Your data, used for one purpose at a time.

1. Who we are

This website is run by SDC Security & Facility Services Pvt. Ltd. (“SDC”, “we”, “us”), a private limited company incorporated in India (CIN U74999KA2017PTC103762) and licensed as a private security agency under PSARA licence ISD/PSA-64/2019.

Registered office: No. 102, Ground Floor, Kempamma Layout, near St. Philomena’s School, Mariyappana Palya, Bengaluru 560 056, Karnataka. Phone +91 99803 43925. Email sdcpvtltd01@gmail.com.

For the personal data described here, SDC is the data fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This policy is also written to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We will follow the Digital Personal Data Protection Rules, 2025 as each part comes into force.

This policy covers our public websites: the multi-page site under /v2, the one-page site, and the careers pages at /careers. It does not cover sites we link to.

2. What we collect and when

We collect personal data only when you give it to us, or when your browser asks our servers for a page.

We do not ask for Aadhaar, PAN, bank details, health information or biometrics on this website. Please do not put them in an uploaded document. If we need identity documents after an interview, we will ask for them separately and explain why.

3. Why we use it, and on what basis

Job applications: your consent

Before you can apply, the form shows you a short notice and asks you to agree. We use your application only for recruitment: to contact you (by phone or WhatsApp), to assess you for the job, to check your documents, and to tell you the outcome. If the same mobile number has applied before, we link the applications so our team does not call you twice. You can withdraw your consent at any time (see Your rights). Withdrawing does not affect anything we did before you withdrew, but we will stop considering your application.

Enquiries and messages: you contacted us for a purpose

When you send us an enquiry, email or WhatsApp message, we use your details only to reply, arrange a site survey and prepare a quotation. The DPDP Act allows this where you have voluntarily given us your data for a specific purpose (section 7(a)). We will not add you to marketing lists.

Running the website safely

We use server logs and the short-term IP check to keep the site available, stop abuse and investigate security problems.

When the law requires it

We may use or disclose data to meet a legal obligation, or to comply with an order of a court, tribunal or authority (sections 7(d) and 7(e) of the DPDP Act). [Legal basis to be confirmed by SDC’s legal adviser]

4. How long we keep it

• Job applications: 12 months from the date you apply. Every night, an automatic job deletes applications that are more than 12 months old, unless the person joined SDC. It also deletes their history and alerts. Uploaded documents are marked for deletion at the same time and removed from storage the next time our HR team opens the recruitment system, usually within a few days.
• If you join SDC: your application becomes part of your employee record and is kept under our employee privacy notice [employee privacy notice to be provided], as long as employment and labour laws require.
• Files uploaded but never submitted: deleted after 2 days.
• Enquiry emails and WhatsApp messages: kept while we discuss your enquiry and, if you become a client, for the contract and the period tax and company law require. Otherwise deleted within [retention period for enquiries to be confirmed by SDC].
• Server logs: kept by our hosting providers for their standard log period, typically a few days to a few weeks. [to be confirmed for Railway and Vercel]

If you ask us to delete your data sooner, we will, unless a law requires us to keep it.

5. Who we share it with

We do not sell your personal data, and we do not share it for advertising. Inside SDC, job applications can be seen only by staff whose role needs them: administrators, HR and payroll, operations managers and senior managers.

We use these service providers (“data processors”), who handle data only on our instructions:

• Supabase — database and private file storage for job applications.
• Railway and Vercel — hosting for this website and our application server.
• Cloudflare — the Turnstile spam check, only if we switch it on.

When you contact us by email or WhatsApp, the message passes through those services, which act under their own terms. Our email address is a Google Gmail account, and WhatsApp is run by Meta. Google Fonts is described in section 2.

We will disclose personal data to the police, a court or another authority only when the law requires it, or to protect someone’s safety in an emergency.

6. Where your data is stored

Our database and the documents you upload are stored in Mumbai, India (AWS ap-south-1).

Our web hosting providers and Google Fonts may process requests on servers outside India. Web server region: [to be confirmed for Railway and Vercel]. The DPDP Act allows transfers outside India except to countries the Central Government restricts. We will not transfer data to any restricted country.

7. How we protect it

We take reasonable security measures, as the IT Rules 2011 and the DPDP Act require. They include:

• Encryption in transit (HTTPS) on every page and upload.
• Uploaded documents go to a private storage area. There are no public links. Only PDF and image files up to 5 MB are accepted.
• Applicants can send an application but cannot read anything back. Database rules allow only authorised SDC staff to see applications.
• Staff open documents through a link that expires after two minutes, and every time a document is opened it is logged with the staff member’s name.
• Every change of status on an application is recorded.
• Limits on repeated submissions, and checks on every field, in the browser and again in the database.

No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require, and tell you what we are doing about it.

8. Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you and how we use it, and who we have shared it with.
• Correction and completion — fix anything that is wrong or incomplete, or update it.
• Erasure — ask us to delete your data, unless a law requires us to keep it.
• Withdraw consent — as easily as you gave it. We will then stop using that data and delete it.
• Grievance redressal — complain to us and get a reply.
• Nominate — name another person to use these rights for you if you die or become unable to.

How to use them

1. Email sdcpvtltd01@gmail.com, or call or WhatsApp +91 99803 43925. If you applied for a job, give your name, mobile number and your reference number (SDC-APP-…) if you have it.
2. We may ask a question to confirm it is you, for example by calling the mobile number on the application.
3. We acknowledge your request within 24 hours (working days).
4. We complete it within 30 days [confirm timeline], and tell you what we did. If we cannot do what you ask, we will tell you why.

There is no charge. See also Grievance redressal.

9. Children

This website is not meant for children, and we do not knowingly collect personal data from anyone under 18. The job application form accepts applicants aged 18 to 60 only, and checks the date of birth. If you believe a child has sent us personal data, tell us and we will delete it.

10. Cookies and browser storage

We do not use analytics, advertising or tracking cookies. The public pages set no cookies of their own.

• The careers pages remember the language you choose (English, Kannada or Hindi) in your browser’s local storage. It stays on your device and is not sent to us.
• When staff or clients sign in to SDC Command, we set essential cookies to keep the session signed in. These are strictly necessary and are not used for tracking.

If we ever add analytics or other non-essential cookies, we will ask for your consent first with a banner.

11. SDC Command portal

SDC Command is our system for employees and clients who sign in. Employees’ data in it is covered by a separate employee privacy notice [to be provided]. Client data is handled under our agreements with each client [to be provided]. The public demo of SDC Command uses sample people and sites. Please do not enter real personal data into it.

12. Grievance Officer

If you have a question or complaint about how we handle your personal data, contact our Grievance Officer:

Name

[Grievance Officer name]

Designation

[designation]

Email

[officer email]

Phone

[officer phone]

Data protection contact

[same as Grievance Officer unless SDC says otherwise]

Post

SDC Security & Facility Services Pvt. Ltd., No. 102, Kempamma Layout, Mariyappana Palya, Bengaluru 560 056

Until the officer’s details are published, write to sdcpvtltd01@gmail.com. How we handle complaints is set out on the Grievance redressal page.

13. Complaints to the Data Protection Board of India

If you are not satisfied with our reply, or we do not reply in time, you may complain to the Data Protection Board of India, set up under the DPDP Act. The Board expects you to raise the complaint with us first.

14. Changes to this policy

We will update this policy when the way we handle data changes, or when the law changes. The date at the top shows when it was last updated. If a change affects how we use data you have already given us, we will tell you before it applies, where we have a way to contact you.

Job applications, in Kannada and Hindi