SOJA TA Website Privacy Policy

1. Scope of This Policy & Roles

This policy applies exclusively to data collected via the SOJA TA web platform.

• Identigate as a Data Processor: When providing the SOJA TA service, we act strictly as a data processor on behalf of your employer (the Data Controller). Your employer determines the purpose and specific parameters of data collection.
• Identigate as a Data Controller: We act as a data controller only for technical data collected directly from web visitors browsing our marketing and informational web pages.

2. Categories of Data We Process

A. Data Provided by Subscribing Organizations and Employees

To facilitate labor tracking, payroll integration, and shift management, the platform processes:

• Identity Information: Full names, department allocations, designations, employee numbers, and system user roles.
• Contact Details: Professional email addresses and mobile telephone numbers.
• Attendance & Scheduling Logs: Shift schedules, clock-in/out timestamps, break logs, and status updates (e.g., Late, Incomplete, or Missed lessons/shifts).
• Biometric Templates: Encrypted mathematical vectors derived from biometric registrations. Note: Raw biometric images are processed locally on input terminals and are deleted immediately after template extraction; they are never transmitted to or stored on our web servers.

B. Technical Data Collected Automatically (Website Visitors)

When you browse the SOJA TA web interface, we automatically log:

• IP addresses, browser types, operating systems, referring URLs, and website interaction metrics via cookies. On this public website these metrics are collected using Google Analytics cookies; see Section 5 for details of that processing.

3. Lawful Bases for Processing

Processing activities conducted through the SOJA TA web platform are validated under the following legal frameworks:

• Contract Performance: Enabling your employer to execute employment contracts, calculate exact billable hours, and ensure seamless data synchronization with internal HRMS platforms (such as ESS Sunlax).
• Legitimate Interest: Preventing "buddy punching," protecting company assets, and ensuring capacity optimization across field offices.
• Legal Obligation: Complying with labor laws and maintaining accurate employment records required by regional statutes.

4. Technical Security Framework

We employ rigorous security standards to maintain data integrity:

• Encryption in Transit: All communications between biometric terminals, user web browsers, and our central server are secured using HTTPS, SSL, and TLS protocols.
• Encryption at Rest: Technical data at rest is isolated and locked using Transparent Data Encryption (TDE) with restricted database access.
• Role-Based Controls: Access to management dashboard views is restricted by roles, ensuring users only interact with data matching their official operational permissions.

5. Data Sharing and Third-Party Disclosures

Identigate does not sell or lease personal data to commercial third parties. Data disclosure is limited to:

• Your Employer: Authorized system administrators and HR managers retain full ownership and access rights to organizational datasets.
• Authorized Sub-Processors: Technical partners providing cloud hosting infrastructure or automated SMS/WhatsApp gateway services required for system alerts.
• Website Analytics: Google Analytics processes website usage data — including IP address, device and browser characteristics, referring URLs, and pages viewed — on our behalf, so that we can understand how this website is used. This applies solely to visitors of this public website and does not extend to workforce records held within the SOJA TA platform. Google’s handling of this data is governed by its Privacy Policy.
• Legal Compliance: Disclosures required to satisfy valid legal mandates, court orders, or statutory regulatory directives in accordance with the laws of Kenya or Uganda.

6. Rights of the Data Subject

Depending on your location, you hold specific rights under Kenya’s Data Protection Act, Uganda’s Data Protection and Privacy Act, or GDPR:

• The right to access your processed attendance history.
• The right to request the rectification of inaccurate operational logs.
• The right to object to processing or file inquiries regarding automated metrics.