Biometric Information Privacy Policy

1. Scope

This policy applies to QRCodeKey's optional face verification feature, operated by Jal Technology LLC (the "Company", "we"). It governs the collection, use, retention, and destruction of biometric identifiers and biometric information ("biometric data") of end users ("members") who use that feature, and supplements (but does not replace) the QRCodeKey Privacy Policy.

2. Definitions

• • Biometric identifier: a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry (per BIPA §10).
• • Biometric information: any information, regardless of form, based on a biometric identifier used to identify an individual.
• • Member: the end user (employee, student, attendee) whose face is enrolled.
• • Organization: the Data Controller / Data Fiduciary that operates an account on QRCodeKey and enrolls its members.
• • Reference template: the mathematical encoding of facial geometry stored at enrollment.
• • Verification image: the selfie captured at the moment of attendance, compared against the reference template.

3. Biometric data we collect

When the face verification feature is enabled by an organization and the member provides written informed consent, we collect:

• • A reference photo (at enrollment) and/or a derived facial geometry template;
• • Verification selfies captured at each attendance event;
• • A confidence score and the timestamp of each verification.

We do NOT collect any other biometric identifier (fingerprints, voiceprints, retina/iris, hand geometry, DNA, etc.).

4. Purpose of collection

Biometric data is collected solely to:

• • Verify that the person presenting at attendance is the enrolled member;
• • Prevent proxy attendance fraud;
• • Provide an audit trail of attendance events for the organization.

We do NOT use biometric data for advertising, marketing, profiling, behavioural prediction, sale, lease, trade, or to train any third-party AI model. Biometric data is never transferred to advertising networks, data brokers, social media, or analytics providers.

5. Written informed consent

In compliance with BIPA §15(b), we obtain written consent from each member before collecting any biometric data. Our enrollment workflow:

1. 1. Presents this Biometric Privacy Policy and a summary of what is being collected, the purpose, and the retention period.
2. 2. Requires the member (or parent/guardian if a minor) to affirmatively check three independent consent statements covering disclosure, retention, and voluntariness.
3. 3. Records the consent action with timestamp, IP address, user-agent, consent policy version, and consenting user identity. This audit record is retained for legal defense purposes.
4. 4. Only then accepts the reference photo and creates the biometric record.

Minors: for any member under 18, the consent screen requires the parent or legal guardian's name and relationship to the minor. The DPDP Act 2023 (India) and various state laws require verifiable parental consent.

8. No sale, lease, or trade

In compliance with BIPA §15(c), we do NOT sell, lease, trade, or otherwise profit from a member's biometric data. Biometric data is never used as consideration in any commercial transaction.

9. Disclosure to third parties

In compliance with BIPA §15(d), we do NOT disclose, redisclose, or otherwise disseminate biometric data unless one of the following applies:

• • The member or their legally authorized representative consents in writing to the disclosure;
• • Disclosure completes a financial transaction the member requested;
• • Disclosure is required by federal, state, or municipal law, ordinance, or regulation;
• • Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Sub-processors: biometric data is processed by infrastructure sub-processors strictly necessary to operate the service: MongoDB Atlas (encrypted database), Render (hosting). Each is bound by a Data Processing Agreement and may not use biometric data for any other purpose.

10. Storage and security

In compliance with BIPA §15(e), we store, transmit, and protect biometric data using the reasonable standard of care within our industry, in a manner that is the same as or more protective than the manner in which we store, transmit, and protect other confidential and sensitive information. Specifically:

• • Encryption at rest (AES-256) in MongoDB Atlas;
• • Encryption in transit (TLS 1.2 or higher);
• • JWT-authenticated API access with role-based authorization;
• • Audit logs of every read/write to biometric records;
• • Strict access controls limiting biometric data access to authenticated backend services only;
• • Regular security reviews and key rotation;
• • Sub-processors selected for SOC 2 / ISO 27001 compliance where available.

11. Your rights

• • Right to know: request a description of the biometric data we hold about you and how it is processed.
• • Right to withdraw consent: revoke biometric consent at any time. Upon withdrawal, biometric data is deleted within 30 days.
• • Right to deletion: request immediate deletion of biometric data even before retention expires.
• • Right to receive these guidelines: request a copy of this policy in PDF or other format.
• • Right to lodge a complaint: with the Illinois Attorney General, the FTC, your state regulator, an EU Data Protection Authority, the Data Protection Board of India, or other competent authority.

To exercise any of these rights, contact us at privacy@qrcodekey.com or use the in-app "Withdraw Biometric Consent" option in your account settings.

12. Roles: organization vs QRCodeKey

When an organization (employer, school, event operator) enables face verification and enrolls its members, the organization is the Data Controller (GDPR) / Data Fiduciary (DPDP Act). The organization is responsible for obtaining all necessary consents from members, for ensuring that local labour, education, and consumer laws are followed, and for providing notices to its members.

QRCodeKey acts as a Data Processor on behalf of the organization, governed by our Data Processing Agreement (available on request). We provide consent capture tools, secure storage, and deletion mechanisms to support the organization's compliance.

13. Changes to this policy

When we materially change this policy we will increment the version number and require members to re-consent before further use of the face verification feature. Old consent records remain in our audit log alongside the new version, preserving the consent trail.