Biometric Data Collection Consent

Version: 1.2 Effective Date: January 1, 2026 Last Updated: September 1, 2026

---

About This Consent

Commando 360 uses facial recognition technology to verify the identity of personnel during shift attendance. This document explains what biometric data we collect, how we protect it, and what rights you have.

Your consent is required before any biometric data collection occurs. You have the right to refuse biometric enrollment, though this may affect your ability to use certain features of the platform.

We use access, transport, storage, and retention safeguards for biometric data. We do not sell, lease, trade, or otherwise profit from biometric data. Authorized service providers may process it only to provide, secure, support, or legally administer the Service.

---

1. What Biometric Data We Collect

When you use the Commando 360 mobile application for identity verification, we collect the following:

Facial Geometry Data: A mathematical template or descriptor derived from facial features and used to compare an enrollment image with a verification image.

Facial Photographs: Images captured during enrollment and each verification event. These provide a visual audit trail for attendance records.

Liveness Detection Data: Technical analysis confirming you are a live person rather than a photograph or video. This prevents spoofing attempts.

Limited Verification Metadata: Event time and type, result status, and technical identifiers needed to secure, diagnose, and audit a verification event.

---

2. Why We Collect Biometric Data

We collect biometric data exclusively for enrollment, identity verification, attendance management, fraud prevention, and protected-site security. Specifically:

Biometric verification confirms identity during enrollment, shift check-in and check-out, and, when configured by your organization, periodic attendance checks, manager spot check-ins, and patrol-route checkpoints. This prevents time theft and "buddy punching" (having another person clock in on your behalf), ensures accurate attendance records, and maintains security at protected sites where you may be assigned.

We do not use your biometric data for any other purpose. We do not use it for surveillance, advertising, marketing, tracking, profiling, or any purpose unrelated to attendance verification. Any new use of biometric data would require separate written consent from you.

---

3. How Biometric Data Is Collected

Initial Enrollment

1. You will be prompted to scan your face using your device's camera
2. Multiple angles may be captured to create an accurate template
3. A liveness check verifies you are a real person
4. Your face descriptor template is generated and securely stored

Ongoing Verification

1. During check-in, check-out, or another configured verification event, a photo is captured
2. The photo is compared against your stored template
3. A match confidence score determines verification success
4. The verification photo is stored for audit purposes

---

4. How We Protect Your Biometric Data

Technical Safeguards

• Encrypted Transport: HTTPS/TLS for supported network connections
• Stored-Data Protection: Provider-managed encryption at rest and private storage where applicable
• Access Controls: Role- and attribute-based application controls limiting access to authorized purposes
• Logging: Security and activity logging for selected biometric events and systems

Storage Location

The production biometric database and private object storage are hosted through Supabase in the ap-south-1 (Mumbai, India) region. Facial data is protected in transit using HTTPS/TLS and at rest using Supabase's provider-managed storage protections. Supabase may process limited request, security, or support data from other locations under its applicable service terms, as described in the Privacy Policy.

---

5. Who Can Access Your Biometric Data

Access to your biometric data is strictly limited to:

Your employer or organization does NOT have direct access to your facial geometry templates. Face data is not sold or shared for third-party advertising.

---

6. How Long We Keep Your Biometric Data

After the applicable retention period, biometric data is scheduled for deletion in accordance with the applicable biometric notice and law. Limited residual copies may remain temporarily in protected backups or provider lifecycle systems where permitted by law.

---

7. Sharing and Disclosure

We Will NOT:

• Sell your biometric data
• Lease your biometric data
• Trade your biometric data
• Share your biometric data with third parties for their own purposes

Limited Exceptions:

We may disclose biometric data only if:

1. You provide separate written consent
2. Required by valid legal process (court order, subpoena)
3. Required by law enforcement with proper authorization
4. Necessary to protect life or safety in emergencies

Supabase stores and processes biometric data solely as Commando 360's contracted database and object-storage infrastructure provider. It may not use the data for its own advertising or marketing purposes.

---

8. Your Rights

You have the following rights regarding your biometric data:

Note: Withdrawing consent may affect your ability to use certain features of the Service.

---

9. Right to Refuse

You have the right to refuse biometric enrollment.

If You Refuse:

• Commando Employees: Biometric verification may be required for your role. Refusal may affect your ability to perform certain job functions.
• Client Employees: Your employer determines whether biometric verification is mandatory or optional. Contact your employer's HR department for their policy.

Alternative Verification:

If you refuse biometric enrollment:

• Manual photo verification may be required
• Additional identity checks may be implemented
• Some features may not be available to you

---

10. Consent Acknowledgment

BY CHECKING THE BOXES BELOW AND PROCEEDING, I CONFIRM THAT:

• I have read and understood this Biometric Data Collection Consent form in its entirety.

• I understand what biometric data will be collected: Facial geometry scans, face descriptor templates, photographs, and liveness detection data.

• I understand the purpose: To verify my identity during the enrollment and configured verification events described above.

• I understand the retention periods: My face template and enrollment images, verification evidence and associated results, and transient job metadata have the separate retention periods stated above.

• I understand my rights: I can access, correct, delete, or request my biometric data at any time.

• I understand I can withdraw consent: By contacting support@commando360.ai, though this may affect Service functionality.

• I CONSENT to the collection, storage, and use of my biometric data as described in this document.

---

Full Name: ________________________________ (By typing your name, you are providing your electronic signature)

Date: ________________________________

Employee ID: ________________________________

---

11. For Illinois Residents

If you are a resident of Illinois, additional protections apply under the Illinois Biometric Information Privacy Act (BIPA).

Please also review our Illinois BIPA Notice for complete state-specific disclosures.

---

12. Contact Information

For questions about biometric data collection or to exercise your rights:

Commando360.ai Private Limited PNO 4, H.no 3-1-2(1-D), A-2, Trimulgherry Village Thirumalgherry X Roads, Secunderabad Hyderabad, Telangana 500015, India

Email: support@commando360.ai Phone: +91 95020 56901

---

Document Version: 1.2 Last Updated: September 1, 2026