Privacy Policy — Trackbook HRMS

Operated by: Newish Technology, a sister concern of Bisani Brothers Pvt. Ltd.

Effective and last updated: 13 August 2026

Introduction

This policy explains how Newish Technology (“we”, “us”) handles information through Trackbook HRMS on the web and mobile app. Employers and their authorized administrators generally decide which workforce features are enabled and provide or manage employee records.

For most employee records, the employer acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) because it determines why and how those records are processed. Newish Technology generally acts as a Data Processor, operating Trackbook HRMS on the employer’s instructions and subject to the applicable service and data-processing arrangements. Where Newish Technology independently determines a limited processing purpose, such as platform security, fraud prevention, support, or service reliability, it may act as Data Fiduciary for that processing.

Newish Technology’s role — no involvement in payments

Newish Technology is a software service provider and a sister concern of Bisani Brothers Pvt. Ltd. Its Trackbook HRMS role is limited to providing and operating the platform on the employer’s instructions. Newish Technology does not process, hold, disburse, or transfer employee salary or other funds. Payroll figures, payslips, tax declarations, reimbursements, advances, loans, and related records visible in Trackbook are maintained for the employer’s HR record-keeping and reporting. Actual approval, payment, banking, statutory filing, and disbursement remain the employer’s responsibility through channels outside Trackbook HRMS.

Information we process

• Account and HR records: name, username, email, phone, employee code, date of birth, joining and employment details, company, office, department, team, reporting line, role, profile photo, leave, and requests.
• Attendance and biometric-related data: clock-in/out events, shifts, regularization records, attendance selfies, face-reference photos, face-match scores, and a mathematical 128-dimension face template used for verification. Face templates and reference images are sensitive biometric-related data.
• Camera and media: camera access for face registration, attendance proof, profile or chat images, and video when a user joins an enabled meeting, subject to device or browser permissions.
• Location: precise GPS for geofence attendance and, for assigned field staff when enabled by their employer, background or live location pings, including coordinates, accuracy, timestamps, routes, and assigned office or customer locations. The mobile app presents a disclosure before requesting background-location permission.
• Device and security: Android ID or a comparable device identifier for permitted-device binding, mismatch attempts, IP-derived security records, user agent, authentication events, and audit logs.
• KYC and payroll records: PAN, Aadhaar and other employer-requested identity or compliance information and documents; bank information or documents; salary, payslips, tax declarations, reimbursements, advances, and loans.
• Work and customer activity: tasks, daily reports, targets, notes, CRM leads, customers, visits, and related contact or business information.
• Communications: direct or group chats, shared images, calls, meeting details, participant activity, recordings or artifacts when used, transcripts, and transcript summaries.
• Company onboarding: company identity, contacts, addresses, subscription information, and business or legal documents.

Aadhaar handling

Where an employer requires Aadhaar information for KYC, Trackbook HRMS may process the Aadhaar number and an employer-requested supporting document. Aadhaar values are masked in designated user-facing displays, while access to the underlying compliance record and document is restricted through authenticated, role-based, tenant-scoped controls. Employers must collect and use Aadhaar information only where legally permitted, provide any required notice, and avoid requesting more information than necessary. Trackbook does not represent itself as a UIDAI authentication agency or offline-verification service unless a separately authorized integration is enabled.

Why we use information

We process information to provide authentication and tenant access; operate HR, attendance, location, payroll-record, task, CRM, and collaboration features; verify attendance and authorized devices; generate workplace records and reports; provide support; secure, troubleshoot, and audit the service; follow employer instructions and applicable legal obligations; and improve service reliability. Trackbook HRMS does not serve third-party advertising and the mobile app does not include third-party advertising or behavioral analytics SDKs.

Consent and notice

Trackbook provides in-app disclosures before mobile face registration and enabled background-location processing. Depending on the data, purpose, employment context, and applicable law, processing may be based on consent, an employment-related legitimate use recognized by law, or another lawful ground managed by the employer. Employees may contact their employer administrator or support@trackbook.co to ask about a feature, withdraw consent where consent is the applicable basis, or request an alternative process. Disabling camera or location permissions may prevent the corresponding attendance or field workflow from operating in the app.

Sharing and processors

Information is visible to authorized users within the relevant employer tenant according to roles and permissions. Depending on enabled features and deployment configuration, we may use service providers such as AWS infrastructure or object storage, OpenStreetMap map data, OSRM routing, OpenAI for enabled transcript summaries, and CRM Pro integration. These providers receive only the information reasonably needed for the requested operation. We may disclose information to authorities, professional advisers, or other parties where legally required or reasonably necessary to protect users, employers, rights, or the service. We do not sell personal information.

AI-assisted transcript summaries

When an authorized user or employer invokes meeting transcript summarization and the OpenAI integration is configured, relevant transcript text is sent to the OpenAI API to generate a summary. Trackbook does not send the meeting’s audio or video file to OpenAI through this summarization flow. If the integration is not configured or fails, Trackbook may generate a limited local extract instead. Provider handling is governed by the configured service terms and data-processing arrangements. Employers can control whether the feature is made available.

Data storage, security, and cross-border processing

Trackbook HRMS production traffic uses HTTPS. Security measures include authentication, role-based authorization, tenant scoping, protected media routes, access controls, and operational logging. Hosting and object-storage location, encryption-at-rest controls, backup lifecycle, and subprocessors depend on the production configuration selected for the service. No internet service can guarantee absolute security; users and employers should protect credentials and devices.

Some enabled processors may operate infrastructure in more than one country or region. When a feature transfers data to a processor outside the primary hosting location, we seek to limit the transfer to data needed for that feature and use applicable contractual, confidentiality, security, and deletion terms. Processing remains subject to applicable Indian law and any valid government restriction on transfers.

Retention

Trackbook’s standard attendance-image retention job targets images older than 60 days; actual deletion timing depends on production scheduling, backup lifecycle, employer settings, and applicable exceptions. An active investigation, dispute, payroll or attendance recordkeeping duty, or legal requirement may justify longer retention.

Other HR, payroll, KYC, communications, audit, and customer records are retained while needed to provide the employer’s service and meet applicable employment, tax, accounting, security, contractual, or legal obligations. A deletion request may result in deletion, anonymization, restriction, or continued retention where an exception applies.

Personal data breach notification

If we become aware of a personal data breach affecting information processed through Trackbook HRMS, we will investigate, contain, and assess the incident and notify the affected employer without undue delay where required, so the employer can address its obligations as Data Fiduciary. Where Newish Technology acts as Data Fiduciary for the affected processing, it will address applicable notification duties to affected individuals and the competent authority under law.

Significant Data Fiduciary considerations

If Newish Technology or an employer tenant is formally classified as a Significant Data Fiduciary under Section 10 of the DPDP Act, the classified entity will be responsible for the additional obligations that apply to it, which may include appointing an India-based Data Protection Officer, engaging an independent data auditor, and conducting periodic Data Protection Impact Assessments and audits. Classification depends on government notification and the circumstances of the relevant processing.

Applicable law and legal basis

This policy is intended to be administered consistently with applicable Indian privacy and information-technology law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023, and rules and provisions in force from time to time.

Most workforce information is processed on the employer’s instructions. Depending on the particular activity, the employer may rely on consent, an employment-related legitimate use recognized under Section 7 of the DPDP Act, or another lawful basis. Employers should determine and document the correct basis for each enabled workflow and provide employees with the required notice.

Notice content and language

Where consent is relied upon, the employer and Trackbook workflow should provide a clear notice describing the personal data, purpose, rights, withdrawal or grievance route, and relevant contact details. The platform’s standard legal materials are available in English. Employers should arrange an intelligible translation or assisted explanation where needed for their workforce and applicable legal requirements.

Workforce and children

Trackbook HRMS is a workplace service intended for organizations and their authorized workforce, not a consumer service directed to children. Employers must ensure they have an appropriate basis before adding a minor or enabling sensitive attendance, biometric, KYC, or location processing. If you believe a child’s information was submitted improperly, contact us. We will review the report with the employer, restrict processing where appropriate during review, and delete, anonymize, or retain the record according to the verified circumstances and applicable law.

Data Principal rights and requests

Subject to applicable law and the employer’s responsibilities, employees may request access to a summary of processing, correction, completion, updating, erasure, grievance redressal, or withdrawal of previously given consent. They may also exercise a nomination right where provided by law. Requests may be sent to the employer administrator or support@trackbook.co. We will acknowledge and coordinate requests within a reasonable period and meet any legally prescribed response period that applies.

Many device permissions can be managed through Android settings, but disabling camera or location may prevent related workflows. Employees may also submit an account and data deletion request. We may verify identity and consult the relevant employer before acting.

Contact and changes

Privacy, support, and grievance contact: support@trackbook.co.

Grievance Officer: Privacy Grievance Officer, Newish Technology (a sister concern of Bisani Brothers Pvt. Ltd.), reachable through the email above. The officer’s individual name will be added when formally designated.

Service website: https://hrms.trackbook.co.

We may update this policy as features, providers, deployment arrangements, or legal requirements change. Material revisions will be published with an updated effective date.

Trackbook HRMS is operated by Newish Technology, a sister concern of Bisani Brothers Pvt. Ltd.