DONEHAI PRIVACY POLICY
Effective and last updated: 18-Sep-2026 | Version 2.0
Privacy contact: grievance@donehai.com

This Policy explains how DoneHai Technologies Private Limited ("DoneHai", "we", "us", "our") processes digital Personal Data through its workforce-management websites, applications, APIs and services (the "Platform") and the rights available to individuals.

1. SCOPE AND ROLES
"Organisation" means a customer subscribing to DoneHai. "User" means an authorised employee, contractor, administrator or other individual. "Personal Data" means data about an identifiable individual.

For attendance, location, tasks, claims, leave, documents and other workforce data processed under an Organisation's instructions, the Organisation ordinarily determines why and how data is used and acts as Data Fiduciary. DoneHai acts as Data Processor under the Organisation's lawful instructions and the applicable data processing agreement.

DoneHai acts as Data Fiduciary where it determines the purpose and means, including customer account administration, contracting and billing, platform security, fraud prevention, service communications, support, legal compliance and limited service analytics.

If you use DoneHai through an Organisation, contact it first about workforce records. DoneHai will support verified requests. This does not remove rights exercisable directly against DoneHai where DoneHai is the Data Fiduciary.

2. DATA AND PURPOSES
We may process identity and profile data such as name, work contact details, employee ID, role, department, manager and profile image to create accounts and provide workforce workflows.

Authentication and security data may include login events, OTP records, device identifiers, IP address, sessions and device-integrity signals to authenticate, prevent fraud, secure accounts and investigate incidents.

Attendance and activity data may include check-in/out, shifts, tasks, forms, remarks, approvals, leave, travel and expense information to operate Organisation-configured workflows.

Location data, when enabled, may include GPS or network coordinates, accuracy, timestamps, routes, visits and geo-validation events for attendance or field workflows.

Camera and verification data, when enabled, may include selfies, photographs, scanned evidence and verification result metadata for identity, attendance, evidence and fraud-prevention purposes.

We may also process uploaded content, messages, support requests, Organisation plan and invoice data, app or OS information, usage events, crash reports and performance diagnostics to provide, bill, secure, support and improve the Platform.

The exact data depends on Organisation configuration, features used, device permissions and information provided.

3. SOURCES
We receive Personal Data from Users; their Organisation and authorised administrators; devices and browsers; Platform use; Organisation-enabled integrations; support interactions; and providers supporting authentication, messaging, payments, maps, hosting, security and analytics.

4. GROUNDS FOR PROCESSING
Where DoneHai is Data Fiduciary, processing for a lawful purpose is based on free, specific, informed, unconditional and unambiguous consent, or a "certain legitimate use" specifically permitted by applicable law. Where DoneHai is Data Processor, the Organisation is responsible for the lawful purpose, required notice and applicable ground. Device permission does not replace consent or notice required by law. Acceptance of general Terms is not consent for an unrelated new purpose; where fresh consent is required, we will request it separately.

5. LOCATION, CAMERA AND BIOMETRIC CONTROLS
Location and camera access operate only when the relevant feature is enabled and the device grants permission. Changing permission may stop the feature. Native fingerprint or face authentication is performed by the operating system; DoneHai does not receive the device biometric template. Selfie or verification evidence captured in an Organisation-enabled workflow is separate and may be transmitted to the Platform. The Organisation must ensure use of employee location, photographs and verification is necessary, proportionate, transparent and lawful.

6. AI-ASSISTED PROCESSING
Some features may send a User prompt and relevant Organisation-authorised context to an AI provider to generate a response. Do not include unnecessary Personal Data. AI output may be inaccurate and requires human review before any consequential decision.

7. SHARING
We may disclose Personal Data to authorised Organisation administrators, managers and Users according to roles; vetted providers for hosting, storage, maps, communications, authentication, payments, monitoring, support, analytics and AI; integrations directed by the Organisation; professional advisers and auditors under confidentiality; competent authorities where legally required; and transaction parties in a merger, financing, restructuring or sale subject to safeguards. DoneHai does not sell Personal Data or use workforce data for third-party targeted advertising.

8. INTERNATIONAL PROCESSING
Providers may process data in India or elsewhere. We and the Organisation will comply with restrictions or conditions imposed by the Central Government or other applicable law and use appropriate contractual and technical safeguards.

9. SECURITY AND BREACHES
We use reasonable safeguards designed for the nature and risk of processing, including access controls, authentication, encryption or equivalent protection where appropriate, logging and monitoring, vulnerability management, backups, incident handling and processor contracts. No system is completely secure. If a Personal Data breach occurs, we will investigate, mitigate and provide notifications legally required to the responsible Organisation, affected individuals and authorities, as applicable.

10. RETENTION AND DELETION
We retain Personal Data only as reasonably necessary for its purpose, Organisation instructions, security and audits, disputes and law. During a subscription, the Organisation controls many workforce records and retention settings. After termination, Organisation data is ordinarily available for authorised export for up to 60 days and then scheduled for deletion or de-identification unless otherwise agreed or legally required. Security, processing and traffic logs may be retained for at least the legally required period. Backups are isolated from ordinary use and expire through controlled cycles unless subject to legal hold or investigation. Where deletion applies, relevant processors will also be instructed as required.

11. RIGHTS AND CHOICES
Subject to applicable law and verification, you may request a summary of Personal Data and processing; required sharing information; correction, completion or updating; erasure where retention is unnecessary; withdrawal of consent with ease comparable to giving it; grievance redressal; and nomination of another person to exercise rights after death or incapacity. Withdrawal does not affect earlier lawful processing and may make a necessary feature unavailable.

12. MAKING A REQUEST
Email grievance@donehai.com from your registered address or provide your registered mobile number, Organisation name, requested right and enough detail to identify records. Do not send passwords, OTPs or unnecessary identity documents. We may verify identity and authority. Where the Organisation is Data Fiduciary, we may securely route the request to it and assist. We will acknowledge the request and aim to resolve a grievance as soon as reasonably practicable and no later than 90 days, or earlier if law requires.

13. GRIEVANCES
Contact the Privacy and Grievance Contact at grievance@donehai.com and include the request reference when following up. After exhausting this grievance process, an individual may complain to the Data Protection Board of India using the Board's available mechanism.

14. CHILDREN
The Platform is intended for workplace use by adults and is not knowingly offered directly to children. Before onboarding anyone under 18, the Organisation must notify DoneHai and establish legally valid, verifiable parental or guardian consent and required safeguards. Tracking, behavioural monitoring or targeted advertising must not be used for children except where a lawful exemption applies.

15. COOKIES AND SIMILAR TECHNOLOGIES
The Platform may use cookies, local storage, SDKs and similar technologies for authentication, preferences, security, diagnostics and performance. Where law requires, optional analytics will be subject to appropriate choice. Disabling essential storage may prevent login or other functions.

16. ACCURACY AND RESPONSIBILITIES
Users should provide authentic information, keep account details current, avoid impersonation, and not submit false or frivolous requests. An Organisation should take reasonable steps to keep data used for decisions complete, accurate and consistent.

17. CHANGES
We may update this Policy for legal, security or service changes. We will publish the version and effective date and give appropriate notice of material changes. If a new purpose requires consent, we will request fresh consent rather than treating continued use alone as consent.

18. CONTACT
DoneHai Technologies Private Limited
Privacy and grievance email: grievance@donehai.com
This contact is authorised to answer questions concerning DoneHai's Personal Data processing. Organisation-specific HR or workforce-record questions may also be directed to the Organisation administrator.