Privacy Policy

1. Introduction and Scope

This Data Privacy Policy governs how Airwix Technologies collects, processes, stores, and protects personal and employment-related data through its web portals and the Airwix Payroll mobile application (collectively, the "Platform").

Airwix Technologies operates strictly as a Business-to-Business (B2B) Human Resource Management System (HRMS) and SaaS provider. This policy has been designed to ensure compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) — India's first comprehensive data protection law for the digital age, which mandates explicit consent for data processing and requires that such processing be carried out in a way that prevents harm to individuals. By using the Platform, corporate clients and their provisioned employees acknowledge the data practices described in this document.

2. Legal Framework and Definitions

To align with Indian regulatory standards, this document uses terminology as defined under the DPDPA, 2023:

• Data Principal: The individual (employee) whose personal data is being processed.
• Data Fiduciary / Data Controller: The registered corporate entity (the Employer) that determines the purpose and means of data collection.
• Data Processor: Airwix Technologies, which handles data strictly on behalf of the Data Fiduciary.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

3. Information We Collect

Airwix Technologies collects data solely to facilitate enterprise workforce management. The data collected includes:

A. Information Provided by the User or Employer

• Identity and Contact Data: Full legal name, corporate email address, mobile number, and employee identification number.
• Financial and Compliance Data: Banking details, Permanent Account Number (PAN), Provident Fund (PF) configurations, GST compliance details, and tax-related declarations required for payroll processing.
• Employment Records: Department, job title, shift templates, and leave applications.

B. Information Collected via Automated Means (Device Permissions)

Under Section 7(i) of the DPDPA, employers are legally permitted to process personal data for employment-related purposes, provided the monitoring is directly connected to a legitimate business function such as attendance tracking. Airwix enforces this through:

• Camera Access for Biometric Verification: The application requires camera access exclusively for the "Selfie Attendance" feature. A photograph is captured during punch-in and punch-out to verify physical identity and prevent timecard fraud.
• Geolocation Data for Geo-Fencing: Location data is captured only at the exact moment an employee records an attendance punch, to confirm the employee is within authorised corporate boundaries. In compliance with DPDPA restrictions on excessive tracking, continuous background location monitoring is permanently disabled on this Platform.
• Device Identifiers: Hardware models, operating system versions, and unique device identifiers (such as IMEI or MAC address) are logged to validate authorised access and prevent spoofing.

4. Purpose and Lawful Basis of Processing

In compliance with the DPDPA principles of purpose limitation and data minimisation, data is collected only for specific, lawful purposes and is limited strictly to what is necessary. The collected information is used to:

• Verify workforce attendance and authenticate identity using geo-fencing and facial recognition.
• Calculate statutory payroll deductions, process salary payments, and generate official PDF payslips.
• Manage leave ledgers and route applications to designated organisational managers.
• Maintain audit logs and security protocols to detect data breaches or misuse of confidential systems.

5. Rights of the Data Principal (Employees)

Under Chapter 3 of the DPDPA, 2023, employees (Data Principals) hold specific rights regarding their personal data. Through their respective employers (Data Fiduciaries), employees may exercise the following:

• Right to Access (Section 11): The right to request information about the personal data being processed and to obtain a summary of that data.
• Right to Correction and Erasure (Section 12): The right to request correction of inaccurate data or deletion of personal data that is no longer required for its original purpose.
• Right of Grievance Redressal (Section 13): The right to file complaints regarding data processing practices through a readily accessible mechanism.
• Right to Withdraw Consent: Employees may withdraw consent to data processing at any time, although doing so may affect their ability to use the corporate HRMS Platform.

6. Data Sharing and Disclosure

Airwix Technologies does not sell, rent, or lease personal data to external marketing or advertising agencies. Data is disclosed only in the following circumstances:

• To the Employer (Data Fiduciary): All attendance, leave, and payroll data is fully accessible to the authorised HR administrators of the organisation that provisioned the employee account.
• To Third-Party Processors: Secure API connections may be used to integrate with authorised cloud infrastructure providers or specialised tax calculation engines, all of which are bound by strict confidentiality agreements.
• For Legal Compliance: Data may be disclosed when required by court orders, government investigations, or to protect against legal liability.

7. Data Security and Retention

Security Measures

We implement industry-standard encryption, stateless authentication protocols, and secure cryptographic hashing to protect data against unauthorised access.

Retention Policy

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Indian labour and tax laws. Upon termination of an enterprise contract, data is securely archived, anonymised, or deleted in accordance with strict deletion protocols.

8. Cookies and Tracking Technologies

The Airwix web portals use functional cookies to maintain session integrity and optimise loading performance. We do not use third-party marketing cookies for cross-site profiling. Users may control cookie preferences through their browser settings, though disabling essential cookies may impact web portal functionality.

9. Modifications to This Policy

This Privacy Policy is reviewed regularly to ensure continued compliance with changes in Indian law and company operations. Any modifications will take effect immediately upon publication on the Platform. Users and corporate clients will be notified of any significant changes.

10. Grievance Redressal and Contact Information

In accordance with DPDPA requirements, employees should direct initial data access or erasure requests to their internal corporate HR Administrator.

For technical platform inquiries, privacy concerns, or the escalation of unresolved data grievances, please contact the Airwix Technologies Data Protection Officer (DPO):

• Email: support@airwix.in
• Phone: +91 8200172869
• Website: airwix.in