Privacy Policy

1. Who we are and what this covers

GMR Security Services operates gmrsecurityservices.com and handles information for its recruitment, employment, training, security and workforce services, client relationships and franchise discussions. This combined website and company privacy policy covers information received online and during related calls, correspondence, onboarding and operational work.

References to GMR, we, us and our mean GMR Security Services in connection with this website. This policy does not claim that a proposed branch city is an established office, or that submitting a form creates an employment, service or franchise agreement. It applies to applicants, employees, trainees, client contacts, visitors and prospective business partners, as relevant to their relationship with GMR.

Please read this policy before submitting information. The form identifies required fields and provides the relevant consent or acknowledgement. A status notification, reference number or confirmation popup records receipt; it is not a selection, verification or approval decision.

2. Information supplied in a job application

The recruitment form collects name, mobile number, email if supplied, date of birth, gender, height in centimetres, weight in kilograms, address with PIN code, educational qualification, work experience and previous-service details. It also records selected positions, preferred states and cities, joining availability and any additional message.

A passport-size photograph is required. Driver-related positions request driving licence category and number. The form currently requests an Aadhaar number with exactly twelve digits. A format check only checks the entry; it does not authenticate an Aadhaar or driving licence, verify ownership or establish job eligibility.

Do not upload a document containing unrelated financial, medical or family information. The public form does not ask for bank passwords, payment PINs, Aadhaar OTPs or biometric scans. Existing application documents, where previously provided, may remain part of the restricted recruitment record.

3. Service, contact and franchise enquiries

A security request records contact details, site or preferred location, required service, staffing requirement, sector where supplied and the message. It is used to understand the requirement and discuss availability, staffing and scope.

Contact enquiries record name, phone or email, enquiry category, selected service, state, city and any message. Franchise applications additionally record the proposed location, business name if supplied, relevant experience, office availability, proposed investment range and previous-service information where supplied.

A WhatsApp number is separate from the primary phone number. It can be the same number or a different number. Only provide a number you control or are authorised to use. The form and its accompanying choice govern whether that number is used for request updates.

4. How information reaches us

We receive information when you complete a form, upload a photo, review and confirm an application, check a reference, communicate with GMR or ask an authorised team member to correct a record. Authorised staff can update the supported contact and candidate-profile fields.

The website uses session and security information to keep a form review, validate a submission, preserve selected language and protect administrative access. Hosting and application logs may record technical details such as IP address, browser request, time and errors for operation and troubleshooting.

Only submit information relevant to the purpose of the form. If you submit someone else's details, you must have appropriate authority and make this policy available to them. Incorrect contact details may prevent a response or expose your updates to the wrong recipient.

5. Review drafts and file uploads

Before final submission, the job review flow temporarily retains the entered information and a staged photograph so you can check or edit the application. The review is time-limited. Expiry, replacement or completion may remove the staged photo; it does not itself create a confirmed application.

Following successful confirmation, the application and photo become part of the recruitment record. Review and private-photo routes are not intended for search indexing. Do not forward review links, leave a shared device signed in or include identity numbers in a message that does not need them.

6. Why we use information

Recruitment information is used to record applications, assess stated qualifications and experience against available roles, understand preferred work locations, arrange follow-up, maintain the application status and conduct appropriate identity or licence checks through a separately communicated process.

Height, weight, gender and previous-service information may be relevant to particular operational requirements. Their presence in the form does not mean that every role has the same physical criteria. Decisions must be made in accordance with applicable law and the actual role; a form response is not a medical assessment.

Enquiry information is used to discuss service requirements, prepare an appropriate proposal, assess a franchise enquiry, answer questions and keep a record of communications. Information may also be used to prevent misuse, investigate errors, protect legitimate interests and meet applicable legal obligations.

7. Aadhaar and driving licence information

Aadhaar and driving licence entries are identity-related information used for the stated recruitment purpose. The current application encrypts stored numbers and masks routine Aadhaar displays. These technical controls do not establish a legal entitlement to collect every identifier or amount to UIDAI approval.

The Aadhaar Act, 2016, particularly sections 4, 8A and 29 as applicable, and the Aadhaar (Authentication and Offline Verification) Regulations, 2021 govern relevant Aadhaar activity. Offline verification requires a voluntary, informed process and an alternative identification route; numbers or biometrics must not be retained where that process prohibits it.

The current form requests twelve digits, but that check is not authentication or proof of identity. Aadhaar is not represented as universally compulsory for private recruitment. Contact GMR before submitting if you need an alternative; do not enter invented digits, an OTP or biometric data. An Aadhaar-compliant operational process must be confirmed before verification is undertaken.

8. Calls, WhatsApp and email

GMR may contact you about the submitted application or enquiry using the contact information you provided. For job applications, WhatsApp updates depend on both the entered WhatsApp number and the form's WhatsApp choice. For other enquiry forms, supplying a WhatsApp number indicates the request to receive updates there; leaving it blank does not authorise a fallback to the primary number.

Status messages may include your name, reference number, role or location and current status. Automatic WhatsApp sending depends on a configured provider and its messaging rules. A manual WhatsApp link can prepare a message for an authorised team member to send. A prepared message or API acceptance does not prove delivery.

Ask GMR to stop optional WhatsApp updates or correct an incorrect number. Withdrawal does not reverse a message already sent or necessarily end recordkeeping needed for the underlying request.

9. Who may receive information

Access is limited to authorised personnel who need the information for recruitment, operations, enquiry handling, management, support or system administration. Private applicant photographs and documents are accessed through protected administrative routes.

Hosting, infrastructure or communications providers may process information needed to operate their service. If a WhatsApp Business integration is enabled, the provider receives the recipient number and message content required to send an update. Email and telephone providers handle communications through their respective services.

Where a proposed placement or service engagement requires information to be shared with a client or an appropriate verifier, share only what is relevant and use an appropriate purpose and authority. Legal authorities may receive information where disclosure is required by law or is necessary for a lawful process. No personal information is made public merely because a city appears on the network map.

Public website translation, where enabled, is intended for website content such as vacancies, locations and service descriptions. Applicant identity numbers, private messages and private documents are not intended to be sent for public-content translation.

10. Storage and safeguards

Information is stored in the website's database and private file storage. The application uses authenticated administration, request validation, role restrictions and protected document routes. Aadhaar and driving licence numbers are encrypted before being stored in candidate details.

No security measure can guarantee that a system is risk-free. Use the official domain, keep your reference private, and contact GMR if you believe an application or message has been accessed or used without authority. We will assess reported incidents and take appropriate action, including any notification required by applicable law.

11. How long records remain

Records are retained for the purpose for which they were collected, follow-up, recruitment or business administration, legitimate dispute handling and applicable legal requirements. This policy does not promise an automatic deletion date or a fixed backup-erasure schedule.

Moving an item to Deleted / Restore hides it from normal lists and, for client requests, public status lookup. It is a recoverable administrative deletion, not immediate permanent erasure. Backups, legal holds and other necessary records may remain after an operational record is removed.

For a request to correct, withdraw or erase information, contact GMR with the minimum details needed to locate the record. The team must assess identity, scope and any continuing legal or operational need before acting.

12. Requests and consent choices

Ask GMR to review or correct your information, stop a consent-based optional use, or erase information that no longer has a lawful retention purpose. Requests are assessed under the law currently in force, including applicable provisions of the IT Act, 2000 and SPDI Rules, 2011; future DPDP rights are distinguished below.

Use https://gmrsecurityservices.com/contact and select Other, describing the issue as a privacy grievance. Provide the reference and a registered contact method. Do not send a full identity number, bank information, password or OTP in the initial message. Proportionate identity verification may be needed before disclosure or correction.

Where Rule 5(9) of the SPDI Rules applies, the designated Grievance Officer must address grievances expeditiously and within one month of receipt. The contact details in section 23 are expressly demonstration details and must be replaced before production use. Support contact is not a claim that a statutory officer has already been appointed.

13. Cookies, links and shared devices

The website uses necessary session and security functions and may remember your selected language. These functions support form review, CSRF protection, login and ordinary site operation. Blocking necessary cookies can interfere with a submission or administrator session.

Links to WhatsApp, social platforms, external references or other websites lead to services with their own privacy practices. Client logos, map attribution and other third-party marks do not make those third parties responsible for this website's forms.

On a shared device, close the form review and clear the session when finished. A reference number is not a password; tracking also requires matching registered contact information. The public tracking page displays a limited status result rather than the complete private application.

14. Children, updates and applicable framework

Employment eligibility and age checks depend on the actual role and applicable law. A parent or guardian cannot consent away a statutory prohibition on employment. The general job form is not intended to collect applications from children. Contact GMR if a child's information has been submitted in error.

As reviewed on 22 October 2026, the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 have phased commencement. The core processing and individual-rights provisions scheduled eighteen months after the 13 November 2025 Gazette publication are not presented here as already enforceable.

The applicable IT Act / SPDI framework, Aadhaar requirements and other current legal duties remain relevant. A revised policy alone does not cure a collection, security or consent-process defect. Material changes should be communicated and new purpose-specific consent obtained where required.

Official references and contact

Official legal references and their applicability are set out in sections 19-22. The demo legal-contact record is in section 23. References identify governing frameworks and do not establish certification, a licence, registration or government endorsement.

Current website support: https://gmrsecurityservices.com/contact. This support route remains available while the demonstration legal-contact record is being finalised.

15. Employee, trainee and onboarding records

Where a recruitment process moves to onboarding, additional information may be needed for identity and eligibility checks, emergency contacts, attendance, deployment, training, payroll, bank payment and applicable statutory benefits. Such information should be requested through an authorised process, for a stated purpose and only to the extent relevant to the engagement.

Recruitment submission does not authorise unrestricted background checks. Where checks, health or fitness information, references or additional identity records are required, the person should receive the relevant explanation and any consent or other lawful requirements must be addressed before processing. Payroll or onboarding information must not be posted in public website fields.

16. Client sites, visitors and incident information

Security assignments may involve visitor entries, attendance, access records, vehicle logs and incident reports. CCTV or other monitoring must be governed by the actual site arrangements, applicable notices and authorised instructions. This policy does not state that GMR operates CCTV or collects biometric data at every location.

The service agreement should identify who controls site records, which personnel may access them, the purpose, retention arrangements and how requests or incidents are escalated. Staff must not copy site documents, photographs, recordings or visitor details to personal accounts or disclose them for unrelated purposes.

17. Sharing within a business relationship

Where necessary for an agreed deployment or authorised service, relevant personnel information may be provided to a client for access, identity, suitability or attendance requirements. Client information may be shared with assigned staff or authorised service providers only for the relevant work. A service relationship is not permission to circulate complete applicant, Aadhaar, payroll or visitor records indiscriminately.

An authorised request from a public authority is assessed in accordance with applicable law. Any independent privacy responsibilities of a client, bank, statutory body or other recipient remain subject to that recipient's own role and applicable requirements.

18. Confidentiality, incidents and the end of a relationship

Employees and authorised partners handling personal information must follow access restrictions and confidentiality obligations. Lost documents, misdirected messages or suspected unauthorised access should be reported promptly to the responsible GMR contact. Information should be secured and investigated, with notifications made where applicable requirements call for them.

At the end of employment, training or a service relationship, access and records should be reviewed and company or client material returned through the authorised handover. Some records may need to remain for payroll, statutory, contractual or dispute purposes; ending a relationship does not automatically require immediate deletion of every record. Privacy requests can be raised using the contact details in this policy.

19. IT Act, 2000 and SPDI Rules, 2011

The Information Technology Act, 2000, including sections 43A and 72A to the extent currently applicable, addresses security failures concerning sensitive personal data and certain wrongful contractual disclosures. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 supply relevant privacy, consent and handling requirements. Health, medical, financial and biometric information require particular care.

For covered SPDI, Rules 4-8 address privacy disclosure, necessary and purpose-related collection, consent, review / correction, limited retention, disclosure, transfer and reasonable security practices. Required fields must be assessed for necessity; a broad acknowledgement is not consent to unrelated marketing, unrestricted background checks or publication of private documents. Applicable third-party processing terms must reflect these restrictions.

20. Security incidents, records and service providers

Section 70B of the IT Act and applicable CERT-In Directions dated 28 April 2022 govern covered cyber incident response. Covered entities must assess reportable incidents against the specified six-hour reporting requirement and maintain required ICT logs for a rolling 180 days within Indian jurisdiction. These are legal requirements where applicable, not a claim that a technical audit has confirmed implementation.

Operational logs are different from complete applicant files. Retention must be matched to a purpose, legal requirement and documented schedule rather than indefinite reuse. Transfers of covered SPDI must meet Rule 7 conditions, including comparable protection and the applicable necessity or consent requirement. Provider location and safeguards should be checked before use; this policy does not certify a hosting location.

21. Digital Personal Data Protection Act, 2023

G.S.R. 843(E), dated 13 November 2025, stages commencement of the DPDP Act. Sections 3-17 and the principal processing, notice, consent, security, children's-data and individual-rights framework are scheduled eighteen months from publication; section 6(9) has a one-year stage. G.S.R. 846(E) similarly stages the DPDP Rules, 2025. These future stages must not be advertised as already operational on 22 October 2026.

When the relevant provisions commence, sections 4-8 concern lawful processing, notice, consent, specified legitimate uses and fiduciary duties; section 9 addresses children's data and sections 11-14 individual rights. Implementation must follow then-effective notifications and rules. This notice does not assume that GMR is a notified Significant Data Fiduciary, that every use has consent, or that a future right is available before commencement.

22. Aadhaar and sensitive verification records

For Aadhaar offline verification, section 8A requires the applicable consent, purpose and information disclosures. UIDAI guidance requires alternative identification and limits collection / storage for the offline-verification process, including masking rather than storing a complete Aadhaar number where prohibited. A compulsory website field must not be treated as authority to bypass those safeguards.

Medical and background checks must use a separate, appropriate process for the role. Obtain only relevant results, restrict access and avoid sending complete medical reports or identity documents through ordinary public enquiries. Share a fitness outcome or necessary deployment information with a client rather than unrelated health details. Correct form design, notices and retention procedures must accompany this policy.

23. Demonstration legal-contact record

DEMO ONLY - REPLACE BEFORE PUBLIC LAUNCH. Trading / website name: GMR Security Services. Registered legal entity name and registration details: not yet confirmed.

Demonstration contact: Demo Privacy Officer. Demonstration email: privacy@example.com. The example.com address is a reserved example and is not monitored. Do not send personal data to it. Current support is available through https://gmrsecurityservices.com/contact. A named, authorised grievance contact and working email must replace these demo entries.

This version is a law-referenced implementation draft. Publication is not proof of compliance, officer appointment, Aadhaar authorisation or security certification. Entity-specific licences, contracts, processing practices and statutory registrations require validation before production reliance.

Official sources (reviewed 22 October 2026)

MeitY: IT Act and SPDI clarification - https://www.meity.gov.in/writereaddata/files/PressNote_25811.pdf | DPDP commencement - https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf | DPDP Rules, 2025 - https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf

UIDAI offline-verification guidance - https://www.uidai.gov.in/images/FAQ_OVSE.pdf | CERT-In Directions - https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf | Acts and amendments should be checked on https://www.indiacode.nic.in/ .