01Who we are & scope

This Privacy Policy explains how SITEMAX Media LLP (“SITEMAX”, “we”, “us”), acting as the Data Fiduciary, collects and processes personal data through the SITEMAX mobile application (the “App”). The App is developed and maintained on our behalf by Gatetouch as a technology service provider.

The App is an internal workforce tool. It is provided to people authorised by SITEMAX or its partner agencies — employees, field staff, and contractors — for use in the course of their work. By “you” we mean such an authorised user. This policy covers data processed through the App; it does not cover any separate website or unrelated service.

02Information we collect

We collect only what the App needs to run operations and verify work. The categories below map to what the App actually does.

03Location tracking in plain terms

Location is the most sensitive data the App handles, so we are specific about it.

• Only while checked in. Continuous location is collected only during an open, checked-in work session. No location points are collected before you check in or after you check out.
• Always visible to you. While tracking is active, the App runs a foreground service and shows a persistent notification, so you always know location is being collected.
• It stops at checkout. Checking out — or an approved automatic checkout at the end of your shift — ends the session and stops location collection immediately.
• Why we need background location. Field work takes you away from the screen, so the App must access location in the background during a checked-in session to keep the route and live map accurate. This is a core function of a field-operations app; it is disclosed here and requires your consent, and you can decline the permission.
• Minimum necessary. We request precise location only for check-in, task validation and in-session tracking, and the minimum needed elsewhere.

04How we use information

We use the information above to:

• record attendance and work hours and provide inputs to payroll;
• assign, route, and track field tasks (flex, mounting, monitoring, unmounting, sales visits);
• capture and validate proof of work against the correct site and time;
• give managers live operational visibility, a staff map, and SLA and task reminders;
• detect fraud and errors, such as a photo taken outside the allowed distance from a site (geofence validation);
• produce operational, workforce, and performance reports;
• provide support, keep the service secure, and meet legal and tax obligations.

Performance dashboards are a management aid. They are not an automated decision-making engine; metric definitions and their use are set by your organisation and should be transparent to you.

05Legal basis & consent

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we process your personal data on the basis of the consent you give at onboarding and for the legitimate purposes of your employment or engagement for which the App is provided. The App records the version of the tracking and privacy notice you accepted, with the date and time.

Where consent is the basis, you may withdraw it. Because the App is a work tool, withdrawing consent for core processing (such as in-session location or proof capture) may prevent you from performing tracked field duties through the App; we will explain the effect before you act on it.

06What we do not collect

To keep collection proportionate, the standard App build does not:

• read or upload your personal phone contacts, except a contact you explicitly and individually select for a work action;
• read your SMS inbox or harvest your full call-log history — for sales activity we record only that you initiated a call or message and the outcome you enter;
• collect any location outside an open, checked-in work session;
• record audio or capture the screen;
• access photos in your gallery beyond images you choose to attach.

07Sharing & disclosure

We do not sell your personal data. We share it only as follows:

• Within your organisation — your managers, operations, and administrative and finance staff, limited by role, territory, and business need through role-based access controls.
• Service providers (data processors) — vetted vendors who host and run the App on our behalf: cloud hosting and storage, maps and geocoding, push-notification, and email or SMS delivery providers. They may process data only on our instructions.
• Legal and safety — where required by law, regulation, court order, or to protect rights, safety, and property.
• Business transfer — in a merger, acquisition, or reorganisation, under equivalent protections.

08Security

• Encryption in transit (TLS) and encryption at rest for databases and file storage;
• an encrypted local database on the device for offline work, with remote logout and device revocation;
• role-based access control on both the app and the server, with territory and ownership limits;
• signed, time-limited links for photos and documents, and an immutable audit trail of changes;
• secrets held in a managed secrets store, with monitoring, backups, and tested recovery.

No system is perfectly secure, but we maintain reasonable security safeguards appropriate to the sensitivity of the data, as required by the DPDP Act.

09Retention schedule

We keep personal data only as long as needed for the purpose it was collected, or as the law requires. Default periods (configurable by your organisation) are:

10Your rights

Subject to the DPDP Act and to legal and operational retention limits, you may:

• Access a summary of the personal data we process about you;
• Correct or update inaccurate or incomplete data;
• Request erasure of data no longer required for a lawful purpose (see the Data Deletion Policy);
• Nominate another person to exercise your rights in the event of death or incapacity;
• Grievance redressal — raise a concern and have it addressed;
• Withdraw consent for consent-based processing, with the effect noted in §5.

Because the App is a workplace tool, some requests (for example correcting attendance records) may be handled through your organisation's administrator or HR. To exercise a right, contact the Grievance Officer in §13. If you remain unsatisfied, you may approach the Data Protection Board of India.

11Children

The App is intended for authorised workers aged 18 and over. It is not directed at children, and we do not knowingly create accounts for or collect data from anyone under 18.

12Changes to this policy

We may update this policy as the App or the law changes. We will revise the effective date above and, for material changes, notify you in the App or by email. Continued use after an update means you accept the revised policy.

13Grievance Officer & contact

We aim to acknowledge requests within 72 hours and resolve them within the timelines required by the DPDP Act.

01Acceptance & eligibility

By logging in to or using the App, you agree to these Terms and to the Privacy Policy. If you do not agree, do not use the App. The App is provided only to people authorised by SITEMAX Media LLP or its partner agencies, for work purposes, and only to users aged 18 or over. Your use is part of, and subject to, your employment or engagement terms.

02Definitions

• App — the SITEMAX mobile workforce application.
• Provider — SITEMAX Media LLP; the App is maintained on its behalf by Gatetouch.
• Organisation — SITEMAX or the partner agency that authorised your account.
• User / you — an authorised person using the App.
• Work session — the period between a check-in and the matching check-out.

03Licence to use

The Provider grants you a limited, personal, non-exclusive, non-transferable, revocable licence to use the App on an approved device for authorised work only. You may not copy, modify, distribute, sell, lease, decompile, or reverse-engineer the App or any part of it, except as the law expressly permits.

04Accounts & devices

• Keep your credentials confidential; you are responsible for activity under your account.
• Use the App only on devices approved under your Organisation's policy; a lost or compromised device must be reported at once so it can be revoked.
• Do not share your account, let another person check in or out for you, or operate another user's account.
• Keep the App updated; the Provider may require a minimum supported version.

05Acceptable use

You agree to use the App honestly and only for assigned work. You must not:

• falsify attendance, check in or out from a place you are not at, or submit proof photos for work not actually done;
• use mock-location, GPS spoofing, rooted/jailbroken tampering, or any tool to fake location, time, or identity;
• upload unlawful, infringing, or malicious content, or interfere with the App's security or operation;
• attempt to access data or functions beyond your assigned role and permissions.

Dishonest or fraudulent use may lead to disciplinary action by your Organisation and, where applicable, legal consequences.

06Attendance, tracking & monitoring

You acknowledge and agree that, as described in the Privacy Policy:

• the App records your attendance and collects your location during an open work session, and stops at check-out;
• your Organisation's managers can view your attendance, in-session location, assigned tasks, and work output for operational and HR purposes;
• the App displays a persistent notification while tracking is active.

You consent to this monitoring for the purposes set out in the Privacy Policy. If you withdraw consent for core tracking, you may be unable to perform tracked field duties through the App.

07Proof of work & accuracy

Mounting, monitoring, and unmounting tasks require a genuine in-app photo with valid location and time; the App may reject proof captured outside the allowed distance from a site or outside the required time window. You are responsible for the accuracy of the data you enter. Deliberately inaccurate or fabricated records are a breach of these Terms.

08Offline use & sync

The App works offline and stores your work locally in an encrypted form, then syncs when a connection returns. You should sync regularly and must not tamper with locally stored data or the sync queue. Until a record syncs, it may not be visible to your Organisation. The App shows the sync status of important records.

09Intellectual property

The App, its software, design, trademarks, and content are owned by the Provider and its licensors, including Gatetouch. These Terms grant you no ownership or rights except the limited licence in §3. Data you enter remains subject to your Organisation's policies and the Privacy Policy.

10Suspension & termination

Your Organisation or the Provider may suspend or revoke your access at any time — for example on breach of these Terms, on a security concern, or when your employment or engagement ends. On termination, your licence ends, access is revoked, and the device may be logged out or wiped of App data. Provisions that by their nature should survive (intellectual property, disclaimers, liability, governing law) continue after termination.

11Disclaimers & limitation of liability

The App is provided on an “as is” and “as available” basis. Location accuracy, maps, and timing depend on your device, GPS signal, and network, and may not always be exact. To the maximum extent permitted by law, the Provider is not liable for indirect, incidental, or consequential loss, for loss arising from device or network failure, from your misuse of the App, or from data not yet synced. Nothing in these Terms excludes liability that cannot be excluded by law.

12Third-party services

The App relies on third-party services such as maps, geocoding, push notifications, and cloud hosting. Their availability and performance are outside the Provider's control, and your use of features that depend on them is subject to those providers' terms where applicable.

13Changes & governing law

The Provider may update these Terms as the App or the law changes; the effective date will be revised and material changes notified in the App. Continued use means you accept the updated Terms.

These Terms are governed by the laws of India. Subject to any applicable employment law, the courts at Ahmedabad, Gujarat have exclusive jurisdiction over any dispute.

01Scope

This policy covers personal data collected through the SITEMAX mobile app and its backend, as described in the Privacy Policy. Because SITEMAX is a workforce app, some records are work records of your Organisation; deletion of those is handled together with your Organisation and may be subject to retention duties (see §6).

02Who can request

• You, as the person the data is about (the data principal).
• Your Organisation's administrator or HR, on your behalf or when your engagement ends.
• A nominee you have authorised, in the event of death or incapacity.

03How to request

Use any of these channels:

1. In the App — where available, open Profile → Privacy → Request data deletion and submit the request.
2. By email — write to [email protected] from your registered email, with the subject “Data deletion request” and your name and employee code.
3. Through your Organisation — ask your manager, administrator, or HR to raise the request.

Because email schemes may not open reliably inside this page, copy the address above rather than relying on a tap.

04Identity verification

To protect your data, we verify your identity before acting — normally by confirming the request comes from your registered email or account, or through your Organisation's administrator. We may ask for limited additional confirmation if we cannot verify you from the request alone.

05What is deleted

On an approved request we delete or irreversibly anonymise the personal data that is no longer required for a lawful purpose, including:

• your profile and account details and login credentials;
• your device enrolment, push tokens, and app session data;
• raw location points attributable to you, beyond any still within the retention window;
• personal data in your sales/CRM activity that is not part of a statutory record;
• locally stored data on your device, via remote logout or wipe.

06What is retained & why

Some records cannot be deleted immediately because the law or legitimate business duties require us to keep them. These are retained for the periods in the Privacy Policy's retention schedule, then deleted, and are anonymised or de-linked from you where feasible:

07Timeline

• Acknowledgement — within 72 hours of a verified request.
• Completion — within 30 days, extendable where the volume or complexity requires, with notice to you.
• Retained records — deleted automatically at the end of their statutory or policy retention period.

08Automatic deletion

Independently of any request, the App applies the retention schedule in the Privacy Policy — for example, raw GPS points are deleted or aggregated after 90–180 days, and local device data is cleared after it has synced plus a short safety window.

09Contact