Biometric Data & DPDP Act 2023 Compliance Policy

1. Mathematical Vector Non-Reversibility Principle

Curiosity HUB operates on a privacy-by-design architecture. When an employee enrolls their face via webcam or mobile token, our computer vision pipeline extracts a 128-dimensional floating-point Euclidean vector embedding (representing spatial landmark distances such as inter-pupillary distance, jawline curvature, and nasal bridge geometry). It is mathematically impossible to reconstruct, reverse-engineer, or render a human photograph from this vector blob.

2. Compliance with India's Digital Personal Data Protection Act (DPDP Act 2023)

Under the DPDP Act 2023, employers act as Data Fiduciaries and Curiosity HUB acts as a Data Processor. We implement strict safeguards:

• Specific Purpose Limitation: Biometric vectors are processed exclusively to verify workplace attendance, shift punctuality, and calculate authorized salary compensation.
• Tenant Data Isolation: Biometric vectors are encrypted at rest using AES-256 and strictly segregated via relational tenant_id foreign keys. Cross-tenant vector matching is programmatically prohibited.
• Right to Erasure / Revocation: When an employee departs an organization or an administrator deletes an employee record, their associated biometric face vector blobs and enrolled samples are permanently deleted from database storage and in-memory caches.

3. Anti-Spoofing & Liveness Gating

To protect employees from identity theft and unauthorized proxy clock-ins, our platform employs 2D Fast Fourier Transform (FFT) spectral frequency analysis and temporal micro-motion analysis. Printed photos, digital screens, and video replay attacks are detected and blocked instantly without storing intermediate video frames.

4. Data Storage & Sovereignty

All customer databases, attendance ledgers, and facial vector embeddings are hosted on secure AWS cloud infrastructure located within the Indian territory (AWS Mumbai Region), fulfilling national data residency requirements.

5. Contact Data Protection Officer

For inquiries regarding biometric privacy, consent withdrawal, or DPDP Act compliance, contact:
Data Governance Officer, Curiosity HUB
Email: curiosityhubahd@gmail.com • Telephone: +91-8866868245
Ahmedabad, Gujarat, India.