

1. INTRODUCTION

This Privacy Policy ("Policy") explains how Petrocon Engineers and Consultants Private Limited ("PECPL", "we", "us" or "our"; CIN: U42909KA2024PTC193675) collects, uses, stores, shares and protects personal data.

This Policy applies to:

• Employees, contractors, consultants and interns, including users of the Petrocon HRMS web portal (hrms.petroconengineers.com) and the Petrocon HRMS mobile and desktop applications ("the App")
• Job applicants who apply through our careers page
• Clients, vendors and their contact persons
• Visitors to our offices and to this website

It applies to our head office in Mangaluru and to all satellite offices, field sites and engineering operations run under PECPL.

We process personal data in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 and its Rules, under which PECPL is the Data Fiduciary.

2. INFORMATION COLLECTION

2.1 Information We Collect

We collect only the information needed for a defined employment, contractual, operational or legal purpose. Items marked (Sensitive) are sensitive personal data under the SPDI Rules and are collected only with your prior explicit consent (Section 10).

a) Employee Identification and Employment Data:

• Name, employee code, designation and department
• Contact details, alternate phone number and residential address
• Employment history and records

b) Financial and Statutory Data:

• Bank account details for salary payment (Sensitive)
• PAN, Aadhaar, Universal Account Number (UAN), tax regime and payroll records

c) Medical Data:

• Blood group, and medical summaries or history for corporate insurance (Sensitive)
• Dependant details for insurance and benefits

d) Biometric Data:

• Face images captured during registration and attendance marking (Sensitive)
• Facial recognition templates generated for face matching (Sensitive)

e) Location Data:

• GPS coordinates, timestamp and location accuracy, collected only at attendance check-in and check-out

f) Attendance Records:

• Check-in/check-out timestamps, attendance images and shift records

g) Device and Authentication Data:

• Device ID, device model, operating system version and app version
• Phone number and one-time passwords (OTPs) for login
• Passwords, stored only in encrypted (hashed) form (Sensitive)

h) Job Applicant Data:

• Resume, contact details, qualifications and professional history submitted through our careers page

i) Client and Vendor Data:

• Contact names, business correspondence, transaction records and contracts

j) Premises Security Data:

• CCTV footage and visitor entry records at our offices

2.2 Information We DO NOT Collect

We DO NOT collect:

• Contact lists or address books from your device
• SMS or call logs
• Photo gallery, files or browsing history from your device
• Location data outside attendance check-in and check-out
• Information about your sexual orientation
• Any data unrelated to the purposes in Section 3

3. DATA USAGE

We use your information only for the purpose for which it was collected. We do not use bank details, medical data or biometrics for any other purpose without a separate consent.

3.1 Core Functionality:

• Employee authentication and login verification
• Face recognition for attendance marking
• Attendance record management and display of your attendance history
• Showing your employee profile information

3.2 Employment and Administrative Purposes:

• HR management and employee administration
• Payroll processing and salary payment to your bank account
• Statutory deductions, PF, tax and regulatory compliance
• Corporate medical insurance and benefits
• Internal auditing and record-keeping

3.3 Other Purposes:

• Evaluating job applications
• Managing client and vendor contracts and correspondence
• Securing our offices, systems and people (CCTV, access control, IT security)

3.4 We DO NOT:

• Sell your personal information
• Share your information with third parties for marketing or advertising
• Use your location data for tracking outside attendance events
• Use your biometric data for any purpose other than attendance verification

4. DATA STORAGE AND RETENTION

4.1 Data Storage Locations:

• Employee, payroll and attendance records: on PECPL's secure servers and cloud infrastructure hosted on Amazon Web Services in the Mumbai (India) region
• Biometric templates: on isolated, access-restricted systems separated from general IT administration, using AWS Rekognition
• Authentication tokens: temporarily on your device

4.2 Data Retention:

We keep personal data only as long as its purpose or a legal obligation requires.

• Biometric profiles: for the duration of employment
• Job applications: deleted within 365 days if no employment contract is executed
• Attendance and location records: 5 years, as required by labour laws
• Payroll, tax and PF records: 8 years as required by tax and PF laws
• Medical and insurance data: while the insurance cover is active, then 12 months for claim settlement and audit
• Employee records after exit: until the limitation period for employment claims ends
• CCTV footage: 30 days, unless needed for an investigation

4.3 Data Deletion:

• Your biometric profile is permanently and unrecoverably deleted within 24 hours of your exit clearance being generated
• Other records are deleted or anonymised when their retention period ends; marking a record "inactive" is not treated as deletion
• Backups expire automatically on the same schedule
• You may request deletion of your data by contacting the Grievance Officer (Section 11)

5. DATA SECURITY

PECPL maintains an Information Security Management System aligned with the ISO/IEC 27001 standard, as its reasonable security practices and procedures under the SPDI Rules.

5.1 Security Measures:

• Secure HTTPS communication for all data transmission
• Encryption of sensitive data (bank details, Aadhaar, PAN, medical and biometric data) at rest
• OTP-based login, and multi-factor authentication for administrative and remote access
• Least-privilege access: database credentials are segmented, and general IT administrators cannot read raw personal or financial records
• Masking of salary, bank, tax and biometric fields from users who do not need them
• Access logging, monitoring and regular security updates
• Regular audits of third-party software, apps and SaaS tools used by PECPL

5.2 Biometric Data Security:

• Facial recognition templates are encrypted and held on isolated systems
• Access is limited to authorised HR and IT personnel with a documented need
• Biometric data is never shared with third parties for any other purpose

5.3 Device Security:

• Local data encryption on device
• Secure authentication mechanisms
• Automatic logout after inactivity

5.4 Data Breach:

If a personal data breach affects you, we will inform you without delay, explaining what happened, its likely impact, the steps we are taking, and whom to contact. We will also notify the Data Protection Board of India and CERT-In within the timelines required by law.

6. DATA SHARING AND DISCLOSURE

6.1 We DO NOT:

• Sell your personal information to third parties
• Share your data with advertisers or marketing companies
• Disclose your information for commercial purposes

6.2 Limited Sharing:

We share your information only where there is an authorised business purpose or a legal requirement:

• With authorised HR, payroll and management personnel, for administration
• With banks, EPFO, income-tax authorities and insurance providers, for salary, PF, tax and insurance
• With IT and cloud service providers (such as Amazon Web Services and Microsoft 365) that host or maintain our systems, under written data processing and confidentiality agreements. They may use the data only on our instructions and must return or delete it when the contract ends
• With clients, only where a project contract requires staff details
• When required by law, court order or a government authority

On request, we will tell you which categories of recipients have received your data.

7. YOUR RIGHTS AND CHOICES

You can exercise these rights by contacting the Grievance Officer (Section 11). We may ask you to verify your identity first.

7.1 Right to Access:

• View your attendance records and profile in the App
• Request a summary of the personal data we hold about you and the categories of recipients it was shared with

7.2 Right to Correction:

• Correct or update inaccurate, incomplete or outdated information, including financial and identity details

7.3 Right to Erasure:

• Request deletion of your data once its purpose is complete, unless a law requires us to keep it

7.4 Right to Withdraw Consent:

• Withdraw consent at any time, as described in Section 10

7.5 Right to Nominate:

• Nominate a person to exercise your rights in the event of your death or incapacity; the nomination is recorded in the HRMS

7.6 Right to Grievance Redressal:

• Raise a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if it is not resolved

7.7 Limitations:

• Some records, such as payroll, tax and attendance records, must be kept for the period required by law and cannot be deleted before then

8. CHILDREN'S PRIVACY

The App and the HRMS portal are intended only for PECPL personnel aged 18 and above. We do not knowingly collect data directly from anyone under 18.

Where an employee provides details of a child or a person under lawful guardianship (for example, for medical insurance), we use that data only for the stated benefit and with verifiable consent from the parent or lawful guardian. We do not use children's data for tracking, behavioural monitoring, profiling or advertising.

If you believe we have collected information from a minor without such consent, please contact the Grievance Officer.

9. CHANGES TO THIS PRIVACY POLICY

We review this Policy at least once a year and whenever the law or our systems change significantly. We will notify you of material changes through:

• In-app notifications
• Email
• An updated version of this page

The "Last Updated" date at the top shows when this Policy was last revised. Where a change affects processing based on your consent, we will ask for your consent again.

10. CONSENT

We collect sensitive personal data only after you give prior consent through a clear, affirmative action. Installing or using the App or this website does not by itself count as consent.

10.1 HRMS App Onboarding:

Before you enter bank account details, upload medical summaries or register your face for attendance, the App shows a consent screen. Nothing is collected until you tap "I Agree and Accept".

10.2 Careers Page:

You cannot upload your resume until you tick the consent box. The box is never pre-ticked. Your application data is deleted within 365 days if no employment contract is executed.

10.3 Withdrawing Consent:

You may withdraw your consent at any time by contacting the Grievance Officer (Section 11) [or through Profile → Privacy → Withdraw Consent in the App]. We will stop processing the related data as soon as we receive your request.

If the data is essential to a service, we may not be able to provide that service in the same way. For example, if you withdraw biometric consent, we will move you to manual attendance. Withdrawing consent does not affect your employment.

12. APP-SPECIFIC INFORMATION

• App Name: Petrocon HRMS
• Developer/Publisher: Petrocon Engineers and Consultants Private Limited
• App Purpose: Internal HRMS application for attendance management, face recognition-based attendance marking and HR administration
• Target Audience: PECPL employees, contractors, consultants and interns only
• Data Fiduciary: Petrocon Engineers and Consultants Private Limited
• Grievance Officer: Mr. Niteesh Kumar Saini (see Section 11)

13. BIOMETRIC DATA SPECIFIC PROVISIONS

13.1 Collection of Biometric Data:

The App uses facial recognition for attendance verification, only after you have given consent (Section 10). This involves:

• Capturing face images during registration and attendance marking
• Generating facial recognition templates from those images
• Storing templates for matching

13.2 Purpose of Biometric Data:

Biometric data is collected and used solely for:

• Identifying employees during attendance marking
• Preventing attendance fraud
• Automated attendance verification

It is not used for any other purpose.

13.3 Biometric Data Storage:

• Templates are encrypted and held on isolated, access-restricted systems using AWS Rekognition
• General IT administrators cannot access raw biometric records

13.4 Biometric Data Retention and Deletion:

• Retained only for the duration of your employment
• Permanently and unrecoverably deleted within 24 hours of your exit clearance being generated
• Deleted earlier if you withdraw consent, in which case you will be moved to manual attendance

13.5 Biometric Data Sharing:

• Accessible only to authorised HR and IT personnel
• Processed by AWS Rekognition under a data processing agreement
• Never shared with third parties for any other purpose

14. LOCATION DATA SPECIFIC PROVISIONS

14.1 Location Data Collection:

• Collected only at attendance check-in and check-out
• GPS coordinates are captured with a timestamp
• Location accuracy is recorded for verification

14.2 Purpose of Location Data:

• Verifying attendance location
• Ensuring attendance is marked from authorised work locations

14.3 Location Data Storage:

• Stored with attendance records on company servers
• Not collected in the background and not used for tracking
• Deleted together with the attendance record it belongs to

15. GOVERNING LAW

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the SPDI Rules and the Digital Personal Data Protection Act, 2023. Any disputes arising from this Policy are subject to the exclusive jurisdiction of the courts at Mangalore, Karnataka.

16. ACKNOWLEDGMENT

This Policy explains how PECPL handles your personal data. In particular:

• Sensitive personal data (financial, medical and biometric data, and passwords) is collected only after your explicit consent
• Biometric data is used only for attendance verification and is deleted within 24 hours of your exit clearance
• You may withdraw consent, request access, correction or deletion, or raise a complaint at any time through the Grievance Officer
• The App is for internal PECPL use only