One Platform.
Every Security Operation.

1. Acceptance of Terms

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer", "you", or "your") and EKAMA ("Provider", "we", "us", or "our"), governing your access to and use of the EKAMA Security Operations Platform ("Platform" or "Service"). By accessing, registering for, or using the Platform in any capacity, you acknowledge that you have read, understood, and agree to be bound by these Terms in their entirety. If you are using the Platform on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation to these Terms.

These Terms apply to all users of the Platform, including but not limited to System Administrators, Security Supervisors, Security Officers, Employees subject to attendance verification, and any authorised personnel granted access by an institution operating on the Platform. Your continued use of the Service following the posting of any amendments to these Terms constitutes your acceptance of such amendments.

2. Definitions

"Platform" means the EKAMA Security Operations Platform, a web-based software application comprising an administrative dashboard, a mobile interface for field personnel, and all associated modules, features, and functionalities as described in the system documentation.

"Institution" means any client site, organisation, or entity registered on the Platform to manage its security operations, including but not limited to healthcare facilities, educational institutions, corporate real estate, industrial sites, hospitality venues, and government facilities.

"Biometric Data" means facial photographs and associated facial geometry templates captured through the Platform's AI-powered face verification module for the purpose of employee identity verification during attendance marking.

"GPS Data" means geolocation coordinates, routes, and location timestamps captured by the Platform through officer mobile devices during patrol operations and attendance marking.

"Incident Data" means all information submitted through the incident reporting module, including but not limited to textual descriptions, photographic evidence, voice recordings, GPS-tagged locations, severity classifications, and investigation status records.

"Confidential Information" means all non-public information disclosed by either party, including but not limited to proprietary software code, system architectures, security configurations, institutional patrol data, employee personal data, and business strategies discussed in connection with the Service.

3. Licence Grant & Permitted Use

Subject to your compliance with all terms and conditions set forth herein and the timely payment of all applicable fees, the Provider grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Platform solely for the purpose of managing your organisation's security patrol operations, workforce attendance, incident reporting, and related activities as authorised under your subscription or licence agreement.

You shall not: (a) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Platform; (b) modify, adapt, or create derivative works based on the Platform; (c) rent, lease, lend, sell, or redistribute the Platform to any third party; (d) circumvent, disable, or interfere with any security features, access controls, or usage monitoring mechanisms of the Platform; (e) use the Platform for any unlawful purpose or in any manner that could damage, disable, overburden, or impair the Provider's servers or infrastructure; (f) introduce any malicious software, viruses, or harmful code into the Platform; or (g) use automated means, including bots, scrapers, or scripts, to access or extract data from the Platform without prior written authorisation.

4. User Accounts & Access Control

Each Institution is allocated administrative accounts with role-based access control (RBAC) permissions. The Institution's designated System Administrator(s) are responsible for creating, managing, and deactivating user accounts for Security Officers, Employees, and other authorised personnel within their organisation. Administrators must ensure that all user credentials are kept confidential and are not shared with unauthorised individuals.

The Platform enforces single-device login enforcement for Security Officer accounts. Each officer account is locked to one registered device at a time. Device switching requires authentication through a Force Login procedure. Administrators retain the ability to remotely terminate any active officer session through the Force Logout feature. All login attempts, device registrations, and session terminations are logged for audit and security purposes.

You are responsible for all activities that occur under your account credentials and must promptly notify the Provider of any unauthorised use, suspected security breach, or loss of credentials. The Provider reserves the right to suspend or terminate accounts that exhibit suspicious activity without prior notice to protect the integrity of the Platform and the data of other Institutions.

5. Service Description & Features

The Platform provides the following core modules and capabilities: (a) Patrol Operations, including QR code checkpoint verification with GPS location capture, intelligent patrol scheduling with configurable time intervals, real-time live monitoring of active patrols with auto-refreshing activity feeds, GPS route tracking and historical route replay, and a visual layout editor for floorplan-based checkpoint management; (b) Compliance and Reporting, including automated patrol classification as On Time, Delayed, or Missed, multi-format report generation in daily, weekly, and monthly intervals, and cron-driven automated email reports delivered via configurable SMTP per institution; (c) Workforce Management, including multi-role user administration, employee registration with institutional assignment, shift definition and roster scheduling with grace period configurations; (d) AI-Powered Attendance, including GPT-4o face verification for employee identity confirmation, GPS-gated attendance marking restricted to within 100 metres of the registered institution, and payroll-ready attendance monitoring with IN/OUT transaction tracking and export capabilities; (e) Incident Management, including field incident reporting with photographic and voice evidence, GPS-tagged incident locations, lifecycle tracking with status workflows, and Google Maps navigation integration; (f) Visitor Management, including self-service QR check-in, automated rescheduling, and satisfaction survey collection; (g) Customer Feedback and Satisfaction Surveys, including questionnaire building, automated survey delivery, and analytics dashboards; and (h) System Security and Control features including notifications, dark/light theme support, and per-institution SMTP configuration.

The Provider reserves the right to modify, enhance, or discontinue any feature or module of the Platform at any time, with or without prior notice, provided that such modifications do not materially impair the core functionality for which the Service was subscribed. Material changes will be communicated through the Platform's notification system or via email to registered administrative contacts.

6. Biometric Data Processing & AI Verification

The Platform's AI-Powered Attendance module utilises facial recognition technology powered by OpenAI's GPT-4o Vision API to verify employee identity during attendance marking. By enrolling an employee in the face verification system, the Institution and the enrolled employee acknowledge and consent to the following: (a) the capture and secure storage of facial reference photographs; (b) the processing of real-time facial images through a third-party AI service (OpenAI GPT-4o Vision API) for identity comparison purposes; (c) the retention of facial data for the duration of the employee's association with the Institution and for a period not exceeding twelve (12) months following termination of employment or de-enrolment, after which all biometric data shall be permanently deleted; and (d) the processing of such data may occur on servers located outside the Institution's jurisdiction.

The Provider implements a minimum confidence threshold of seventy-five percent (75%) for face verification acceptance. Verification attempts falling below this threshold are automatically rejected, and the employee is required to retry or contact their administrator. The Institution is solely responsible for obtaining all necessary employee consents, including explicit written consent for biometric data processing as required by applicable data protection legislation in the Institution's jurisdiction, prior to enrolling any employee in the face verification system.

The Provider shall not use, sell, lease, or share biometric data for any purpose other than the identity verification function described herein. Biometric data is encrypted at rest and in transit using industry-standard encryption protocols. In the event of a data breach affecting biometric data, the Provider shall notify affected Institutions within seventy-two (72) hours in accordance with applicable data breach notification requirements.

7. GPS Data Collection & Geolocation Processing

The Platform continuously collects, stores, and processes GPS data from Security Officer mobile devices during active patrol operations and attendance marking. This includes real-time location coordinates, patrol route paths, checkpoint scan locations, and attendance marking locations. GPS data is used for: (a) verifying that Security Officers physically visit designated checkpoint locations during patrols; (b) enforcing GPS-gated attendance restrictions requiring employees to be within 100 metres of the registered institution; (c) generating GPS route replay and compliance reports; and (d) providing real-time location visibility through the Live Monitor dashboard.

Each Institution must ensure that all Security Officers and Employees are informed of and consent to GPS data collection as a condition of using the Platform. The Institution is responsible for complying with all applicable local laws regarding employee location monitoring, including any requirements for prior disclosure, consent, or authorisation. GPS data is retained for a period of ninety (90) days for active institutions and is purged upon Institution deactivation unless a longer retention period is required by applicable law or agreed upon in writing.

8. Data Protection & Privacy

The Provider is committed to protecting the privacy and security of all data processed through the Platform. Each Institution acts as an independent data controller for the personal data of its personnel processed through the Platform, and the Provider acts as a data processor on behalf of each Institution. The Provider processes personal data solely for the purpose of providing the Service and does not process personal data for its own independent purposes.

The Provider implements appropriate technical and organisational security measures, including but not limited to: (a) encryption of data at rest using AES-256 or equivalent standards; (b) encryption of data in transit using TLS 1.2 or higher; (c) role-based access control with least-privilege principles; (d) regular security audits and vulnerability assessments; (e) secure session management with configurable timeout policies; and (f) secure backup and disaster recovery procedures. Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure, and the Provider does not guarantee absolute security of data.

Each Institution shall: (a) process personal data in accordance with applicable data protection laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 where applicable, the Personal Data Protection Act No. 9 of 2022 (Sri Lanka), and any other relevant jurisdictional requirements; (b) maintain its own privacy notices and obtain necessary consents from data subjects; (c) promptly notify the Provider of any data subject access requests, rectification requests, or erasure requests received directly from data subjects; and (d) ensure that its use of the Platform complies with all applicable employment and surveillance laws.

9. Intellectual Property Rights

All intellectual property rights in the Platform, including but not limited to the software code, database schemas, user interface designs, graphical elements, documentation, trademarks, logos, and trade names (collectively, "IP Rights"), are and shall remain the exclusive property of the Provider or its licensors. Nothing in these Terms shall be construed as transferring, assigning, or licensing any IP Rights to you other than the limited right to use the Platform as expressly granted herein.

You retain all intellectual property rights in your own data, content, and materials uploaded to or processed through the Platform ("Customer Data"). By using the Platform, you grant the Provider a limited, non-exclusive licence to process, store, and transmit Customer Data solely for the purpose of providing the Service. The Provider shall not use Customer Data for any purpose other than delivering the Service, generating aggregate anonymised statistics, or complying with legal obligations.

10. Payment Terms & Subscription

Access to the Platform is provided subject to the payment of applicable subscription fees, licence fees, or acquisition costs as agreed upon between the Customer and the Provider in a separate commercial agreement. All fees are quoted exclusive of applicable taxes, duties, and levies, which shall be borne by the Customer. Payment terms, invoicing schedules, and late payment consequences are governed by the applicable commercial agreement between the parties.

The Provider reserves the right to adjust pricing with thirty (30) days' prior written notice for subscription arrangements. For outright purchase and managed deployment arrangements, pricing is fixed as agreed in the commercial agreement. Failure to pay applicable fees within the agreed timeframe may result in suspension or termination of access to the Platform, subject to the cure periods specified in the applicable commercial agreement.

11. Service Level Commitments

The Provider endeavours to maintain the Platform's availability and performance at a high standard. The Platform is designed to operate on standard web infrastructure (Apache or Nginx with PHP 8.0+, MySQL 5.7+ or MariaDB 10.3+) and does not require proprietary hardware. Scheduled maintenance windows shall be communicated to all registered administrative contacts at least forty-eight (48) hours in advance through the Platform's notification system or via email. The Provider shall use commercially reasonable efforts to minimise unplanned downtime and restore service promptly following any disruption.

The Provider does not guarantee uninterrupted or error-free operation of the Platform. Service availability may be affected by factors beyond the Provider's reasonable control, including but not limited to internet connectivity issues, third-party service outages (including OpenAI API availability for face verification), force majeure events, and acts of government. The specific service level commitments, if any, including uptime percentages, response times, and credit mechanisms, are defined in the applicable commercial agreement and are not governed by these Terms.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PROVIDER SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR FAILURE TO REALISE EXPECTED SAVINGS, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE USE OF OR INABILITY TO USE THE PLATFORM, REGARDLESS OF THE LEGAL THEORY UNDER WHICH SUCH DAMAGES ARE SOUGHT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, AND EVEN IF THE PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THE PROVIDER'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS SHALL NOT EXCEED THE TOTAL FEES PAID BY THE CUSTOMER TO THE PROVIDER DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THIS LIMITATION APPLIES REGARDLESS OF THE NUMBER OF CLAIMS OR THE NATURE OF THE CAUSE OF ACTION.

13. Indemnification

You agree to indemnify, defend, and hold harmless the Provider, its officers, directors, employees, agents, licensors, and affiliates from and against any and all claims, demands, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or in connection with: (a) your use of the Platform in violation of these Terms or any applicable law; (b) your violation of any third-party intellectual property or privacy rights through your use of the Platform; (c) your failure to obtain necessary employee consents for biometric data processing, GPS tracking, or CCTV integration as required by applicable law; (d) any content, data, or materials you upload, transmit, or process through the Platform; (e) your negligence or willful misconduct in connection with the Platform; or (f) any dispute between you and your employees, officers, or third parties relating to the use of the Platform.

14. Confidentiality

Each party agrees to maintain the confidentiality of all Confidential Information received from the other party and to use such information solely for the purposes contemplated by these Terms. Confidential Information shall not be disclosed to any third party without the prior written consent of the disclosing party, except as required by applicable law, regulation, or court order. In the event of a legally compelled disclosure, the receiving party shall provide the disclosing party with prompt written notice so that the disclosing party may seek a protective order or other appropriate remedy.

The obligations of confidentiality shall survive the termination or expiration of these Terms for a period of five (5) years. Notwithstanding the foregoing, Confidential Information that is: (a) publicly available through no fault of the receiving party; (b) rightfully received from a third party without confidentiality obligations; (c) independently developed by the receiving party without reference to the disclosing party's Confidential Information; or (d) required to be disclosed by law, shall not be subject to these confidentiality obligations.

15. Term & Termination

These Terms shall remain in effect for the duration of your access to and use of the Platform, unless terminated earlier in accordance with this Section. Either party may terminate these Terms: (a) immediately upon written notice if the other party materially breaches any provision of these Terms and fails to cure such breach within thirty (30) days of receiving written notice specifying the breach; (b) immediately if the other party becomes insolvent, files for bankruptcy, has a receiver appointed for its assets, or ceases business operations; or (c) by the Customer upon thirty (30) days' prior written notice for convenience, subject to any minimum commitment periods specified in the applicable commercial agreement.

Upon termination or expiration: (a) all licences and access rights granted hereunder shall immediately cease; (b) the Customer shall cease all use of the Platform and return or destroy all Provider materials in its possession; (c) the Provider shall, within thirty (30) days of receiving a written data export request, provide the Customer with a machine-readable export of all Customer Data in a commonly used format; and (d) the Provider shall securely delete all Customer Data, including biometric data, within ninety (90) days following the completion of data export, unless retention is required by applicable law. Provisions which by their nature should survive termination, including but not limited to Sections 8 (Data Protection), 9 (Intellectual Property), 12 (Limitation of Liability), 13 (Indemnification), 14 (Confidentiality), and 17 (General Provisions), shall survive any termination of these Terms.

16. Modifications to Terms

The Provider reserves the right to amend or update these Terms at any time. Material amendments shall be communicated to all registered administrative contacts via email at least fifteen (15) days before the effective date of such amendments. Non-material amendments, including corrections of typographical errors, clarifications, and updates to reflect new Platform features, may be implemented with less notice. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Terms. If you do not agree to any amended Terms, you must cease using the Platform and notify the Provider in writing prior to the effective date of the amendment.

17. Dispute Resolution & Governing Law

These Terms shall be governed by and construed in accordance with the laws of the Democratic Socialist Republic of Sri Lanka, without regard to its conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded from application to these Terms.

Any dispute, claim, or controversy arising out of or relating to these Terms or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, shall be resolved: (a) first, through good-faith negotiation between the parties, with each party designating a senior representative with authority to settle the dispute; (b) if negotiation fails within thirty (30) days, through mediation administered by a mutually agreed mediator in Colombo, Sri Lanka; and (c) if mediation fails within sixty (60) days, through binding arbitration conducted in accordance with the Arbitration Act No. 11 of 1995 of Sri Lanka, with the arbitral tribunal seated in Colombo, Sri Lanka. The language of arbitration shall be English. The arbitral award shall be final and binding and may be entered in any court of competent jurisdiction.

18. General Provisions

Entire Agreement. These Terms, together with any applicable commercial agreement, privacy policy, and acceptable use policy, constitute the entire agreement between you and the Provider with respect to the subject matter hereof and supersede all prior or contemporaneous negotiations, representations, warranties, understandings, and agreements between the parties, whether written or oral.

Severability. If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court or arbitral tribunal of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall continue in full force and effect.

Waiver. The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. Any waiver of any provision of these Terms shall be effective only if in writing and signed by the waiving party.

Assignment. You may not assign, transfer, or delegate any of your rights or obligations under these Terms without the prior written consent of the Provider. The Provider may assign its rights and obligations under these Terms to any affiliate or in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided that the assignee agrees to be bound by these Terms.

Force Majeure. Neither party shall be liable for any failure or delay in performing its obligations under these Terms if such failure or delay results from circumstances beyond the reasonable control of the affected party, including but not limited to natural disasters, pandemics, war, terrorism, civil unrest, government actions, internet or telecommunications failures, or third-party service provider outages.

Notices. All notices required or permitted under these Terms shall be in writing and shall be deemed delivered: (a) when delivered personally; (b) one (1) business day after deposit with a nationally recognised overnight courier; (c) five (5) business days after mailing by registered or certified mail, return receipt requested; or (d) on the date of transmission if sent by email to the addresses specified in the applicable commercial agreement or to info@ekama.lk for the Provider.

19. Contact Information

For any questions, concerns, or requests relating to these Terms of Service, data protection practices, or the Platform in general, please contact us at:

1. Scope & Applicability

This Privacy Policy applies to all individuals whose personal data is processed through the Platform, including but not limited to System Administrators, Security Supervisors, Security Officers, Employees subject to attendance verification, registered Visitors, and respondents of Customer Satisfaction Surveys. It applies whenever personal data is collected, recorded, organised, structured, stored, adapted, retrieved, used, disclosed, transmitted, or otherwise processed by or on behalf of an Institution using the Platform.

Each Institution operating on the Platform acts as an independent Data Controller in respect of the personal data of its personnel, visitors, and survey respondents. EKAMA acts as a Data Processor on behalf of each Institution and processes personal data only in accordance with the documented instructions of the relevant Institution and the terms of the applicable service agreement. This Privacy Policy should be read in conjunction with the EKAMA Terms of Service and any separate privacy notice issued by the Institution to its personnel.

2. Categories of Personal Data Processed

The Platform processes the following categories of personal data, depending on the modules activated by the Institution and the role of the data subject: (a) Identity & Contact Data, including full name, national identity card number, EPF/ETF number, employee number, designation, contact telephone number, and service phone identifier; (b) Account Credentials, including usernames, hashed passwords, role assignments, device identifiers, and session tokens; (c) Biometric Data, specifically facial photographs and facial geometry templates processed for AI-powered face verification during attendance marking; (d) Geolocation Data, including real-time GPS coordinates, patrol route paths, checkpoint scan locations, and attendance marking locations; (e) Incident Evidence, including photographs, voice recordings, textual descriptions, severity classifications, and GPS-tagged locations submitted through the incident reporting module; (f) Visitor Data, including visitor names, contact details, host information, QR check-in records, and satisfaction survey responses; and (g) Operational Metadata, including login timestamps, device registration records, audit logs, IP addresses, and user-agent strings.

The Platform does not knowingly process special categories of personal data other than biometric data, which is processed exclusively for the purpose of employee identity verification with explicit consent as described in Section 4 below. Where an Institution uploads any health, medical, or other special-category information into incident reports or free-text fields, that Institution is solely responsible for ensuring lawful processing under applicable data protection law.

3. Purposes & Legal Bases of Processing

The Platform processes personal data for the following purposes, each grounded in a corresponding legal basis under the Personal Data Protection Act No. 9 of 2022 and applicable international data protection law: (a) provisioning and administration of user accounts and role-based access, performed on the basis of the Institution's legitimate interests in operating its security workforce management function; (b) execution of an employment or service contract with the data subject, including attendance verification, payroll preparation, shift rostering, and compliance monitoring; (c) performance of legal obligations applicable to the Institution, including statutory employment records, occupational safety reporting, and incident investigation records required by law; (d) protection of the vital interests of the data subject or other persons, including emergency response, incident escalation, and lone-worker safety monitoring; (e) consent freely given by the data subject, specifically for biometric face verification, GPS tracking outside working hours where applicable, voice recording of incident evidence, and participation in customer satisfaction surveys; and (f) legitimate interests pursued by the Institution or Provider, including platform security, fraud prevention, service improvement, and generation of anonymised aggregate statistics, provided such interests are not overridden by the rights and freedoms of data subjects.

Where processing is based on consent, the data subject may withdraw consent at any time by notifying their Institution's System Administrator in writing. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Where processing is based on legitimate interests, the data subject has the right to object to such processing on grounds relating to their particular situation, as set out in Section 11 below.

4. Biometric Data Processing

The Platform's AI-Powered Attendance module captures and processes biometric data — specifically facial reference photographs and facial geometry templates — for the sole purpose of verifying employee identity during attendance marking. Biometric data is classified as a special category of personal data and is processed only where the data subject has given explicit, written, freely given, specific, informed, and unambiguous consent prior to enrolment. The Institution is responsible for obtaining and recording this consent and for providing the data subject with a clear, plain-language explanation of what the biometric processing involves, including the use of the OpenAI GPT-4o Vision API as a third-party AI processor.

Biometric data is encrypted at rest using AES-256 or equivalent standards and is encrypted in transit using TLS 1.2 or higher. Facial reference photographs are stored in a dedicated, access-controlled repository separate from other personal data, and access is restricted to authorised Platform personnel for the sole purpose of maintaining and securing the face verification service. Biometric data is retained for the duration of the employee's active association with the Institution and for a maximum period of twelve (12) months following termination of employment or de-enrolment, after which all biometric data is permanently and irreversibly deleted. The Provider does not use, sell, lease, or share biometric data for any purpose other than the identity verification function described herein, and does not allow third-party AI providers to retain or reuse biometric data for model training or any other purpose.

The face verification process uses a minimum confidence threshold of seventy-five percent (75%). Verification attempts falling below this threshold are automatically rejected. Data subjects have the right to refuse biometric enrolment, in which case the Institution must offer an alternative, non-biometric method of attendance verification that achieves the same legitimate purpose, where reasonably practicable.

5. GPS & Geolocation Data

The Platform collects, stores, and processes GPS data from Security Officer mobile devices during active patrol operations and from Employee devices during attendance marking. This data includes real-time location coordinates, patrol route paths, checkpoint scan locations, attendance marking locations, and associated timestamps. GPS data is processed for the purposes of: (a) verifying that Security Officers physically visit designated checkpoint locations during scheduled patrols; (b) enforcing GPS-gated attendance restrictions requiring employees to be within 100 metres of the registered institution; (c) generating GPS route replay, compliance reports, and historical audit trails; (d) providing real-time location visibility through the Live Monitor dashboard; and (e) investigating incidents and responding to emergencies affecting officer safety.

GPS data collection operates only while the officer or employee is using the Platform's mobile application in the course of their duties. The Platform does not track device location when the application is closed, backgrounded, or when the user is off-duty, except where the Institution has explicitly activated lone-worker safety monitoring and obtained the data subject's prior consent for such extended tracking. Each Institution must ensure that all Security Officers and Employees are informed of GPS data collection as a condition of using the Platform, and that any consent required by local employment or surveillance law is obtained and recorded. GPS data is retained for a period of ninety (90) days for active institutions and is purged upon Institution deactivation, unless a longer retention period is required by applicable law or a specific investigative hold.

6. Incident & Evidence Data

The Platform's Incident Management module allows Security Officers and authorised personnel to submit incident reports containing textual descriptions, photographic evidence, voice recordings, GPS-tagged locations, severity classifications, and investigation status records. This data may contain personal data of data subjects who are the subject of, witness to, or otherwise involved in the reported incident, including members of the public. Incident data is processed for the purposes of incident investigation, escalation, resolution, regulatory reporting where required, and the protection of the legitimate interests of the Institution, its personnel, and the public.

Photographic and voice evidence submitted through the incident module is encrypted at rest and access-controlled according to the Institution's role-based access configuration. The Institution is responsible for ensuring that any photograph or voice recording containing personal data of third parties is collected lawfully — for example, where the third party has consented, where collection is necessary for the performance of a legal obligation, or where collection is necessary for the establishment, exercise, or defence of legal claims. Incident data is retained for the duration of the Institution's active subscription plus a period of two (2) years following the closure of the incident, or such longer period as may be required by applicable law, regulatory requirement, or pending litigation.

7. Visitor & Survey Data

The Platform's Visitor Management and Customer Satisfaction Survey modules process personal data of visitors and survey respondents. Visitor data typically includes the visitor's name, contact details, host name, purpose of visit, check-in and check-out timestamps, and any QR code identifiers issued for the visit. Survey data includes responses submitted through token-secured feedback forms, which may include the respondent's name and contact details where voluntarily provided, alongside questionnaire responses, star ratings, choice selections, and free-text comments.

Visitor and survey data is processed on the basis of the Institution's legitimate interests in managing site access and assessing service quality, and — where the respondent's name or contact details are collected — on the basis of the respondent's explicit consent to provide that information. Token-secured survey links are designed so that the form locks permanently once submitted; respondents cannot amend responses after submission but may request rectification or erasure by contacting the Institution's System Administrator. Visitor data is retained for a period of twelve (12) months from the date of visit, and survey data is retained for a period of twenty-four (24) months from the date of submission, unless a longer period is required by applicable law.

8. Data Sharing & Third-Party Processors

The Provider does not sell, rent, lease, or trade personal data to any third party. Personal data is shared with third parties only where necessary to deliver the Service, where required by law, or where the data subject has consented. The categories of third-party processors engaged by the Provider include: (a) AI Vision Service Provider — OpenAI Corporation, located in the United States, engaged to provide the GPT-4o Vision API used for facial image comparison during attendance verification. Facial images are transmitted to OpenAI solely for the purpose of identity comparison and are not retained or used by OpenAI for any other purpose, including model training, in accordance with OpenAI's API data usage terms; (b) Mapping & Navigation Provider — Google LLC, engaged to provide Google Maps navigation and location visualisation features within incident investigation and live monitoring modules; (c) Email Transmission Providers — configured per Institution via SMTP, used to deliver automated reports, incident alerts, and survey invitations; (d) Cloud Hosting & Infrastructure Providers — engaged to provide server hosting, data storage, backup, and content delivery network services; and (e) Professional Advisors & Auditors — engaged for legal, accounting, security audit, or compliance purposes, bound by confidentiality obligations.

Each third-party processor is engaged under a written agreement that imposes confidentiality, security, and data protection obligations no less protective than those described in this Privacy Policy. The Provider remains accountable for the personal data processed on its behalf by such processors and conducts reasonable due diligence before engaging any new processor that will have access to personal data. Where a third-party processor is located outside Sri Lanka, the Provider ensures that an appropriate safeguard — such as standard contractual clauses, an adequacy decision, or explicit consent — is in place before any transfer occurs, as described in Section 9 below.

9. International Data Transfers

Personal data processed through the Platform may be transferred to, stored in, or processed in countries outside the data subject's country of residence, including but not limited to the United States (for OpenAI GPT-4o Vision API processing of facial images), Singapore, the European Union, and other jurisdictions where the Provider or its third-party processors maintain infrastructure. Where the recipient country is not recognised as providing an adequate level of data protection, the Provider ensures that appropriate safeguards are in place, including the execution of standard contractual clauses approved by the relevant supervisory authority, binding corporate rules, or the explicit, informed consent of the data subject.

Data subjects may request a copy of the safeguards relied upon for any international transfer by contacting the Provider using the details in Section 13 below. The Provider will, where reasonably practicable, minimise the volume of personal data transferred internationally and will prefer processors that offer regional data residency options where available.

10. Data Retention

The Provider retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce the Provider's agreements. The specific retention periods applicable to each category of personal data are: (a) Account credentials & audit logs — retained for the duration of the user's active account plus twelve (12) months following deactivation; (b) Biometric data — retained for the duration of the employee's active association plus a maximum of twelve (12) months following termination or de-enrolment; (c) GPS data — retained for ninety (90) days for active institutions; (d) Patrol compliance reports — retained for twenty-four (24) months from generation; (e) Attendance records — retained for the duration of the employment relationship plus seven (7) years to satisfy statutory employment and EPF/ETF record-keeping requirements; (f) Incident data — retained for two (2) years following closure of the incident; (g) Visitor data — retained for twelve (12) months from the date of visit; (h) Survey responses — retained for twenty-four (24) months from submission; and (i) Customer support communications — retained for three (3) years from the date of the communication.

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or aggregated in such a manner that it can no longer be used to identify a specific data subject. Where the Institution terminates its subscription, the Provider shall, within thirty (30) days of receiving a written data export request, provide the Institution with a machine-readable export of all Customer Data and shall securely delete such data, including biometric data, within ninety (90) days of completing the export, unless retention is required by applicable law.

11. Data Security Measures

The Provider implements appropriate technical, organisational, and physical security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Technical measures include: (a) encryption of personal data at rest using AES-256 or equivalent standards; (b) encryption of personal data in transit using TLS 1.2 or higher; (c) role-based access control (RBAC) applying least-privilege principles across all administrative interfaces; (d) single-device login enforcement for Security Officer accounts with remote Force Logout capability; (e) secure password hashing using industry-standard algorithms; (f) regular security audits, vulnerability assessments, and penetration testing; (g) web application firewall protection and continuous intrusion monitoring; and (h) secure session management with configurable timeout policies and refresh-token rotation.

Organisational measures include: (a) executed data processing agreements with all third-party processors; (b) confidentiality obligations binding all Provider personnel with access to personal data; (c) role-based access reviews conducted on a recurring basis; (d) documented incident response and breach notification procedures; (e) staff training on data protection, secure coding, and security awareness; and (f) segregation of duties between development, operations, and security functions. Physical measures include access-controlled data centre facilities operated by the Provider's hosting partners, with biometric entry, 24/7 monitoring, and environmental controls.

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure. The Provider does not guarantee absolute security of personal data, but commits to taking all reasonable steps to mitigate risk and to notifying affected Institutions and data subjects in accordance with Section 13 below in the event of a confirmed data breach.

12. Data Subject Rights

Data subjects have the following rights with respect to their personal data processed through the Platform, in accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka and applicable international data protection law: (a) Right of Access — to obtain confirmation as to whether personal data concerning them is being processed, and to obtain a copy of such personal data together with details of the processing purposes, categories of data, recipients, retention period, and the source of the data; (b) Right to Rectification — to request the correction of inaccurate or incomplete personal data without undue delay; (c) Right to Erasure — to request the deletion of personal data where the data is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and no other legal basis applies, where the data subject has objected to processing and there are no overriding legitimate grounds, or where the data has been processed unlawfully; (d) Right to Restriction of Processing — to request the restriction of processing where the accuracy of the data is contested, where processing is unlawful but the data subject opposes erasure, where the data is no longer needed but the data subject requires it for the establishment, exercise, or defence of legal claims, or where the data subject has objected to processing pending verification of whether the Provider's legitimate grounds override those of the data subject; (e) Right to Data Portability — to receive personal data concerning them in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible; (f) Right to Object — to object to processing based on legitimate interests or performed for direct marketing, on grounds relating to their particular situation; (g) Right to Withdraw Consent — to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and (h) Right to Lodge a Complaint — to lodge a complaint with the competent data protection supervisory authority, in particular in the jurisdiction of their habitual residence or place of alleged infringement, if they consider that the processing of their personal data infringes applicable data protection law.

Data subjects may exercise any of these rights by submitting a written request to their Institution's System Administrator or directly to the Provider using the contact details in Section 13 below. The Provider or Institution will respond to verified requests within thirty (30) days of receipt, with the possibility of extending this period by a further sixty (60) days where the request is complex or numerous, in which case the data subject will be informed of the extension and the reasons for it within the initial thirty (30) day period. The Provider may request reasonable information necessary to verify the identity of the data subject before responding to a request, and may refuse to act on requests that are manifestly unfounded or excessive.

13. Data Breach Notification

In the event of a personal data breach — meaning a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — the Provider shall promptly assess the severity of the breach and take all reasonable steps to contain it, mitigate its effects, and restore the security of the affected systems. Where the breach is likely to result in a risk to the rights and freedoms of data subjects, the Provider shall notify the affected Institution(s) without undue delay and in any case within seventy-two (72) hours of becoming aware of the breach, providing a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects.

The Institution shall, in turn, be responsible for notifying affected data subjects and the competent data protection supervisory authority where required by applicable law, taking into account the severity of the breach and the likelihood of harm to data subjects. Where the Provider has implemented appropriate technical and organisational protection measures that render the breached data unintelligible to unauthorised persons — for example, where all affected personal data was encrypted at rest with strong, industry-standard encryption — the Provider may, in accordance with applicable law, determine that notification to data subjects is not required. The Provider shall maintain a written record of all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken, regardless of whether notification to data subjects or authorities is required.

14. Cookies & Local Storage

The Platform uses minimal client-side storage to deliver core functionality. Specifically: (a) a language preference cookie named lang is set when a user selects a language via the URL parameter or language selector, persisting the user's language choice for one (1) year across sessions. This cookie is HTTP-only, SameSite=Lax, and is transmitted only over HTTPS in production deployments; (b) session tokens may be stored as cookies or in browser sessionStorage to maintain authenticated user sessions; and (c) local UI preferences such as dark/light theme selection may be persisted in browser localStorage.

The Platform does not use third-party advertising, marketing, or analytics cookies. The Provider does not engage in cross-site tracking, behavioural profiling, or targeted advertising. Where a user wishes to clear all Platform-related client-side data, they may do so at any time through their browser's privacy settings, with the understanding that this may require them to re-select their language preference and re-authenticate on their next visit.

15. Children's Privacy

The Platform is not directed at, and is not intended for use by, individuals under the age of eighteen (18) years. The Provider does not knowingly collect personal data from children. Security Officers, Employees, Visitors, and Survey Respondents are required to be of legal age under the laws of the jurisdiction in which they operate. Where an Institution employs individuals who have reached the age of legal employment but are under the age of eighteen, the Institution is solely responsible for obtaining any parental or guardian consents required by applicable law before enrolling such individuals in the Platform, and for ensuring that any biometric processing or GPS tracking of such individuals complies with the heightened protections that may apply to minors under applicable data protection law.

If the Provider becomes aware that personal data of a child has been collected without verifiable parental consent or in violation of applicable law, the Provider shall take reasonable steps to delete such data as soon as practicable. Concerns about children's privacy on the Platform may be reported to the Provider using the contact details in Section 17 below.

16. Changes to This Privacy Policy

The Provider reserves the right to update or amend this Privacy Policy at any time to reflect changes in the Platform's features, applicable data protection law, or the Provider's data processing practices. Material amendments — meaning changes that affect the categories of personal data processed, the purposes of processing, the legal bases relied upon, the recipients of personal data, the retention periods, or the rights of data subjects — shall be communicated to all registered administrative contacts via email at least fifteen (15) days before the effective date of such amendments. Non-material amendments, including corrections of typographical errors, clarifications, and updates to reflect minor feature enhancements, may be implemented with less notice.

The "Last Updated" date at the top of this Privacy Policy indicates the date of the most recent revision. Data subjects are encouraged to review this Privacy Policy periodically. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. Where a data subject does not agree to an amended Privacy Policy that materially affects the processing of their personal data, they should contact their Institution's System Administrator or the Provider before the effective date of the amendment to discuss available options, which may include withdrawal of consent for affected processing activities.

17. Contact & Data Protection Officer

For any questions, concerns, requests, or complaints relating to this Privacy Policy, the processing of personal data through the Platform, or the exercise of data subject rights, please contact the Provider's designated Data Protection Officer using the details below. The Data Protection Officer is responsible for overseeing data protection compliance within the Provider's organisation and serves as the primary point of contact for data subjects, Institutions, and supervisory authorities on matters relating to the processing of personal data.

Before responding to any data subject request, the Provider may request reasonable information necessary to verify the identity of the requester and to locate the relevant personal data within the Platform. Where a request is complex or made at high volume, the Provider may extend the response period in accordance with applicable law and will inform the data subject of any such extension and the reasons for it.