OneTap Data Processing Agreement
Draft for legal review. Not yet in force. This text sets out the structure and commitments OneTap is built to meet. Counsel must review and complete it, including every part in square brackets, before OneTap goes live.
1. Who does what
The company that signs up for OneTap (the "Company") decides why and how its employees' attendance data is processed. Under the Digital Personal Data Protection Act, 2023, the Company is the Data Fiduciary. Oltin [registered company name and number], of 431 Fen Street, Brooklands, Milton Keynes, MK10 7PE ("Oltin"), processes that data on the Company's behalf as its Data Processor, only to provide OneTap.
2. What OneTap processes
| About | Data |
|---|---|
| Employees | Name, work email, employee ID, role, the offices they may check in at. If the Company gives them, the details attendance registers ask for: designation, gender, date of birth, father's or spouse's name, and date of joining. |
| Attendance | Check-in and check-out times as recorded by the server, the office matched, which checks passed, the trust level, and any review decision with its reason. |
| Linked phones | Model, operating system, app version, the phone's public keys, and the results of Apple App Attest or Google Play Integrity checks. |
| At the moment of a check-in or check-out only | The office Wi-Fi router's hardware ID and name, and the public IP address of the request. At an office with an area set: whether the phone was inside it, how far it was from the office, and how accurate that reading was. |
| If the employee allows location all the time | The time the phone left the office's area after a check-in, and the check-out it caused. |
| The Company's admins | Name, work email, sign-in records and the audit trail of their changes. |
OneTap keeps no location trails and stores no coordinates of people. At an office with an area set, the phone sends one position at each tap; OneTap compares it with the area and keeps only the results above, never the position. Face ID and fingerprint never leave the phone: OneTap receives only a signature made after the phone unlocked its key.
3. Purpose
Oltin processes the data only to record attendance for the Company, to keep the attendance and statutory registers the Company needs, and to secure and operate OneTap. Oltin does not sell the data, use it for advertising, or profile employees.
4. Instructions
Oltin processes the data only on the Company's documented instructions: this agreement and the settings the Company chooses in OneTap Admin. Oltin tells the Company if it believes an instruction breaks the law.
5. Security
Oltin keeps the data secure with measures that include encryption in transit (TLS 1.2 or newer) and at rest, isolation of each company's data in the database, keys held in phones' secure hardware, least-privilege access for Oltin staff, and logs of access. Oltin runs security controls aligned with ISO/IEC 27001. People at Oltin who can reach the data are bound by confidentiality.
5A. Support access
The Company instructs Oltin, under section 4, that Oltin's support staff may open the Company's account in OneTap Admin, as far as the Company's owner allows, only to help the Company: to answer its questions, and to find and fix faults.
- The owner decides. In OneTap Admin's settings the owner chooses whether support staff may see the account without changing anything, which is the setting a new Company starts with; see it and make the changes one of the Company's admins could make; or not open it at all. The owner can change this at any time, and a change ends any visit then in progress.
- Each visit is limited. A named member of Oltin's staff opens it, with the reason recorded, from Oltin's networks and after two-factor sign-in. It ends after 15 minutes without use and after two hours at most.
- Support never acts as the owner. Support staff never add or change the Company's admins, change the rules only the owner sets, delete the Company's data or download all of it, answer Data Principals, name the Company's grievance officer, breach contact or register signatory, or issue its statutory registers.
- No conflict. A member of Oltin's staff never supports a Company they work for.
- Everything is recorded. Each visit, with its reason, and everything done in it, is recorded in the Company's audit trail under the staff member's name, and in Oltin's own audit.
- The data stays in OneTap. Support staff don't copy the Company's data out of OneTap, except as the Company asks.
6. Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud | Hosting and the database | Belgium, European Union |
| Cloudflare | Network edge, DNS and protection from attacks | Edge locations; data at rest stays in the European Union |
| Zoho (ZeptoMail) | Sending sign-in codes, invites and notices by email | Zoho's EU data centre |
| Apple and Google | Checking that a phone and the OneTap app are genuine | Their own services |
Oltin gives the Company at least 30 days' notice before adding or replacing a sub-processor. The Company may object by writing to Oltin at the address in section 1 before the change takes effect. Each sub-processor is bound by data protection terms no less protective than these.
7. Where the data is kept
The data is stored and processed in the European Union (Belgium). It leaves the European Union only as needed for the phone checks run by Apple and Google, and in transit across the network edge.
8. Personal data breaches
Oltin tells the Company without undue delay, and within 24 hours of becoming aware of a personal data breach, with what is known and what is being done, so the Company can inform the Data Protection Board of India and affected employees within 72 hours. Where CERT-In rules require it, Oltin reports the incident to CERT-In within 6 hours.
9. Employees' rights
OneTap gives the Company the tools to answer employees' requests to see, correct or erase their data, and to name a grievance officer whom employees can reach in the app. Oltin helps the Company meet the timelines the law sets.
10. Keeping and deleting data
Oltin keeps the data while the Company uses OneTap, and keeps statutory records for at least five years as labour law requires. When the agreement ends, the Company can export all its data; Oltin then deletes it within 30 days and issues a certificate of deletion, except for records the law requires to be kept, which are deleted when that period ends.
11. Audits
Oltin gives the Company the information needed to show that this agreement is met, including summaries of independent security assessments. Further audits are agreed in writing.
12. Liability, law and disputes
[To be completed by counsel: limits of liability, governing law of India, and the courts of [city].]
13. Acceptance
The person who signs the Company up accepts this agreement on the Company's behalf. OneTap records the version accepted, the time, and who accepted it.