Privacy Policy & Data Protection

Last Updated: March 2026 • DPDP Act (2023) Alignment

This Privacy Policy applies to Sandeep Services (acting as the "Data Fiduciary") and all affiliated digital interfaces including the website (sandeepservices.com) and the Sandeep Services Attendance Mobile Application. This document explains how we collect, process, retain, and safeguard personal data of our users, website visitors, job applicants, and deployed personnel (the "Data Principals") in accordance with The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and applicable Indian cybersecurity and data protection regulations.

1. Statutory Framework & Data Fiduciary Details

Under the provisions of the Digital Personal Data Protection Act, 2023 (DPDPA), Sandeep Services is the designated Data Fiduciary responsible for determining the purpose and means of processing personal data:

• Entity Name: Sandeep Services
• Registered Headquarters: 2nd Floor, 2-2-61/14, 1/B, Main Road, Hayathnagar, Hyderabad, Telangana 500013, India
• Official Communications: info@sandeepservices.com / +91 9010000536
• Jurisdiction: Hyderabad, Telangana, Republic of India

2. Categories of Digital Personal Data Collected

In accordance with the principle of Data Minimization (Section 6 & 8 of DPDPA 2023), we collect only the minimum personal data strictly necessary to fulfill specified operational and commercial requirements:

• Inquiry & Client Data: Full name, authorized corporate representative name, contact telephone number, corporate email address, service requirements, and facility location submitted voluntarily via quote and contact forms.
• Attendance & Field Verification Data: Real-time on-site GPS coordinates strictly captured at the time of manual punch-in/punch-out, identity confirmation photos, and verified Aadhaar-linked employee ID numbers for statutory police verification and security post logs.
• Technical & Telemetry Data: IP address, browser type, operating system version, and system timestamp logs collected solely for diagnostic stability, fraud prevention, and bot protection.

3. Specified Lawful Purpose of Processing

We process digital personal data strictly on lawful grounds for the following specified purposes:

• Quotation & Service Delivery: Formulating customized workforce proposals, drafting enterprise service contracts, and coordinating security, staffing, and facility management deployments.
• Statutory Verification & Compliance: Conducting required background verification, address checks, and statutory labor law compliance (EPSARA, statutory standards) for deployed staff.
• Operational Attendance Verification: Accurately validating physical presence at designated client facilities during scheduled shifts.
• Security & Abuse Prevention: Guarding our systems against automated spam, fraudulent inquiries, and cybersecurity incidents.

4. Notice & Consent Architecture

Under Section 6 of the DPDP Act, 2023, every request for personal data is accompanied by a clear, itemized notice. By submitting personal data through our inquiry forms or logging into our enterprise applications, you provide explicit, free, specific, informed, and unambiguous consent for processing for the specified purpose.

Right to Withdraw Consent: Data Principals have the unconditional right to withdraw their consent at any time by writing to our Grievance Redressal Officer. Upon receipt of consent withdrawal, processing will cease unless retention is mandated by prevailing statutory laws.

5. Statutory Rights of the Data Principal

Under Chapter III (Sections 11 to 14) of the DPDP Act, 2023, all Data Principals possess the following enforceable rights:

• 1. Right to Access Information (Section 11): Right to obtain a summary of personal data being processed, details of processing activities, and identities of authorized service processors.
• 2. Right to Correction and Erasure (Section 12): Right to correct inaccurate or misleading personal data, complete incomplete records, and request erasure of personal data that is no longer necessary for the specified purpose.
• 3. Right of Grievance Redressal (Section 13): Right to readily accessible grievance redressal mechanisms with our designated Grievance Officer regarding any act or omission by the Data Fiduciary.
• 4. Right to Nominate (Section 14): Right to nominate another individual who shall exercise the rights of the Data Principal in the event of death or incapacity.

6. Reasonable Security Safeguards & Encryption

In compliance with Section 8(5) of DPDPA 2023, Sandeep Services has instituted robust technical, operational, and physical security measures:

• End-to-end HTTPS/TLS 1.3 encryption across all website and application endpoints.
• Strict role-based access control (RBAC) ensuring only authorized operations personnel access client and verification databases.
• Regular automated vulnerability monitoring, firewall protection, and anti-tamper safeguards.

7. Prohibition on Data Selling & Third-Party Disclosures

Sandeep Services strictly upholds the trust of its clients and workforce:

• We do NOT sell, rent, monetize, or broker personal data to any third-party marketing or advertising networks under any circumstance.
• Personal data is shared only with verified statutory authorities when mandated by applicable law, or with vetted technical cloud infrastructure providers bound by non-disclosure agreements and DPDPA-compliant processing mandates.

8. Purpose Limitation & Data Retention Policy

Personal data is retained only for the duration necessary to satisfy the specified operational purpose for which it was collected, or as required by applicable statutory labor and commercial record-keeping regulations. When records reach the end of their retention lifecycle or upon a valid erasure request, they are irreversibly anonymized or securely deleted.

9. Statutory Grievance Redressal Officer (GRO) & Escalation

If you wish to exercise any statutory Data Principal rights, report a privacy concern, or file a grievance under the Digital Personal Data Protection Act, 2023, please reach out directly to our designated Grievance Redressal Officer:

Response Timeframe: All grievances and data access requests will be formally acknowledged within 48 hours and resolved within 30 business days.

Escalation: In the event that a grievance remains unresolved after exhausting our internal grievance redressal mechanism, the Data Principal retains the right to file a formal complaint with the Data Protection Board of India (DPBI) in accordance with Section 13(3) of the Act.