Privacy Policy — Snoba Go

1. Introduction

This Privacy Policy explains how HRIS Snoba ("We", "Company") collects, uses, stores, and protects your information when you use the Snoba Go application ("Application").

Snoba Go is a companion application to the Snoba HRIS system, designed specifically for employee attendance, leave requests, overtime, and reimbursement needs. This application uses face recognition technology for authentication and attendance verification.

By using this Application, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree to this policy, please do not use the Application.

2. Definitions

• Application: Snoba Go, the mobile application provided by HRIS Snoba.
• Snoba HRIS: The parent Human Resource Information System used by the Business Owner to manage employee data and HR operations.
• Business Owner: An individual or entity subscribed to Snoba HRIS who uses Snoba Go to manage their employees' attendance.
• Employee: An individual registered in the Business Owner's Snoba HRIS system who uses Snoba Go for attendance and submission purposes.
• Account: An account created and managed by the Business Owner in Snoba HRIS. Snoba Go does not provide an independent account creation feature.
• Personal Data: Any information relating to an identified or identifiable individual.
• Biometric Data: Data derived from a person's unique physical characteristics, including facial data used for face recognition.
• Usage Data: Data collected automatically from the use of the Application, including activity logs, device metadata, and other technical information.
• Country: Indonesia.

3. Access and Authentication

Snoba Go does not provide a feature for creating new accounts. Access to the Application uses accounts created and managed by the Business Owner through Snoba HRIS. The Business Owner logs in using the owner account, and the Application can be used by employees on a shared basis.

Use of Snoba Go is only available to employees of Business Owners with an active Snoba HRIS subscription. The service is not available to parties outside the Snoba HRIS ecosystem.

4. Data Collected

4.1 Biometric Data (Face)

In order to provide the face recognition feature for attendance, We collect:

• Employee facial photos taken through the device's camera during the face enrollment process and when performing attendance check-ins.
• Facial biometric templates generated from photo processing for identity matching purposes.

Biometric data is only collected with explicit permission from the Business Owner and the relevant Employee, in accordance with applicable data protection regulations in Indonesia.

4.2 Attendance and Work Activity Data

• Check-in and check-out time records.
• Geographic location (GPS) when performing attendance, if the location verification feature is enabled.
• Facial photo as attendance proof.
• Photo data for submissions: leave, overtime, and reimbursement requests along with supporting documents.
• History of submission approvals and rejections.

4.3 Device and Usage Data

• IP address and mobile device type.
• Operating system and browser/application version.
• Unique device identifier.
• Time and duration of Application use.
• Activity logs and diagnostic data.

4.4 Account Data

• Full name and employee profile information (managed by the Business Owner in Snoba HRIS).
• Email address used for authentication.
• Position, department, and related organizational information.

5. Purpose of Data Use

• Verifying employee identity through face recognition technology during attendance check-ins.
• Accurately recording and managing employee attendance data.
• Processing leave, overtime, and reimbursement submissions.
• Verifying attendance location if activated by the Business Owner.
• Providing attendance reports and analytics to the Business Owner through the Snoba HRIS dashboard.
• Ensuring system security and integrity.
• Fulfilling legal obligations applicable in Indonesia.
• Improving the performance and functionality of the Application.

6. Legal Basis for Data Processing

• Consent: You provide explicit consent for the collection of biometric data when you first use the face recognition feature.
• Contract Performance: Processing is necessary to carry out the employment relationship between the Employee and the Business Owner.
• Legitimate Interest: Processing for system security and prevention of attendance fraud.
• Legal Obligation: Data storage in accordance with applicable employment regulations in Indonesia.

7. Special Provisions for Biometric Data

Given the sensitive nature of biometric data, We apply stricter protection standards:

• Collection of biometric data is only carried out after obtaining explicit written or digital consent.
• Biometric data is stored in encrypted template form, not as raw photos that can be directly identified.
• Biometric data is not sold, leased, or shared with third parties for commercial purposes.
• Biometric data is only used for attendance verification purposes within the Snoba ecosystem.
• Biometric data is deleted when an Employee is no longer active in the system or upon a deletion request from the Business Owner.
• Access to biometric data is restricted to authorized personnel only, with strict security protocols.

8. Data Sharing and Disclosure

8.1 With the Business Owner

Employee attendance and submission data can be accessed by the Business Owner through the Snoba HRIS dashboard, as the Business Owner is the customer responsible for managing their employees' data.

8.2 With Service Providers

We may share data with third-party service providers that assist in the operation of the Application, including cloud computing, analytics, and security services. These providers are required to maintain data confidentiality and are not permitted to use the data for other purposes.

8.3 In the Context of Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring party. We will provide notification before such a transfer occurs.

8.4 Legal Obligations

We may disclose your data if required by law, court order, or a legitimate request from a competent government authority in Indonesia.

9. Data Storage and Retention

• Attendance and work activity data: For the duration of the Business Owner's active Snoba HRIS subscription, plus any period required by applicable employment regulations.
• Biometric data: Until the Employee is no longer active in the system or upon a deletion request from the Business Owner, whichever comes first.
• Usage Data: Generally stored for a shorter period, unless required for security or legal obligations.

After the retention period ends, data will be permanently deleted or anonymized so that it can no longer be identified.

10. Data Security

We use appropriate technical and organizational security measures to protect your data, including:

• Data encryption during transmission (TLS/SSL) and at rest.
• Role-based access control.
• Regular system security monitoring.
• Vulnerability testing and security audits.

Nevertheless, no method of electronic data transmission or storage is entirely secure. We cannot guarantee the absolute security of your data and encourage you to report any potential security incidents to us.

11. Your Rights

In accordance with applicable data protection regulations in Indonesia, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal obligations that may require us to retain certain data.
• Right to Withdraw Consent: Withdraw consent for biometric data processing at any time, although this may affect your ability to use the face recognition feature.
• Right to Data Portability: Request your data in a machine-readable format.
• Right to Object: Raise an objection to the processing of your data for specific purposes.

To submit a request, please contact us through the information at the end of this Policy. Business Owners may submit requests on behalf of their employees through the Snoba HRIS admin panel.

12. Children's Privacy

The Snoba Go Application is not intended for individuals under the age of 18. We do not intentionally collect personal data from children. If We become aware that We have collected data from an individual under 18 without parental or guardian consent, We will take steps to delete that data.

13. International Data Transfers

Your data is processed and stored on servers located in Indonesia as well as in other countries where our infrastructure service providers operate. Any international data transfers are carried out with adequate protection in accordance with applicable security standards.

14. Links to Third-Party Services

The Application may contain links to third-party services or websites. We are not responsible for the privacy practices or content of those third-party services. We recommend that you read the privacy policy of each service you access.

15. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. Changes will be notified through in-app notifications, email to subscribed Business Owners, and an update to the "Last updated" date at the top of this document.

Changes take effect from the date the update is published. Continued use of the Application after the update takes effect constitutes your agreement to the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns, or wish to exercise your rights regarding this Privacy Policy, please contact us:

• Email: snoba.dev@gmail.com
• Application: Snoba HRIS / Snoba Go
• Country: Indonesia

We are committed to responding to every request within a reasonable time in accordance with applicable legal provisions.