Privacy Policy

1. Data operator and contacts

The operator of the faceid.tj website data is Khizmatrasonii Nav LLC, Dushanbe, Republic of Tajikistan.

For employee data processed in the mobile app and system, the operator is the employer organisation that deployed FaceID for its staff; the Company acts as a processor on its instructions and under contract.

For any data questions, write to info@hizmatrason.tj.

2. Scope of this Policy

The Policy covers all parts of the FaceID product:

• the faceid.tj website;
• the FaceID mobile app for Android and iOS (com.hizmatrason.faceid);
• the face-recognition terminals and the server side of the system.

3. What data we collect on the website

• Contact details from the request form: name, organisation name, phone number, email address and message text.
• Anonymised technical visit data: device type, browser, operating system, language, page, referrer and approximate region (from IP, without storing the IP itself).

4. Data collected by the mobile app and system

• Biometric data — a facial image and derived biometric template used to recognise an employee at check-in.
• Location data — the device’s precise location, including in the background (background location permission) — detailed in section 5.
• Camera access — to capture the face for check-in and enrolment.
• Time-tracking data — check-in/out records, time, shift, late and overtime statuses.
• Device technical data — model, OS version, app version, technical identifiers and a push token for notifications.

5. Location data: how and why we use it

The FaceID mobile app requests access to the device’s location, including access in the background (background / BACKGROUND_LOCATION permission), for the following time-tracking purposes:

• Geo-verification of check-ins — confirming that a check-in/out was made at the workplace agreed with the employer.
• Field-employee geotracking — showing a live location map and movement history during the working day for employees whose work involves travel.

6. Background location access and consent (Prominent Disclosure)

Background location access (when the app is minimised or the screen is off) is used only for field-employee geotracking and is enabled ONLY when both conditions are met: (1) the employer has activated geotracking for the employee and (2) the employee has granted background location permission in the device settings.

Before the first access to location, including background, the app shows a prominent disclosure explaining what location data is collected, why, and that collection may continue in the background, and asks for the employee’s explicit consent.

The employee may decline location access or revoke it at any time in the device settings. In that case geo-verification and geotracking become unavailable, while the rest of the app keeps working.

Location data is available only to the employee’s employer; we do not sell it, do not share it with advertising networks or data brokers, and do not use it for advertising.

7. Biometric data and consent

The facial image and biometric template are processed solely to identify an employee at check-in and on the employer’s instructions. They are stored in a separate protected instance of the organisation, are not shared with third parties other than the employer, and are not used for any other purpose. An employee may withdraw consent via the employer; after withdrawal the biometric data is deleted or anonymised.

8. Purposes and grounds of processing

• Time tracking, calculation of lateness, overtime and payroll, and discipline control — based on the employment relationship, the employer’s instruction and the employee’s consent.
• Handling website requests — based on your consent and pre-contractual steps.
• Improving the website and anonymised traffic analysis — based on legitimate interest.

9. Sharing with third parties

We do not sell personal data. Employee data (including biometrics and location) is available only to their employer — the client organisation that deployed FaceID. We use Google Analytics for website traffic analysis, processing anonymised data on Google’s side under its policy. Data may be disclosed only upon a lawful request of the authorised bodies of the Republic of Tajikistan. The app does not share location data or biometrics with advertising networks or data brokers.

10. Retention and security

Employee data is kept for the duration of the employment relationship and to the extent required by the employer, after which it is deleted or anonymised. Website requests are kept for the period needed to handle them. We apply organisational and technical safeguards: channel encryption (HTTPS/TLS), access control, a separate database per organisation and storing passwords as cryptographic hashes.

11. Your rights

• Obtain information about the processing of your data and request its correction, blocking or deletion.
• Withdraw consent, including consent to location and biometric processing — via the employer or by writing to info@hizmatrason.tj.

12. Children

The FaceID product is intended for employee time tracking and is not directed to children under 16; we do not knowingly collect children’s data.

13. Changes and contacts

We may update this Policy; a new version takes effect upon publication on faceid.tj. For privacy questions, write to info@hizmatrason.tj.