Privacy Policy & DPDP Act 2023 Disclosures

Statutory Legal Disclosures Digital Personal Data Protection Act, 2023

Privacy Notice & Statutory DPDP Act Charter

Published by Waves Technologies (www.wavestech.co.in) • Effective Date: September 29, 2026 • Version 2.1

1. Preamble & Applicability

This Privacy Notice is issued by Waves Technologies (“Waves”, “Company”, “Data Fiduciary”, “we”, or “us”) pursuant to Section 5 and Section 6 of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This policy governs the processing of digital personal data of employees, field sales executives, retail store staff, and authorized promoters (“Data Principal” or “you”) through the Waves Attendance mobile application (Package ID: com.wavesattendance.app) and cloud portal. The App is strictly an enterprise workforce management tool allotted for official attendance recording, work shift auditing, and statutory wage calculation.

2. Itemized Statutory Notice (Section 5(1) DPDP Act 2023)

We collect and process only the minimal personal data necessary to achieve the specified purposes of employment management and physical shift verification:

A. Live Verification Selfie

On-Punch Only

Front-camera photograph captured live at the instantaneous moment of punch-in and field counter check-in to verify the physical presence of the designated employee and prevent proxy attendance (“buddy punching”).

✓ No Gallery Access • No continuous video feed

B. Precise Geolocation Data

On-Punch Only

Latitude, longitude, and accuracy coordinates fetched solely at the moment of submitting an entry, counter audit, or exit punch to confirm compliance with assigned store geofences or territory counter locations.

✓ No 24/7 Background Tracking • Anti-mock active

C. Staff Account & Shift Data

Employment Record

Employee Full Name, Registered Mobile Number (User ID), Employee Code, Brand Division, Assigned Branch, Shift Hours, Check-in / Exit Timestamps, and Leave History allotted by Waves HR.

Basis: Section 7(i) DPDP Act (Employment & Benefits Settlement)

D. Diagnostic & Synchronization Data

App Health

Device model, operating system version, network state (for offline punch buffering and auto-sync), and security integrity signals to block synthetic mock location attacks.

Basis: Section 8(4) & 8(5) DPDP Act (Reasonable Security Safeguards)

3. Prominent In-App Disclosures (Google Play & Statutory)

Runtime Camera Permission Disclosure

“Waves Attendance requires access to your device's Camera solely to capture a live selfie during attendance punch-in and field store check-in. The camera is triggered ONLY when you tap the viewfinder. We do NOT record video continuously or access your personal photo gallery. Photos are encrypted and transmitted to Waves HR solely for anti-proxy attendance verification.”

Runtime Precise Location Disclosure

“Waves Attendance requires Precise Location (GPS Coordinates) solely to calculate your proximity to your assigned store geofence during punch-in/exit. Coordinates are queried ONLY at the instantaneous moment of punching. There is NO continuous background location tracking while off-duty. Coordinates are encrypted and processed strictly for shift verification and wage processing.”

WhatsApp External Share Disclosure

“When you choose to share your attendance report card to WhatsApp, the app creates a consolidated summary image featuring your verified photo(s), punch times, and exit time. This image is transferred via Android's secure FileProvider intent directly to your personal WhatsApp app. Waves Technologies does NOT share your attendance data with any third-party marketing networks.”

4. Lawful Bases for Data Processing

We process digital personal data strictly under statutory lawful grounds recognized under the DPDP Act 2023:

Consent (Section 6): Employees grant free, specific, informed, unconditional, and unambiguous consent during registration and runtime permission dialogs.
Legitimate Use for Employment (Section 7(i)): Under Section 7(i) of the DPDP Act 2023, personal data may be processed “for the purposes of employment or those related to safeguarding the employer from loss or liability... or provision of any service or benefit to the Data Principal.” Personal data is collected strictly to record work shifts, prevent fraudulent proxy attendance, safeguard organization assets, and calculate payroll.

5. Data Principal Rights Charter (Sections 11 - 14)

Under Chapter III of the DPDP Act 2023, you enjoy enforceable statutory rights as a Data Principal:

1. Right to Access (Section 11)

You may request a summary of your personal data processed by Waves Technologies and the identity of any authorized processors handling your records.

2. Right to Correction (Section 12(1))

You have the right to request correction of inaccurate data, completion of incomplete records, or updating of your contact and profile information.

3. Right to Erasure (Section 12(2))

You may request deletion of personal data when employment concludes and statutory wage and labor retention periods have expired.

4. Right to Nominate (Section 14)

You have the right to nominate an individual who shall, in the event of your death or incapacity, exercise your Data Principal rights under the Act.

6. Retention Schedule & Security Safeguards (Section 8)

Retention Duration: Attendance logs and shift records are retained during employment plus 3 years following separation to comply with statutory audits under the Payment of Wages Act and Minimum Wages Act. Verification selfie images are retained for 90 days for rolling audit and proxy dispute resolution, then archived or purged.

Security Safeguards: End-to-end TLS 1.3 encrypted transit, access control partitioned by store branch, prohibition of arbitrary file injection, and anti-tamper location heuristics.

Data Breach Protocol (Section 8(6)): In the unforeseen event of a personal data breach, Waves Technologies will notify the Data Protection Board of India (DPBI) and affected employees without delay.

7. Prohibition of Processing Children's Data (Section 9)

In strict compliance with Section 9 of the DPDP Act 2023, Waves Technologies does not knowingly collect, process, or track the personal data of any child under 18 years of age. All accounts are allotted strictly to adult workforce members who have reached the age of majority.

8. Grievance Redressal Officer & Statutory Escalation

Pursuant to Section 8(9) and Section 13 of the DPDP Act 2023, for any questions, requests to exercise your statutory rights, or data protection grievances, please contact our designated Grievance Officer:

Designation: Data Protection Officer & Grievance Officer

Organization: Waves Technologies

Registered Address:
Waves Technologies
Metro Pillar No 800, Mavelil Arcade, Building No 56/3289,
Ground Floor, Sahodaran Ayyappan Rd,
near Little Flower, Kadavanthra,
Kochi, Kerala 682020

Grievance Email: [email protected]

General Enquiries: [email protected]

Official Website: https://www.wavestech.co.in/

SLA: Grievance acknowledgment within 48 hours; final resolution within 30 calendar days.

Statutory Escalation to Data Protection Board of India (DPBI)

If your grievance is not resolved by Waves Technologies within 30 days, or if you are dissatisfied with our response, you have the statutory right under Section 13(3) of the DPDP Act 2023 to register a complaint with the Data Protection Board of India at: https://dpbi.gov.in