Employee Privacy Charter & Privacy Policy.

1. Organizational Scope & Enterprise Parties

This Privacy Policy is issued by KATIRTEK TRIA PRIVATE LIMITED(“KatirTek Tria”, “we”, “our”, or “us”) and governs all endpoint metadata ingestion, shift tracking, and operational telemetry processed through the Tria Pulse cloud platform and desktop agent software.

This policy applies to all subscribing entities (“Customer Organizations”), tenant administrators, managers, and enrolled employees or authorized contractors (“Data Subjects”) using the service.

2. Architectural Session Boundary & The Hard Lock Invariant

Unlike legacy workplace monitoring utilities that run uninhibited 24/7 background trackers, Tria Pulse operates under a strict architectural invariant:

3. Detailed Categories of Processed Data

When an employee is within an active work session, Tria Pulse collects only the minimum data required to deliver shift accounting and endpoint security observability:

• Shift & Session Timestamps: Clock-in time, clock-out time, break start/end times, and total duration to replace manual timesheets with automated mathematical accuracy.
• Focus vs. Idle Intervals: Binary system input activity status (active vs. idle duration) derived from operating system event timers, used solely to compute focused work hours.
• Application Title & Categorization:The foreground process window name (e.g., “Visual Studio Code”, “Figma”, “Jira”) classified into organizational functional categories (Software Development, Design, Project Management, Internal Communication, Neutral).
• USB Hardware Security Events: Connection and disconnection timestamps, device vendor ID, and volume serial identifiers for USB mass storage devices to support enterprise Data Loss Prevention (DLP) auditing and protect company intellectual property.
• Network & Fleet Health Metadata: Corporate network adapter status, local IP subnet, device hostname, operating system architecture (Windows, macOS, Linux), and Tria Pulse agent binary version to ensure compatibility, security patching, and fleet reliability.
• Customer Account Information: Organization name, administrator email address, billing contacts, and seat counts required for contract execution and service provisioning.

4. What We Strictly Never Capture (Zero-Spyware Pledge)

We maintain an absolute technical and ethical prohibition against invasive employee surveillance technologies:

• No Keystroke Logging: We do not log keystrokes, keyboard inputs, search phrases, entered text, passwords, or confidential customer data.
• No Continuous Screen Recording or Stealth Snapshots: We do not record video of employee monitors, stream desktop screens to administrators, or capture stealth desktop images.
• No Audio or Video Surveillance: We have zero access to device microphones, webcams, phone calls, ambient room noise, or video conferences.
• No Personal Communications or Document Inspection: We do not read the body, payloads, or contents of emails, chat messages (Slack, Teams, WhatsApp), documents, spreadsheets, or source code files.
• No Physical Location / GPS Tracking: We do not extract GPS coordinates, Wi-Fi triangulation, or residential addresses of employees.
• No Off-Hours or Weekend Monitoring: When an employee is off-shift, the agent daemon is completely dormant. Personal browsing, weekend usage, and personal entertainment remain 100% private.
• No Covert or Invisible Operation: The Tria Pulse agent daemon runs visibly with a dedicated system tray icon showing live connection status, shift duration, and active monitoring state.

5. Purpose of Processing & Legitimate Interests

Telemetry collected by Tria Pulse is processed strictly for legitimate workplace administration purposes:

• Automated, dispute-free shift verification and payroll attendance reconciliation.
• Detection of late-night overtime streaks and sustained burnout indicators across engineering teams.
• Verification of software tool adoption, license utilization, and cloud service efficiency.
• Auditing hardware connection security (USB DLP) to comply with SOC 2, ISO 27001, and client confidentiality.

6. Multi-Tenant Segregation & Data Isolation

Tria Pulse is architected from the ground up for strict multi-tenancy. Every telemetry payload, shift record, and administrative setting is hard-partitioned by Customer Tenant ID at the database and cache layer. Cross-tenant data access is mathematically impossible under our query structure. Customer data is never co-mingled or shared across client organizations.

7. Data Retention & Cryptographic Deletion

All endpoint telemetry is retained on a rolling schedule configured by the Customer Organization (standard default: 90 days). Once the retention window lapses:

• Historical detailed events are automatically purged from high-throughput database partitions.
• Upon organization termination, customer tenant partitions and encryption keys are permanently destroyed.
• Customers may request an immediate, complete tenant data purge at any time by contacting support.

8. Cryptographic Security & Infrastructure Controls

We implement industry-grade technical and organizational safeguards to protect customer telemetry:

• Encryption in Transit: All communications between the desktop client daemon and our ingestion APIs are encrypted over TLS 1.3 with forward secrecy.
• Encryption at Rest: Persistent database storage and telemetry volumes are encrypted using AES-256 with tenant-isolated key derivation.
• Credential Security: Administrative passwords use salted Argon2id / bcrypt key stretching. Mandatory Multi-Factor Authentication (MFA) is enforced across administrative consoles.
• Role-Based Access Control (RBAC): Granular permissions restrict telemetry access so only authorized tenant administrators and designated managers can view team metrics.
• Tamper-Resistant Audit Logs: All administrative inquiries, exports, and setting modifications are permanently recorded in immutable system audit trails.

9. Employee Transparency & Self-Inspection Rights

We believe privacy requires full transparency between employers and employees. Tria Pulse provides an employee-facing portal where individuals can inspect their own active hours, focus breakdowns, and shift logs. Employees can verify exactly what metadata has been registered by their system.

10. Statutory Rights & Global Privacy Compliance

Depending on jurisdiction, Data Subjects and Customer Organizations retain explicit privacy rights:

• Digital Personal Data Protection Act (DPDP Act, India 2023): Adherence to lawful processing grounds, consent frameworks, purpose limitation, and employee grievance redressal mechanisms.
• GDPR (General Data Protection Regulation, EU): Lawful processing under Article 6 (Legitimate Interests / Contractual Necessity), data minimization under Article 5, right to access (Article 15), right to rectification (Article 16), and right to erasure (Article 17).
• CCPA / CPRA (California Consumer Privacy Act): Right to know categories of collected metadata, and a binding commitment that Tria Pulse does not sell or share personal information for commercial marketing.

11. Zero Data Sale & Third-Party Disclosures

We never sell, rent, lease, or monetize customer or employee telemetry. We do not broker data to advertisers, data analytics brokers, or commercial marketing platforms. Third-party disclosures are strictly limited to essential cloud infrastructure providers (e.g., cloud hosting facilities, managed database clusters) bound by strict Data Processing Agreements (DPAs) and confidentiality obligations.

12. Privacy Inquiries & Grievance Redressal

For data access requests, Data Processing Agreements (DPA), enterprise privacy inquiries, or grievance redressal, please contact our dedicated privacy and support team: