Privacy Policy

Effective Date: 1st November 2026 · Last Updated: 1st November 2026

1. Introduction

FACILIX ("we", "our", "us" or "Platform") is committed to protecting the privacy and personal data of individuals who access or use our website, software, applications and associated services.

FACILIX is a digital checklist management and property performance platform that enables organisations to conduct inspections, manage observations, assign corrective actions, monitor closures and evaluate the operational performance of properties and sites.

In providing these services, we may process personal data relating to:

Customers and organisational representatives.
Employees and facility management personnel.
Supervisors and inspectors.
Housekeeping and security personnel.
Technicians and maintenance staff.
Contractors and authorised third parties.
Website visitors and prospective customers.

This Privacy Policy explains what information we collect, how we use it, when we share it, how we protect it and how individuals can exercise their privacy rights.

This Policy is intended to align with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") and other applicable Indian laws, subject to their respective commencement and applicability.

2. Roles and Responsibilities Under the DPDP Act

The role FACILIX performs depends on the purpose for which personal data is processed.

2.1. FACILIX as a Data Processor

When an organisation uses FACILIX to manage its site inspections, employee activities, contractor information, operational checklists, photographs and performance records, that organisation generally determines the purpose and means of processing.

In such circumstances:

The Customer generally acts as the Data Fiduciary.
FACILIX generally acts as the Data Processor.
The Customer is responsible for establishing a lawful basis for processing and providing appropriate notices.
FACILIX processes personal data on the Customer's documented instructions and for the provision of contracted services.

2.2. FACILIX as a Data Fiduciary

FACILIX may independently determine the purpose and means of processing personal data for activities such as:

User registration and account administration.
Subscription management and billing.
Customer support and communication.
Platform security and fraud prevention.
Website enquiries and business development.
Compliance with applicable legal obligations.

For these activities, FACILIX acts as the Data Fiduciary, where applicable.

3. Personal Data We Collect

Depending on how the Platform is used, we may collect the following categories of information.

3.1. User and Account Information

Full name.
Business email address.
Mobile number.
Designation and job title.
Organisation or company name.
Department and assigned role.
Username and account identifiers.
Authentication and access-related information.

3.3. Photographs and Documents

Users may upload:

Inspection photographs.
Images of equipment, infrastructure and facilities.
Photographs containing employees or contractors.
Supporting documents.
Inspection reports.
Audit records.
Other operational attachments.

Customers and Users should avoid uploading unnecessary personal or sensitive information through photographs and documents.

3.4. Technical and Usage Information

We may collect:

IP address.
Device and browser information.
Login timestamps.
Session information.
Application usage records.
System logs.
Error reports.
Security and access logs.

3.5. Commercial Information

Where applicable, we may collect:

Company billing details.
Subscription information.
Transaction references.
Purchase orders.
GST and invoicing details.
Customer communication records.

3.6. Workforce Attendance Information

FACILIX collects and processes attendance-related information of employees, contract workers, supervisors, technicians and other authorised personnel using the Platform.

Depending on the features enabled by the Customer, information collected may include:

Employee name and employee identification number.
Mobile number and other registration details.
Date and time of check-in and check-out.
Attendance status, including present, absent, late arrival and early departure.
Assigned site, property and work location.
GPS coordinates captured during attendance registration.
Selfie photographs submitted for attendance verification.
Device and application information.
Attendance approval, modification and audit records.

We do not intend to collect financial authentication credentials such as card PINs or banking passwords through the Platform.

4. Purpose of Data Collection and Processing

4.1. Purpose of Processing Attendance Information

Attendance information may be processed for the following purposes:

Recording employee and contract workforce attendance.
Monitoring site-wise workforce deployment.
Verifying employee presence at assigned locations.
Maintaining check-in and check-out records.
Managing shifts and attendance schedules.
Identifying attendance discrepancies.
Generating attendance reports and management dashboards.
Supporting payroll preparation and contractor billing by Customers.
Maintaining attendance audit trails and dispute records.
Preventing unauthorised attendance entries and misuse of the Platform.

We process personal data for legitimate and specified purposes, including:

Purpose	Information used
User registration	Name, email, mobile number and account details
Authentication	Login credentials and access logs
Checklist management	User details, checklist responses and inspection records
Site inspections	Inspection information, photographs and observations
Corrective action management	Assigned personnel, issues and closure records
Performance monitoring	Inspection scores, KPI data and performance reports
Notifications	Email address, mobile number and communication preferences
Customer support	Contact details and support communications
Billing and subscriptions	Commercial and invoicing information
Security and fraud prevention	Device, access and system logs
Legal compliance	Information required under applicable laws

We will not intentionally process personal data for unrelated purposes without an appropriate lawful basis and where required, additional notice and consent.

FACILIX processes such information for the purposes configured and authorised by the Customer, subject to applicable law and contractual arrangements.

5. Consent and Lawful Processing

5.1. Where consent is the applicable lawful basis, personal data will be processed after obtaining valid consent in accordance with applicable law.

5.2. Consent requests will identify the relevant categories of personal data and the specific purposes for which they are processed.

5.3. Individuals may withdraw consent through the available mechanisms, subject to applicable legal requirements.

5.4. Withdrawal of consent may affect the availability of certain services or functionalities where the relevant processing is necessary for their provision.

5.5. Where FACILIX processes data on behalf of a Customer, the Customer is responsible for obtaining the necessary consent or establishing another lawful basis for such processing.

5.6. FACILIX may process information without consent where permitted or required by applicable law.

6. Photographs, Inspection Records and Employee Information

6.1. GPS-Based Location Capture

FACILIX uses GPS-based location functionality to help Customers verify the physical presence of employees and contract workers at their assigned sites or properties.

When an employee records attendance through the Platform:

The application may access the device's location services.
GPS coordinates may be captured at the time of check-in and/or check-out.
The captured location may be compared with the designated site or property's location.
Location information may be recorded alongside the employee's attendance timestamp.
Authorised Customer administrators and supervisors may access this information for attendance verification and workforce monitoring.

GPS information is collected for attendance verification and related operational purposes.

FACILIX does not intend to continuously track employees' locations throughout the day. Location information is collected in connection with attendance activities, subject to device permissions and the functionality enabled.

Employees should ensure that location services and the necessary application permissions are enabled when recording attendance.

6.2. Selfie-Based Attendance Verification

FACILIX provides selfie-based attendance functionality to help Customers verify the identity and presence of employees recording attendance.

When using this functionality:

Employees may be required to capture and submit a photograph through the FACILIX application during check-in and/or check-out.
The photograph may be stored alongside the employee's attendance record.
The photograph may be reviewed by authorised supervisors, administrators or other designated personnel.
The photograph may be used to verify attendance entries, investigate discrepancies and maintain attendance records.

Selfie photographs constitute personal data when they identify or can identify an individual.

Such information shall not be used for unrelated purposes without an appropriate lawful basis and where required, additional notice and consent.

FACILIX does not represent that ordinary selfie capture automatically constitutes biometric authentication or facial recognition. Any future facial recognition functionality would require separate assessment, appropriate disclosures and applicable legal safeguards.

Customers are responsible for informing employees and contract workers about selfie-based attendance verification before enabling this functionality.

FACILIX processes such information according to the applicable Customer instructions and contractual arrangements.

FACILIX does not intend the Platform to be used for unlawful employee surveillance, unauthorised monitoring or unrelated profiling.

6.3. Purpose of GPS and Selfie Data Processing

GPS coordinates and selfie photographs may be processed for the following purposes:

Verifying employee presence at assigned sites.
Preventing proxy or fraudulent attendance entries.
Recording check-in and check-out activities.
Monitoring workforce deployment across properties.
Maintaining attendance records and audit trails.
Resolving attendance discrepancies and disputes.
Supporting attendance reports and management information systems.
Supporting payroll preparation and contractor billing by Customers, where applicable.

6.4. GPS-Based Location Tracking for Inspections and Checklists

FACILIX provides GPS-enabled checklist and inspection functionality to help Customers verify that inspections and operational activities are conducted at their designated properties, buildings or sites.

When an authorised User performs an inspection or completes a digital checklist through the Platform:

The application may access the device's location services.
GPS coordinates may be captured at the time of inspection or checklist submission.
The captured location may be associated with the relevant checklist, inspection record, date and timestamp.
Location information may be used to verify that the inspection was conducted at the assigned property or designated location.
Authorised Customer administrators and supervisors may access location information as part of inspection verification, audit trails and operational performance monitoring.

GPS information collected through inspection and checklist activities is used for site verification, operational accountability and performance monitoring.

FACILIX does not intend to continuously track an individual's location throughout the day. Location information is collected in connection with specific attendance, inspection or checklist activities, subject to device permissions and the functionality enabled.

Customers are responsible for informing their employees, inspectors, contractors and other authorised Users about GPS-enabled inspection and checklist functionality before its use.

7. Sharing and Disclosure of Information

FACILIX does not sell personal data to third parties. Personal data may be shared in the following circumstances:

7.1. With Customers and Their Authorised Users

Inspection information, reports, photographs, assigned observations and performance records may be accessible to authorised Customer administrators, supervisors, inspectors and other designated personnel.

7.2. Technology and Service Providers

We may engage third-party providers for:

Cloud hosting and infrastructure.
Database management.
Email and SMS delivery.
WhatsApp communication, where enabled.
Authentication and security.
Analytics and monitoring.
Payment processing.
Technical support.

Such providers may process personal data on our behalf under appropriate contractual and security arrangements.

7.3. Legal and Regulatory Authorities

Information may be disclosed where required by applicable law, a court order, government authority or other legally enforceable request.

7.4. Business Transactions

In the event of a merger, acquisition, restructuring or transfer of business assets, relevant information may be transferred subject to applicable legal requirements and appropriate safeguards.

8. Data Storage and Retention

8.1. Access to Attendance Information

GPS records, selfie photographs and other attendance information may be accessed by authorised Customer administrators, HR personnel, facility managers, site supervisors and other designated personnel based on their assigned access permissions.

FACILIX shall implement appropriate access controls to restrict unauthorised access to such information. Customers are responsible for ensuring that attendance information is accessed and used only for authorised business and operational purposes.

8.2. FACILIX retains personal data only for as long as necessary for the purposes for which it was collected or processed, subject to applicable legal and contractual requirements.

8.3. Customer Data may be retained during the subscription period and for an agreed period following termination to facilitate reporting, export, contractual closure and deletion.

8.4. Account and billing information may be retained for periods required by applicable tax, accounting and other legal obligations.

8.5. Security logs and other records shall be retained in accordance with applicable legal requirements.

8.6. Where applicable, personal data and associated logs may need to be retained for prescribed minimum periods, including the one-year period specified under the relevant DPDP Rules.

8.7. Upon expiry of the applicable retention period, personal data shall be securely erased or anonymised, unless further retention is required by law or for the establishment, exercise or defence of legal claims, as applicable.

8.8. Customers are responsible for configuring appropriate retention arrangements for their operational records.

9. Data Security

9.1. Retention of GPS and Selfie Attendance Records

GPS coordinates, selfie photographs and associated attendance records shall be retained for the period necessary to fulfil the specified purposes, subject to applicable contractual, employment and statutory retention requirements.

Customers are responsible for defining appropriate retention requirements for employee attendance records.

Upon expiry of the applicable retention period, such information shall be securely erased or anonymised, unless further retention is required or permitted under applicable law.

FACILIX takes reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, destruction or loss.

Depending on the system architecture and applicable service configuration, safeguards may include:

Role-based access controls.
User authentication mechanisms.
Secure communication protocols.
Encryption or other appropriate data protection measures.
Access monitoring and system logs.
Backup and recovery procedures.
Restricted administrative access.
Security reviews and vulnerability management.
Appropriate contractual safeguards with service providers.

No electronic system or internet-based transmission can be guaranteed to be completely secure.

Customers and Users are responsible for maintaining secure passwords, restricting account access and promptly reporting suspected unauthorised activity.

10. Personal Data Breach Management

In the event of a personal data breach affecting information processed by FACILIX, we will:

Investigate the incident.
Take reasonable steps to contain and mitigate its impact.
Inform the relevant Customer where FACILIX is acting as a Data Processor, in accordance with applicable contractual arrangements and legal requirements.
Provide reasonable assistance to enable the Customer to meet its notification obligations.
Make notifications to affected individuals and relevant authorities where FACILIX is legally required to do so.
Maintain appropriate incident records.

Where a Customer acts as the Data Fiduciary, the Customer remains responsible for its statutory notification obligations, with assistance from FACILIX as required under the applicable agreement.

11. Rights of Individuals Under the DPDP Act

Subject to the applicability of the DPDP Act and its Rules, individuals may have the following rights.

11.1. Individual Rights and Attendance Data

Employees and other individuals whose attendance information is processed through FACILIX may exercise applicable rights under the DPDP Act, 2023, including rights relating to access, correction, completion, updating, erasure, grievance redressal and withdrawal of consent, subject to applicable legal requirements.

Where FACILIX processes attendance information on behalf of a Customer, individuals should generally approach the relevant Customer, acting as the Data Fiduciary, to exercise these rights.

FACILIX will provide reasonable assistance to the Customer in responding to such requests in accordance with the applicable contractual arrangements and law.

11.2. Right to Correction and Erasure

Individuals may request correction, completion or updating of inaccurate personal data and erasure of personal data where legally permissible.

11.3. Right to Withdraw Consent

Individuals may withdraw consent previously provided for processing their personal data. Withdrawal shall not affect the lawfulness of processing undertaken before withdrawal.

11.4. Right to Grievance Redressal

Individuals may raise complaints regarding the processing of their personal data through the contact details provided in this Policy.

11.5. Right to Nominate

Individuals may nominate another person to exercise their rights in accordance with the applicable DPDP Act and Rules.

11.6. Exercising Rights Where FACILIX Is a Data Processor

Where personal data is processed on behalf of a Customer, individuals should generally approach the relevant Customer or employer acting as the Data Fiduciary.

FACILIX will provide reasonable assistance to the Customer in handling such requests, as required under the applicable agreement and law.

12. Cookies and Similar Technologies

The FACILIX website or application may use cookies and similar technologies to:

Maintain login sessions.
Improve platform functionality.
Understand website usage.
Monitor application performance.
Enhance security.
Remember user preferences.

Where required, consent will be obtained before using non-essential cookies or similar tracking technologies.

Users may manage cookie preferences through available browser or platform settings. Disabling certain cookies may affect functionality.

13. Third-Party Links and Integrations

FACILIX may contain links to third-party websites, applications or integrated services.

Such third parties operate under their own privacy policies and terms.

FACILIX does not control the independent privacy practices of such services and encourages Users to review their respective policies before sharing information.

14. Data Processing Outside India

FACILIX may use cloud infrastructure or service providers that process or store information outside India.

Where applicable, such processing and transfers shall be subject to the DPDP Act, the DPDP Rules, government restrictions and other applicable Indian legal requirements.

FACILIX will take reasonable steps to ensure appropriate contractual and security safeguards are maintained.

15. Children's Personal Data

FACILIX is designed primarily for business and organisational use and is not intended for independent use by children.

Customers should not create accounts for children or upload children's personal data unless such processing is legally permitted and all applicable requirements, including verifiable parental consent where required, have been fulfilled.

16. Changes to This Privacy Policy

FACILIX may periodically update this Privacy Policy to reflect changes in the Platform, business operations, technology or applicable laws.

Material changes will be communicated through the website, application or registered communication channels wherever reasonably practicable.

The updated Policy shall become effective from the date specified in the revised version.

17. Contact and Grievance Redressal

For questions, requests, complaints or concerns relating to personal data processing, individuals may contact:

Privacy and Grievance Contact – FACILIX
Email: hello@facilink.co.in
Website: www.facilix.in
Registered Office: B-609, Raj Tower CHS, I.C. Colony, Borivali West,
Mumbai, Maharashtra, India – 400103

Please include sufficient information to help us identify the relevant account or processing activity. We may request reasonable verification of identity before acting on a request.

We will acknowledge and address grievances within the applicable timelines prescribed under the law and applicable contractual arrangements.

18. Applicable Law

This Privacy Policy shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent applicable and in force.