Privacy Policy

SmartTrakr is used by companies to track field employees carrying a Smart ID card. This policy covers both: the company that buys SmartTrakr, and the employee whose location it records. If you are an employee and something here does not match what your employer told you, that discrepancy matters — contact us.

Under the Digital Personal Data Protection Act, 2023, your employer is the Data Fiduciary for their employees' data. SmartTrakr processes it on their instructions.

• A continuous record of where their Smart ID card is during their declared shift hours — the route, not only arrivals.
• When they check in and out, and the sites they visit.
• Notes, photos and documents they post to their own timeline.
• People they record having met, when they choose to log a contact.
• Their name, employee code, phone, department and shift hours.

• Location outside declared shift hours. Those positions are discarded when they arrive and are never written to storage, so they cannot later be retrieved, disclosed or leaked.
• Anything from the employee's personal phone. The SmartTrakr app has no location permission — the card does the tracking.
• Calls, messages, contacts, or any other content on a personal device.

Consent is enforced, not assumed. A Smart ID card cannot be assigned to an employee who has no consent on record — the system refuses the assignment.

Each consent record stores the version of the wording agreed to, the time, and whether it was given in the app or recorded by the employer from a signed form. When the wording changes, existing consent becomes stale and must be given again.

An employee can withdraw consent at any time from the app. Tracking stops at the very next position report — the card's positions are discarded from that moment. The card itself stays assigned until the employer collects it, but it no longer records where they go.

Location is deleted after the retention window the employer sets — 90 days by default. They may shorten it, and they cannot raise it beyond a platform ceiling. Lowering the ceiling takes effect for everyone immediately.

When the window elapses, coordinates are cleared. Records that a business legitimately needs — that someone was present, which site they visited, how long they were there — survive without the precise point, so an employee can still evidence their own attendance.

Within a company, a manager sees only the departments they run. HR can see attendance and employee records but not live location or coordinates. Every location query a manager runs is recorded, with who ran it and which employee it concerned.

The DPDP Act gives you the right to access your data, have it corrected, and request erasure. Employees can see what is collected about them, and withdraw consent, directly in the SmartTrakr app.

To be confirmed: A formal request-handling process and response timeline for access, correction and erasure requests is being finalised. Until it is published, requests are handled manually — contact us and we will action them.

To be confirmed: The DPDP Act requires a named, reachable grievance officer published here. One is being appointed. In the meantime, reach us through the contact page.

When this policy changes materially we bump the consent version, which means every tracked employee is asked to agree again rather than being opted in silently.