Privacy Policy

1. Introduction

WMS360 is a workforce management app for teams of every kind: field operatives, warehouse staff, office employees, and any organisation that needs reliable attendance and leave tracking. Employees use it to mark attendance, apply for leave and stay updated from their phone.

This Privacy Policy explains what personal data is processed when you use the WMS360 mobile app and its related services ("WMS360"), why it is processed, who it is shared with, and the choices and rights available to you.

This Policy is intended to operate consistently with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025, and other applicable laws of India.

2. Who Is Responsible for Your Data

2.1 Your organisation

The organisation that employs or engages you, and that registered your mobile number on WMS360 ("your organisation"), is the Data Fiduciary for your personal data. Your organisation decides why your data is processed. For example, it decides whether attendance needs location or face verification, which work areas apply to you, and how leave is approved.

2.2 Epta Technologies LLP

Epta Technologies LLP ("Epta", "we", "us" or "our") develops and operates WMS360. We act as a Data Processor: we process personal data on behalf of your organisation and in line with its instructions and our contract with it. We do not use your data for our own purposes.

Questions about how your organisation uses your data, such as its attendance or leave rules, are best directed to your organisation first. We will support your organisation in responding.

3. Who the App Is For

WMS360 is for employees of organisations that use WMS360, whether they work in the field, in warehouses, in offices or anywhere else that attendance needs to be tracked.

There is no public sign-up. You can sign in only if your organisation has registered your mobile number. If you cannot sign in, contact your organisation's administrator to confirm that your mobile number is registered.

4. Information We Process

Depending on the features your organisation enables, WMS360 may process the following.

4.1 Profile and employment information

This is provided by your organisation when it registers you:

• name and employee ID;
• registered mobile number;
• department and designation;
• placement: your assigned site, warehouse or office;
• reporting manager;
• profile photograph, where used.

4.2 Sign-in information

• your registered mobile number;
• one-time passwords (OTPs) sent to that number to verify sign-in;
• session and sign-in history.

WMS360 does not use passwords.

4.3 Attendance information

• check-in and check-out date and time;
• attendance status and verification results;
• the work area the attendance was checked against.

4.4 Location information

Your device's location is collected at the moment you check in or check out. See section 7.

4.5 Face verification information

Where your organisation requires face verification, WMS360 processes face images that you capture for registration and at attendance, along with the verification results. See section 8.

4.6 Leave information

• leave applications, including leave type, dates and reason;
• leave status and approval or rejection decisions;
• leave balances maintained by your organisation.

4.7 Device and technical information

• device model, operating system and app version;
• a device identifier, used to link your account to your registered device;
• a push notification token, used to deliver notifications;
• network status and diagnostic information needed to troubleshoot problems;
• security events such as failed sign-in attempts.

5. How We Use Information

Personal data is used only to provide WMS360 to you and your organisation, including to:

• verify your identity and sign you in;
• record your check-in and check-out;
• confirm that you are at your assigned work area, where your organisation requires it;
• confirm that it is you marking your own attendance, where face verification is required;
• submit, route and track your leave requests;
• show you your profile, placement and reporting manager;
• send you notifications, updates and announcements from your organisation;
• protect accounts and prevent misuse, such as spoofed locations or one person marking attendance for another;
• provide support, fix problems and keep the app working;
• meet legal obligations.

WMS360 does not show advertising, and personal data is never sold or used for marketing.

6. App Permissions

The app asks for the following permissions on your device:

Location

Used to verify that your attendance is marked within your assigned work area.

Camera

Used to capture your face for verification and, if you choose, your profile photograph.

Notifications

Used to send you updates and announcements.

You can grant or withdraw these permissions at any time in your device settings. If you withdraw a permission that your organisation requires, such as location or camera for attendance, the related feature will not work until the permission is granted again.

7. Location-Based Attendance

Where your organisation sets up work areas, WMS360 checks your location against your assigned site, warehouse or office when you check in or check out.

• Your location is read once, at the moment you check in or check out.
• The app does not track your location continuously, and does not collect location in the background or when you are not marking attendance.
• The location, its time and the result of the work-area check are stored with your attendance record.

If location services are switched off, or your location cannot be determined, attendance that requires location may not be recorded.

8. Face Verification

Where your organisation requires it, a quick face check confirms that it is you marking your own attendance.

• Registration. You capture photos of your face in the app. These are used to create a reference for your account, which your organisation may review and approve.
• Liveness check. When you mark attendance, the app checks on your device that a real, live person is in front of the camera. This step uses Google ML Kit, which runs entirely on the device.
• Verification. A photo is then sent securely to WMS360's servers and compared with your registered reference. The match result is recorded with your attendance.

Face data is used only to verify your identity for attendance. It is never used for any other purpose and never shared for advertising. It is stored securely and is accessible only to authorised systems and personnel, to the extent needed for verification and approval.

9. Sharing and Disclosure

Personal data may be shared only with:

• your organisation — its authorised administrators, HR staff and managers, according to their roles;
• authorised Epta personnel — only as needed to operate, support and secure WMS360;
• service providers that help us run WMS360, such as cloud hosting and push notification services, under appropriate confidentiality and security obligations;
• authorities — government bodies, regulators, courts or law-enforcement agencies, where required by law.

We do not sell personal data, and we do not share it with anyone for advertising.

10. Third-Party Services

Firebase Cloud Messaging

Provided by Google and used to deliver push notifications. It processes your device's notification token and the notification being delivered. See Firebase's privacy information.

Google ML Kit

Used for on-device face detection and liveness checks. The camera images it analyses are processed on your device. See Google's Privacy Policy.

Your device's operating system and app store also process information under their own terms and privacy policies.

11. Storage and Security

WMS360 data is stored on secure cloud servers. We use appropriate technical and organisational measures to protect personal data against unauthorised access, misuse, alteration, loss or disclosure, including:

• encryption of data in transit between the app and our servers;
• secure, encrypted storage of sign-in sessions on your device;
• OTP-based sign-in linked to your registered device;
• role-based access, so people see only what their role requires;
• audit logging of administrative actions;
• monitoring for suspicious sign-in and attendance activity.

No method of transmission or storage is completely secure, but we keep safeguards proportionate to the sensitivity of the data.

12. Data Retention

Personal data is kept for as long as your account is active and as required by your organisation's retention policy and applicable law. Employment records such as attendance and leave may need to be kept for a period after you leave your organisation.

When data is no longer needed, it is deleted or anonymised. Copies in backups are removed as those backups expire.

13. Your Rights

Subject to applicable law, you have the right to:

• obtain information about the personal data processed about you;
• request correction or completion of inaccurate or incomplete data;
• request erasure of data that is no longer needed;
• raise a grievance about how your data is handled;
• nominate another person to exercise your rights in the event of death or incapacity.

Because your organisation is the Data Fiduciary, please send requests to your organisation's administrator in the first instance. You can also write to us at the address in section 18, and we will pass your request to your organisation and help it respond.

Where your organisation is required or permitted by law to keep certain employment records, some data may be retained even after a request for erasure.

14. Account and Data Deletion

Your WMS360 account is created and managed by your organisation. To delete your account and its associated data:

• ask your organisation's administrator; or
• email contacts@eptatechnologies.com from or quoting your registered mobile number, with the subject "Account deletion".

We will verify the request and coordinate the deletion with your organisation. Data your organisation must keep by law, such as attendance records, is retained only for the required period and then deleted.

15. Children

WMS360 is a workplace app for employees and is not intended for anyone under 18 years of age. We do not knowingly process personal data of children through WMS360.

16. Changes to This Policy

We may update this Privacy Policy when WMS360's features, our processing activities or applicable laws change. The updated version will show a new "Last updated" date. Significant changes will be communicated through the app or by your organisation.

17. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. Subject to applicable law and statutory dispute-resolution mechanisms, the courts at Bhiwandi, Maharashtra shall have jurisdiction over matters relating to this Policy.

18. Contact and Grievances

For questions, requests or grievances about personal data in WMS360, contact your organisation's administrator or reach us directly. We will acknowledge your grievance and respond within the time required by applicable law.