OneTap app privacy policy
Draft for legal review. Not yet published. Counsel must review this policy before OneTap goes live. The App Store and Google Play link to it once it is published.
Who is responsible
OneTap records attendance for employers. Your employer decides why and how your attendance is recorded, and is responsible for your data as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Your employer gives you a privacy notice in the app before you first check in, which you can read in English or any of the 22 languages of the Eighth Schedule.
Oltin, of 431 Fen Street, Brooklands, Milton Keynes, MK10 7PE, makes OneTap and runs it for your employer as the Data Processor.
What the app records
- Your name, work email, employee code and role, as your employer gives them.
- If your employer gives them, the details attendance registers ask for: your designation, gender, date of birth, father's or spouse's name, and the date you joined.
- When you check in and check out, by OneTap's clock, not your phone's.
- At each check-in or check-out: the office Wi-Fi router's ID and name, and the address of the network your phone used.
- At an office with an area set: whether your phone was inside it, how far it was from the office, and how accurate that reading was.
- If you allow location all the time: when your phone leaves your office's area after you check in, and the check-out that caused.
- Which checks each check-in passed, and how sure OneTap is that it was you.
- Your phone's model, its software version, the OneTap version and the app's public keys, with the results of Apple App Attest or Google Play Integrity checks.
What it never records
- Where you are: OneTap reads your phone's position only when you tap, compares it with your office's area, and never stores it or tracks where you go.
- Your face or fingerprint: your phone checks them itself and tells OneTap only that it was you.
- Photos, contacts, messages, or anything about other apps on your phone.
Why it asks for location
Phones show the Wi-Fi router's ID only to apps allowed to use location, so OneTap asks for location while you use it. It uses it when you tap. If you also allow location all the time, your phone tells OneTap only when it leaves your office's area, so OneTap can check you out. You can turn this off in your phone's settings.
Who sees it, and where it is kept
- Your employer's owner and the administrators they choose.
- Oltin's staff, only to run and support OneTap and keep it secure. Every access is logged.
- The companies Oltin uses to run OneTap, under contract and only to provide the service. The trust center lists them.
Your data is stored and processed in the European Union, in Belgium. It leaves the European Union only for the phone checks Apple and Google run, and in transit across the network edge. OneTap doesn't sell your data, use it for advertising, or profile you.
How long it is kept
- Attendance records and registers: at least 5 years, as Indian labour laws require, and 6 for a company with an office in Uttar Pradesh.
- Records of who accessed or changed data: at least 1 year.
- When your employer stops using OneTap, your data is deleted from it, except what the law requires to be kept.
Your rights and deleting your account
In the app, on Profile, you can ask your employer for a summary of your data, or for it to be corrected or completed. You can also ask them to erase it, once the law no longer requires them to keep it. You can complain to your employer's grievance officer, and then to the Data Protection Board of India. Your employer creates and ends your OneTap account, so ask them to close it.
Contact
Your employer is the first place to ask about your attendance. To reach Oltin, write to support@oltin.ai, or by post to Oltin, 431 Fen Street, Brooklands, Milton Keynes, MK10 7PE.