Privacy Policy

1. About Us

RSK Online Services Private Limited ("Company", "we", "us", "our") operates OnMarQ360, a cloud-based HR and attendance management platform.

2. Scope of This Policy

This Privacy Policy applies to:

• The OnMarQ360 Employee Mobile App (iOS and Android)
• The OnMarQ360 Web Portal (app.onmarq360.com)
• All supporting APIs and backend services

This policy explains what personal data we collect, why we collect it, the legal basis for doing so, how we store and protect it, whom we share it with, how long we keep it, and your rights over it.

3. Who Controls Your Data

OnMarQ360 operates as a B2B SaaS platform. When we process employee personal data on behalf of an organization ("Client"), the roles are:

Your primary point of contact for questions about how your employer uses your data is your employer's HR department. For questions about how we handle your data as a processor, contact tech@rskonlineservices.com.

4. What Data We Collect

4.1 Data You or Your Employer Provides

Identity data (Full name, employee ID, designation), Contact data (Email, phone number), Employment data (Department, branch, role, reporting manager), Financial data (Bank details, salary advance requests, expense claims), Leave data (Leave type, dates, reason, approver), Helpdesk data (Ticket subject, description, priority, status), Performance data (Ratings, feedback, review comments), Login credentials (Username, encrypted password).

4.2 Data Collected Automatically

Precise GPS location (Latitude and longitude at clock-in/out), Device information (Device model, OS version, app version), Network information (IP address, connection type), Usage logs (Login timestamps, session duration, feature access), Push notification tokens.

4.3 Location Data — Full Disclosure

We collect your precise GPS location solely to verify that you are within an authorized work location (geofence) when you clock in or out. Specifically:

• Location is accessed only when you initiate a clock-in or clock-out action
• Location collection stops immediately after the action is recorded
• We do not track your location continuously during the day
• We do not track your location outside of your active work session
• Location data is accessible only to your employer's authorized administrators

You may revoke location permission at any time via your device settings.

5. Data Storage and Infrastructure

All data collected through OnMarQ360 is stored exclusively on:

6. Data Retention

We retain personal data as follows:

• Active employee account data: Duration of employer's active subscription
• Attendance records: 5 years (Maharashtra Shops & Establishments Act 2017 compliance)
• Leave records: 5 years
• Helpdesk/ticket records: 2 years from resolution date
• Financial data: 7 years (Income Tax Act, Companies Act)
• Audit and security logs: 3 years
• GPS location logs: 90 days rolling
• Crash and diagnostic logs: 30 days

7. Data Security

We implement the following security measures:

All data encrypted in transit via TLS 1.2+, All data encrypted at rest via AES-256, JWT authentication with short expiry and refresh token rotation, Session tokens stored in device Keychain (iOS) and Keystore (Android), Role-Based Access Control (RBAC), Automated intrusion detection, Regular vulnerability assessments.

In the event of a data breach, we will notify the relevant regulatory authority within 72 hours and affected individuals without undue delay when the breach poses high risk.

8. Your Rights

To exercise any of the following rights, email tech@rskonlineservices.com with the subject: "Data Rights Request — [Your Name]"

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion/Erasure: Request deletion of your data (subject to legal retention obligations)
• Data Portability: Receive your data in a structured, machine-readable format
• Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing
• Object to Processing: Object to processing based on legitimate interests
• Grievance Redressal: File a complaint with our Grievance Officer

Response timelines: Acknowledgment within 24 hours; substantive response within 30 days.

9. Grievance Officer — India

10. Contact Us

For questions about this Privacy Policy:

• General enquiries: admin@rskonlineservices.com
• Privacy and data rights: tech@rskonlineservices.com
• Legal notices: admin@rskonlineservices.com