1. Biometric and Face Data

Attenzo uses biometric technology to verify employee identity and prevent proxy attendance. We want to be completely transparent about how this data is handled:

• **No Raw Photos**: We do not store raw photos or images of your face on our servers.
• **Encrypted Descriptors**: During registration, we extract a mathematical representation of your face (a face descriptor). These descriptors are encrypted and stored securely on our servers to enable verification.
• **On-Device Processing**: Verification is performed securely, comparing the live scan with the stored descriptor.
• **Liveness Detection**: We use blink detection to ensure the scan is of a live person and not a photo.

2. Data We Collect

In addition to biometric descriptors, we collect and process the following information strictly for workforce management purposes:

• **Personal Information**: Name, work email address, and employee ID.
• **Attendance Data**: Shift schedules, check-in and check-out timestamps, and total hours worked.
• **Location Data**: GPS coordinates at the time of check-in/out to verify you are within the authorized geofence.
• **Device Information**: IP address and browser type for security and debugging purposes.

3. How We Use Your Data

We use the collected data exclusively to:

• Verify your identity during shift check-ins.
• Calculate work hours and generate payroll reports for your employer.
• Enforce geofencing rules set by your organization.
• Maintain an audit log of attendance for compliance and transparency.

4. Data Retention and Deletion

We retain your data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. When an employee is removed from the system or an organization terminates its subscription, all associated biometric descriptors and personal data are permanently deleted from our active databases.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal or biometric data to third parties. Data is only shared with:

• Your employer organization and authorized administrators.
• Third-party integrations (like payroll systems) that your organization explicitly connects.
• Cloud infrastructure providers (like our database hosts) who process data strictly on our behalf under confidentiality agreements.

6. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, or request the deletion of your information. To exercise these rights, please contact your organization's administrator or reach out to us at support@attenzo.com.