Illinois Biometric Information Privacy Act (BIPA) Notice

Effective Date: January 1, 2026 Version: 1.2 Last Updated: September 1, 2026

---

Notice to Illinois Residents

This notice is provided pursuant to the Illinois Biometric Information Privacy Act, 740 ILCS 14 ("BIPA"). If you are an Illinois resident using the Commando 360 mobile application, this notice describes our biometric data practices and your rights under Illinois law.

Summary of Key Points:

Commando 360 collects facial geometry data to verify identity during enrollment and configured attendance, manager spot-check, and patrol-route verification events. This data is maintained in private, access-limited systems and is subject to the retention and destruction schedule below. We do not sell, lease, trade, or otherwise profit from biometric data. You may request access to your biometric information or request deletion, subject to applicable law.

Before any biometric data is collected, we will obtain your written consent. You may refuse to provide consent, though this may affect your ability to use certain features of the platform.

---

1. Entity Collecting Biometric Information

Commando360.ai Private Limited ("Commando 360," "we," "us," or "our")

PNO 4, H.no 3-1-2(1-D), A-2, Trimulgherry Village Thirumalgherry X Roads, Secunderabad Hyderabad, Telangana 500015, India

Email: support@commando360.ai Phone: +91 95020 56901

---

2. Biometric Identifiers and Information Collected

Commando 360 collects the following biometric identifiers and biometric information from Illinois residents who use our mobile application:

These are "biometric identifiers" as defined by 740 ILCS 14/10.

---

3. Purpose for Collection

We collect biometric identifiers and biometric information solely for the following specific purposes:

1. Identity Verification: To verify identity during enrollment, shift check-in and check-out, and configured periodic attendance, manager spot-check, or patrol-route checkpoints
2. Attendance Tracking: To confirm your physical presence at your assigned work location
3. Fraud Prevention: To prevent "buddy punching" (having another person clock in for you), time theft, and unauthorized access
4. Security: To maintain secure access to protected premises where you may be assigned

We will NOT use your biometric identifiers or biometric information for any other purpose without first providing you with written notice and obtaining your written consent.

We do not use facial data for advertising, marketing, cross-app tracking, or unrelated profiling.

---

4. Retention Period

Your biometric identifiers and biometric information will be retained for the following period:

Retention Schedule

Retention Standard

Each category is retained only until the first of the following occurs:

1. The initial purpose for collecting or obtaining such identifiers or information has been satisfied; or
2. The applicable period in the schedule above ends; or
3. Three years after your last interaction with Commando 360, where that maximum is required by Illinois law.

---

5. Destruction of Biometric Data

Upon expiration of the retention period, or upon a valid request for deletion where deletion is required, we will permanently destroy the biometric identifiers and biometric information within 90 days using deletion methods appropriate to the relevant database, object storage, logs, indices, and protected backup systems.

Destruction Certification: Upon written request, we will provide confirmation that your biometric data has been destroyed.

---

6. Disclosure and Non-Sale of Biometric Data

We Will NOT:

• Sell your biometric identifiers or biometric information
• Lease your biometric identifiers or biometric information
• Trade your biometric identifiers or biometric information
• Otherwise profit from your biometric identifiers or biometric information

Disclosure Restrictions

We will NOT disclose, redisclose, or otherwise disseminate your biometric identifiers or biometric information to any third party unless:

1. You provide written consent to such disclosure;
2. The disclosure completes a transaction you requested or authorized;
3. The disclosure is required by law (e.g., valid subpoena, court order, or law enforcement request); or
4. The disclosure is required by a valid warrant issued by a court of competent jurisdiction.

Sub-Processors

Supabase stores and processes biometric data solely as Commando 360's contracted database and object-storage infrastructure provider. It is restricted to the contracted service, is subject to applicable confidentiality, security, and data-protection terms, and may not use the data for its own advertising or marketing purposes.

---

7. Storage and Protection

Technical Safeguards

Your biometric identifiers and biometric information are protected by industry-standard security measures:

• Encrypted Transport: HTTPS/TLS for supported network connections
• Stored-Data Protection: Provider-managed encryption at rest and private storage where applicable
• Access Controls: Role- and attribute-based application controls limiting access to authorized purposes
• Logging: Security and activity logging for selected biometric events and systems

Storage Location

The production biometric database and private object storage are hosted through Supabase in the ap-south-1 (Mumbai, India) region. Facial data is protected in transit using HTTPS/TLS and at rest using Supabase's provider-managed storage protections. Supabase may process limited request, security, or support data from other locations under its applicable service terms, as described in the Privacy Policy.

Authorized Access

Authorized organizational security or compliance personnel may access verification photographs, match or liveness results, and limited verification metadata only within their permitted organizational scope. Customer organizations do not receive direct access to facial geometry templates. Authorized Commando 360 support or security staff may access facial data only as needed to provide, secure, support, investigate, or legally administer the Service.

Protection Standard

We protect your biometric identifiers and biometric information using the reasonable standard of care within our industry, and in a manner that is the same as or more protective than the manner in which we store, transmit, and protect other confidential and sensitive information.

---

8. Your Rights Under BIPA

As an Illinois resident, you have the following rights under BIPA:

---

9. How to Exercise Your Rights

To Access Your Biometric Data:

Email support@commando360.ai with subject line: "BIPA Access Request - [Your Name]"

Include:

• Your full name
• Your employee ID (if applicable)
• The email address associated with your account

To Request Deletion:

Use Profile → Delete Account in the app, or email support@commando360.ai with subject line: "BIPA Deletion Request - [Your Name]"

Include:

• Your full name
• Your employee ID (if applicable)
• The email address associated with your account
• Statement that you are an Illinois resident

Response Time:

We will respond to your request within 30 days of receipt.

---

10. Consent Requirements

Before We Collect Biometric Data:

We will:

1. Inform you in writing that biometric identifiers or biometric information will be collected or stored
2. Inform you in writing of the specific purpose and length of term for which your biometric identifiers or biometric information are being collected, stored, and used
3. Obtain your written release (consent) signed by you or your legally authorized representative

How Consent Is Collected:

Consent is collected through the Commando 360 mobile application:

1. Before any face scanning occurs, you will be presented with a consent screen
2. The consent screen displays this BIPA notice and consent language
3. You must affirmatively check consent boxes
4. Your consent is recorded with timestamp, device ID, and app version

Right to Refuse:

You have the right to refuse to provide biometric consent. However:

• If you are a Commando employee, biometric verification may be required for your role
• If you are a Client employee, your employer determines whether biometric verification is mandatory
• Refusal may affect your ability to use certain features of the mobile application

---

11. Consent Form

BY CHECKING THE CONSENT BOXES AND PROCEEDING, I ACKNOWLEDGE AND AGREE:

• I have received and read this BIPA Notice describing the biometric identifiers and information that Commando 360 will collect, the purposes for collection, and the retention schedule.

• I understand that Commando 360 will collect my biometric identifiers and information for the enrollment and configured identity-verification events described above.

• I understand the retention periods: My templates, enrollment images, verification evidence and associated results, and transient job metadata have the separate retention periods stated above, subject to the earlier Illinois destruction trigger.

• I understand the destruction schedule: My biometric identifiers will be permanently destroyed within 90 days after the retention period ends or upon my valid deletion request.

• I consent to the collection, storage, and use of my biometric identifiers as described in this notice.

• I understand that I may withdraw my consent at any time by contacting support@commando360.ai, and that withdrawal may affect my ability to use certain features of the Service.

---

Printed Name: ________________________________

Signature: ________________________________ (Electronic signature: By typing your name, you are providing your electronic signature)

Date: ________________________________

Employee ID: ________________________________

---

12. Record of Consent (For Internal Use)

---

13. Amendments to This Notice

If we make material changes to this BIPA Notice, we will:

1. Provide you with 30 days' written notice before the changes take effect
2. Require you to provide renewed consent for the updated practices
3. Provide an opportunity to withdraw consent if you do not agree to the changes

---

14. Contact Information

For questions about this BIPA Notice or our biometric data practices:

Commando360.ai Private Limited PNO 4, H.no 3-1-2(1-D), A-2, Trimulgherry Village Thirumalgherry X Roads, Secunderabad Hyderabad, Telangana 500015, India

Email: support@commando360.ai Phone: +91 95020 56901

---

15. Legal Compliance Statement

This notice is provided in compliance with the Illinois Biometric Information Privacy Act, 740 ILCS 14 and satisfies the requirements of:

• 740 ILCS 14/15(a): Written policy regarding retention and destruction
• 740 ILCS 14/15(b): Written notice and consent requirements
• 740 ILCS 14/15(c): Prohibition on sale, lease, trade, or profit
• 740 ILCS 14/15(d): Disclosure restrictions
• 740 ILCS 14/15(e): Security requirements

---

Document Version: 1.2 Last Updated: September 1, 2026 Applies To: Illinois Residents Using Commando 360 Mobile Application