1 Introduction
This Privacy Policy applies to the DEC Mobile app (for site engineers) and the DEC Operators app (for operators, security, mess and site staff) on iOS and Android (together, the "Apps").
These Apps are internal work tools provided by DEC Infrastructure and Projects (India) Private Limited ("DEC", "Company", "we", "us"), Dabla Sadan, 2-1-434/1, Street No. 4, Nallakunta, Hyderabad – 500 044, Telangana, India, to its employees and to the staff of its contractors working on DEC sites.
The Apps are developed, implemented, managed, published and run for DEC by Nutrinium Technologies Private Limited ("Nutrinium"). They support construction site operations such as attendance, gate and mess entry, reporting, leave, travel, claims, and internal requests and approvals.
This Privacy Policy explains how information is collected, used, shared, and protected when you use the Apps. If you do not agree with this Privacy Policy, do not use the Apps.
The Apps do not contain advertising, do not sell data, and do not use analytics or tracking SDKs.
2 Who Controls Your Data (Data Controller)
For employment and worksite operations data, DEC is the Data Controller — the entity that determines the purposes and means of processing. Nutrinium acts as Data Processor and processes personal data only on DEC's documented instructions.
3 Information We Collect
We collect information to provide, secure, and operate the Apps. The table below summarises the main categories; further detail on face data is in Section 4.
| Data |
When |
Why |
| Account details: employee number, name, work email / username, mobile number, role, project and site |
When HR sets up your account; when you sign in |
To sign you in and show the work and approvals that belong to you |
| A sign-in PIN (stored only as a one-way hash) and a device ID |
When you set a PIN; when you sign in |
Security; one device per account |
| Location (GPS), only while the app is open |
When you check in / out, and on reports that need a site location |
To confirm attendance is marked at the site and to tag reports with where they were made. The Apps do not track location in the background. |
| Face data — see Section 4 |
Face registration, attendance face check, gate / mess face scan, labour attendance |
Identity checks at attendance, the gate and the mess |
| Photos, videos and voice notes you take or attach |
When you add them to a report, request, claim or pass |
Evidence for the work record (progress, safety, deliveries, bills, gate passes) |
| Work records: reports, requests, approvals, attendance, leave, travel, claims, gate and meal entries |
When you use those screens |
To run the site and HR processes they belong to |
3.1 Account & Authentication Information
- Employee ID / employee number, name, designation/role, department, assigned project(s) and site(s)
- Organization-issued username and/or work email
- Contact details (work email and/or mobile number) as configured by DEC / HR
- Authentication credentials (password/PIN) stored using one-way hashing — never stored in plain text
- Device ID used to enforce one device per account
- Optional device unlock biometrics (Face ID / fingerprint): if you turn these on, the biometric template stays on your device OS/secure hardware. The Apps do not access or store Face ID / TrueDepth data or raw biometric images or templates for app unlock. Face ID, where available, only unlocks the app on your own phone; that data never leaves your phone and the Apps never see it.
3.2 Attendance & Time Tracking Data
- Check-in/check-out timestamps, attendance status, shift details
- Leave requests/approvals (if enabled), overtime, work duration summaries
- Travel and claim-related attendance or time records where those features are used
3.3 Location Information
Location is collected only when the feature is enabled by DEC and you grant permission. Location is captured only while the App is open and in active use — not in the background.
- Precise (GPS) and/or approximate location at check-in/check-out
- Location on reports that need a site location
- Location timestamps and accuracy data
3.4 Camera, Photos & Media
- Photos captured in-app for work progress, incidents, quality checks, inspections, deliveries, equipment condition, gate passes or bills
- Videos and voice notes you choose to record or attach (if enabled)
- Media you choose to upload from your device (if enabled)
We do not access your gallery or photos unless you explicitly choose media for upload and grant the relevant permission. Face-related camera use is described separately in Section 4.
3.5 Work-Related Operational Data
- Work-related operational reports
- Requests (material, labour, equipment, etc.), approvals/rejections, comments, audit trails
- Leave, travel and claims records (where enabled)
- Gate and meal / mess entries (where enabled)
- In-app notification history (if enabled)
3.6 Device & Technical Information
- Device model, OS version, App version
- Device ID for account–device binding
- Push notification token (e.g., Expo / FCM / APNs token) for operational notifications
- IP address and basic network information for security/troubleshooting
- Diagnostics, crash logs, and performance metrics where needed for reliability
We do not collect contacts, SMS, call logs, or other unrelated personal data for the Apps' core functions. The Apps do not use advertising, analytics or tracking SDKs.
3.7 Audio/Video (Optional, Feature-Dependent)
- Voice notes/audio clips only if you use the voice note feature and grant microphone permission
- Videos only if you choose to record or upload them for work documentation
4 Face Data
Face recognition is used for identity checks at attendance, the site gate and the mess. The Apps use the ordinary device camera for this purpose. They do not use Face ID / TrueDepth sensor data for face recognition.
4.1 What Face Data Is Collected
- Registration photo: one photo of your face, taken with the front camera when you (or HR) register your face. You must tick a consent box before registering yourself.
- Face template: from the registration photo our face-recognition engine makes a numeric face template (a list of numbers describing the face). The template, not the photo, is what is compared at each check.
- Check photos: when your face is checked — at attendance check-in / check-out, at the site gate or at the mess — the camera takes a short burst of photos (up to 8) so the engine can confirm a live person is in front of the camera.
- Labour attendance photos (DEC Mobile only): site engineers photograph contractors' labourers at the start and end of the day and at lunch, so each labourer's attendance is recorded for the contractor's labour bill.
4.2 How Face Data Is Used
Face data is used only to confirm who a person is:
- when they mark attendance in the App;
- when they enter the site gate or the mess;
- when their attendance is recorded on the daily labour report.
Face data is not used for any other purpose, not used to train models, and not used for marketing.
4.3 Where Face Data Is Stored and Who Can See It
- Face recognition runs on DEC's own face-recognition server (open-source software run by Nutrinium for DEC). Face data is not sent to any outside face-recognition or cloud AI service, and no third party receives it for those purposes.
- The face template is kept in that server's database.
- Registration photos and the check photos kept under Section 4.4 are stored in DEC's HR database.
- All transfer between the Apps and the servers uses encrypted connections (HTTPS).
Who can see the photos
- HR / admin
- Security staff see the registered photo of the person they are checking at the gate
- The mess operator sees it at the mess
- HR sees photos of failed attendance checks
- The site engineers, labour managers and HR of the project see labour attendance photos
4.4 How Long Face Data Is Kept
| Face data |
Kept for |
| Registration photo and face template |
While you work on DEC sites. A replaced photo / template is deleted when you register again. |
| Photos taken at a gate or mess face scan |
90 days, then deleted automatically |
| Photo of a failed attendance face check |
90 days, then deleted automatically (HR's record that the check failed is kept, without the photo) |
| Photos of successful attendance face checks |
Not kept — only the result (matched / not matched) is stored |
| Labour attendance photos on the daily labour report |
Kept with the labour report as the record for the contractor's labour bill |
A daily job carries out the time limits described above.
4.5 How Face Data Is Deleted
- When you leave: your registration photo and every face template are deleted automatically within 30 days after you leave (or after your contractor staff record is closed).
- On request: ask HR, or write to dec@nutrinium.in. HR removes your registered face at once — the photo and all templates are deleted, not just hidden. You can then use QR or your phone number at the gate and mess instead of your face.
5 How We Use Your Information
- Authenticate users and enforce role-based access (including one device per account)
- Record and verify attendance and prevent fraud (including face checks where enabled)
- Operate gate and mess identity checks
- Enable work reports with photo/media attachments
- Process internal requests, leave, travel, claims and approval workflows
- Support contractor labour attendance and labour bill records
- Maintain audit trails for operational accountability and compliance
- Provide notifications and operational communications
- Maintain and improve reliability (debugging, crash analysis)
- Protect against misuse and unauthorized access
6 Legal Basis (Where Applicable)
Depending on jurisdiction, processing may rely on:
- Employment/contract necessity and legitimate interests for workforce and site operations
- Legal obligations (labour, safety, payroll, audit requirements)
- Consent for face registration / face recognition and for optional features (e.g., microphone for voice notes) and device permission grants (location/camera/photos)
7 How We Share Your Information
We do not sell personal information and do not share it for advertising.
We may share information only in the following circumstances:
- Within DEC — people who need it for the work: your approvers, site and project managers, HR, admin, finance, security (gate) and mess staff, each only for their part, on a need-to-know basis.
- Your contractor company — for its own staff's attendance and labour bills, where applicable.
- Nutrinium Technologies — which runs the Apps and servers for DEC as Data Processor.
- Service Providers (Processors) — hosting, storage, notification delivery, and crash/performance monitoring providers under confidentiality and data processing agreements. Push notifications in DEC Mobile are delivered through Expo's notification service and Apple / Google push services; they carry only the notification text.
- Company Systems Integration — synchronization with internal systems (e.g., ERP/HRMS) for payroll, leave, inventory, assets, and project documentation as configured by DEC.
- Legal/Safety / Authorities — if required by law, regulation, court order, or to protect safety and security.
- Business Transfers — merger, acquisition, or asset transfer, with notice where required.
- With Your Direction/Consent — where you explicitly authorize sharing beyond the above.
Face data is not sent to any outside face-recognition or cloud AI service (see Section 4).
8 Data Retention
We retain data only for as long as necessary to provide the Apps and for legitimate business purposes, including compliance with legal, safety, payroll, and audit requirements. Retention periods may vary by data type and project, and are defined by DEC's internal policies.
Work records (attendance, leave, payroll-related, safety and project records) are kept as long as DEC needs them for the work and as long as Indian law requires them to be kept. Photos and documents attached to a work record are kept with that record.
Face data retention and deletion timelines are set out in Sections 4.4 and 4.5.
Certain payroll, safety, and audit records may be retained after an employee or contractor staff member leaves where required or permitted by law. When data is no longer required, it is deleted or anonymized where feasible and in accordance with applicable laws.
9 Security
We use reasonable safeguards to protect data, including:
- Encryption in transit (HTTPS/TLS)
- Role-based access controls and least-privilege access
- Every account tied to one device
- Secure credential handling (hashed passwords/PINs — stored only as one-way hashes)
- Logging and monitoring for suspicious access and abuse prevention
- Secure backups and controlled administrative access
9.1 Security Incidents
If a security incident affects personal data, DEC will take reasonable steps to investigate, mitigate, and provide notices where required by applicable law and Company policy.
10 Your Choices, Controls, and Rights
- Permissions — Camera, location, microphone and photos are asked for by the phone's own permission prompt, and you can change them any time in the phone's Settings. Without the camera, the face check cannot be used; HR can tell you the other ways to mark attendance or enter (for example QR or phone number at the gate and mess). Disabling required permissions may limit functionality.
- Face recognition consent — You must tick a consent box before self-registering your face. You may withdraw consent for face recognition by contacting HR or dec@nutrinium.in; registered face data is then deleted as described in Section 4.5.
- Access / Correction / Erasure — Subject to applicable law, you may request access to your personal data, correction of inaccurate data, or erasure of data no longer necessary for the stated purposes (noting that certain work records may be retained for payroll, safety, audit, or legal compliance even after you leave).
- Grievance Redressal — You may raise privacy-related grievances by writing to dec@nutrinium.in. DEC / Nutrinium will respond within timelines required under applicable law and Company policy. You may also complain to the Data Protection Board of India.
- Nomination — Where applicable under Indian law, you may nominate another person to exercise your rights in the event of your death or incapacity.
The Apps are provided for employment/worksite operations. Certain requests may be routed through DEC's authorized HR/IT administrators for identity verification and operational continuity.
11 Account Deletion & Data Deletion Requests
Because the Apps are provided for employment/worksite operations, account deactivation is handled by DEC (HR/IT) or by Nutrinium on behalf of DEC.
You can request deletion of your account and associated personal data (subject to legal retention) by contacting HR or emailing dec@nutrinium.in with the following details:
- Full name
- Employee ID
- Username
- Deletion request details
Face registration deletion follows the process in Section 4.5 (including the option to use QR or phone number at the gate and mess instead of face).
We may retain certain records where required for legal, payroll, safety, audit, or compliance obligations even after an account deletion request.
12 Children's Privacy
The Apps are for adults employed on DEC sites. They are not intended for individuals under 18 and are meant only for authorized personnel. They are not meant for children.
13 International Data Transfers
Data may be stored and processed in India and, where service providers operate globally (for example Apple / Google / Expo push notification infrastructure), may be processed in other regions with appropriate protections — including contracts, Data Processing Agreements (DPAs), and security controls — as required by applicable law.
Face recognition itself runs on DEC's own face-recognition server operated by Nutrinium for DEC and is not sent to outside face-recognition or cloud AI services.
14 Permissions Explained (iOS & Android)
Common permissions requested by the Apps (actual permissions depend on features enabled by DEC and on which App you use):
Location (Precise/Approximate)
Attendance and site-tagged reports while the App is open — not background tracking
Camera
Face registration/checks, reports, labour attendance photos, QR scanning (if used)
Photos/Media
Upload attachments you choose
Microphone (Optional)
Voice notes, if feature is enabled
Notifications
Send operational alerts and communications
15 Third-Party Links
If the Apps link to external sites, their own privacy practices apply. Please review their policies before submitting personal data to them.
16 Changes to This Policy
If this policy changes, the new version is shown in the Apps and on this page with a new effective date. We may also notify users through internal channels for material changes.
17 Contact Us
For any privacy question, request or complaint: