Comprehensive privacy policy compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) and Information Technology Act, 2000 detailing how SupervisionPro collects, stores, processes, and protects agency and guard data.
Version 1.1.0 Effective: 2025-01-01 Published & Enforceable
Compliance Framework: Digital Personal Data Protection Act, 2023 (DPDP Act 2023), Information Technology Act, 2000, Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and Google Play Developer Program Policies (Data Safety & Account Deletion Standards).
1. Introduction & Overview
NBCA Skill (OPC) Pvt. Ltd. ("Company", "We", "Us", or "Our") operates the SupervisionPro platform (supervisionpro.in), comprising our cloud web dashboards, mobile applications, backend application programming interfaces (APIs), and associated digital services (collectively, the "Platform" or "Service").
This Privacy Policy applies to all users of SupervisionPro, including security agency owners, operations directors, client site administrators, and field security guards ("Users", "Data Principals", or "You"). It specifically covers our officially distributed mobile applications:
We are committed to respecting and safeguarding your personal data in strict compliance with the laws of India and global application marketplace standards.
Important Legal Classification (DPDP Act 2023):
- Data Processor Role: Where a subscribing security agency onboards its workforce, deployment sites, and guard personnel, SupervisionPro operates as a Data Processor processing data strictly on the lawful instructions and operational requirements of the subscribing agency.
- Data Fiduciary Role: The subscribing Security Agency acts as the Data Fiduciary responsible for ensuring a lawful basis (such as employment necessity or express consent) under Section 6 and Section 7 of the DPDP Act 2023. Where you interact directly with our public website, contact forms, or subscription billing, SupervisionPro acts as the Data Fiduciary.
2. Categories of Personal Data Collected
In order to deliver security workforce management, patrol route verification, attendance logging, and emergency incident dispatch, we collect and process the following categories of data:
A. Agency & Administrator Information
Registration Data: Full legal name, corporate email address, verified mobile phone number, agency trade name, GSTIN (Goods and Services Tax Identification Number), registered office address, and billing contact details.
Authentication Identifiers: One-Time Password (OTP) verification logs, encrypted password hashes, active session tokens, and IP addresses.
B. Security Guard & Field Staff Personal Data
Profile Attributes: Full legal name, verified mobile phone number, employee badge ID, assigned agency, deployed client site, designation, uniform size, blood group, and emergency contact details.
Biometric Reference Template (1:1 Face Match): Profile photograph captured during guard onboarding, utilized exclusively as a reference baseline for one-to-one (1:1) facial similarity comparison during attendance clock-in and clock-out.
Shift Attendance Photos: Real-time selfie photographs captured at the exact moment of clock-in and clock-out to eliminate buddy-punching and ghost shifts.
C. Geolocation & Patrol Tracking Data
GPS Coordinates (Precise & Coarse): Latitude, longitude, accuracy radius (in meters), speed, and device timestamp collected strictly during active on-duty shift hours or during active patrol checkpoint scans.
Checkpoint Verification Logs: QR code scan payloads, NFC tag readings, optical photo attachments of security checkpoints, and incident reports submitted from the field.
Offline Patrol Log Buffer: Encrypted local log entries cached on the device during cellular network interruptions, automatically synchronized upon network reconnection.
D. Client & Visitor Gate Pass Logs (Agency Operated)
Visitor Entry Records: Visitor name, contact phone number, vehicle registration number, destination host/unit, photo snapshot, entry timestamp, and exit timestamp recorded by on-duty guards.
Material Movement Documentation: Inward/outward material passes, delivery challan numbers, carrier identification, and supervisor authorization signatures.
E. Technical & Diagnostic Telemetry
Operating system version, device model, battery status (used to diagnose aggressive OEM background process killing), application crash traces, and encrypted HTTPS network telemetry.
3. Mobile Application Permissions & Operational Disclosures (Google Play Compliance)
Our mobile applications request runtime permissions strictly for core operational functions. Below is an exhaustive breakdown of Android permissions utilized by SupervisionPro Guard (com.supervisionpro.guard) and SupervisionPro Agency (com.supervisionpro.agency):
Permission Name
App Utilizing
Purpose & Justification
Tracking Limitation
ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION
Guard & Agency
High-precision GPS geofencing to verify guard attendance at client sites, ensure physical presence at patrol checkpoints, and transmit coordinates during emergency SOS panic triggers.
Shift-Only Monitoring: Location is tracked exclusively during active, clocked-in shifts. Off-duty background tracking is technically disabled.
CAMERA
Guard App
1. Scanning physical QR codes affixed to site checkpoints.<br />2. Capturing real-time selfies for 1:1 facial attendance verification.<br />3. Capturing photo attachments for incident reports and visitor passes.
Camera is invoked solely upon explicit user action within scanning/photo modals. No passive or unauthorized recording occurs.
POST_NOTIFICATIONS
Guard & Agency
Delivering critical duty shift reminders, supervisor dispatch announcements, checkpoint schedules, and urgent emergency SOS panic broadcasts.
Configurable via system notification settings.
WAKE_LOCK & USE_FULL_SCREEN_INTENT
Agency App
Waking the screen and presenting immediate full-screen siren alarms when an on-duty guard in danger triggers an emergency SOS panic button.
Restricted to life safety and emergency panic alerting.
VIBRATE
Guard & Agency
Providing haptic confirmation upon successful QR checkpoint scan and vibrating during emergency alarms.
Operational feedback only.
Local Storage / Cache
Guard & Agency
Encrypted local SQLite/IndexedDB queue for caching patrol scans and incident photos when working offline in basements or cellular dead zones.
Automatically purged upon successful cloud synchronization.
4. Third-Party Software Development Kits (SDKs) & Sub-Processors
We integrate only essential, security-vetted third-party SDKs to support core functionality:
1
Google Firebase Cloud Messaging (FCM): Used to transmit low-latency push notifications for shift schedules, checkpoint reminders, and emergency SOS alerts.
2
Google Firebase Crashlytics: Used to collect anonymous crash telemetry, stack traces, and device hardware diagnostics to ensure mobile application stability across Android device versions.
3
Telecom DLT SMS Gateways: Government of India DLT-approved telecommunication gateways for delivering two-factor authentication OTPs.
4
Cloud Infrastructure & Storage: Enterprise-grade cloud servers physically hosted within India for secure API hosting and encrypted photo evidence storage.
Zero Third-Party Advertising Commitment:
We DO NOT embed third-party advertising SDKs, behavioral tracking trackers, or data-broker libraries in our mobile apps or web platforms. We never monetize, rent, or sell personal data or location coordinates to third parties.
We process personal data only under recognized legal grounds:
1
Consent (Section 6, DPDP Act 2023): Affirmative, informed consent provided upon registration or app permission prompts.
2
Contractual Performance: Execution of the SaaS subscription agreement with your security agency.
3
Legitimate Employment & Operational Uses (Section 7, DPDP Act 2023): Verification of guard presence, preventing time theft, physical perimeter protection, and life safety at protected client premises.
4
Legal & Regulatory Compliance: Maintaining audit logs mandated under the Private Security Agencies (Regulation) Act, 2005 (PSARA), Indian tax laws, and CERT-In cyber security directives.
6. Data Storage, Security & Localization
Data Hosting within India: All databases, encrypted attendance selfie buckets, and patrol archives are hosted in secure enterprise cloud data centers located within the Republic of India.
End-to-End Encryption: All network transmissions between mobile applications, browser portals, and backend APIs are mandated over TLS 1.3 encryption.
Encryption at Rest: Sensitive credentials, session tokens, and database snapshots are encrypted using high-grade AES-256 cryptographic standards.
Multi-Tenant Isolation: Cryptographic tenant separation and row-level access controls prevent unauthorized cross-agency data exposure.
7. Account and Data Deletion Policy (Google Play & DPDP Act Mandate)
We provide comprehensive, readily accessible mechanisms for users to request deletion of their account and associated personal data at any time:
A. How to Delete Your Account In-App
1
SupervisionPro Guard App:
Navigate to the Profile tab in the bottom navigation bar.
Scroll down to the account actions section and tap "Delete My Account & Personal Data".
Confirm the deletion prompt.
2
SupervisionPro Agency App:
Navigate to Settings from the navigation menu.
Tap "Delete User Account" under the account options.
Confirm the deletion prompt.
Upon in-app confirmation, your active authentication tokens, device sessions, and FCM notification tokens are terminated immediately, and your profile is anonymized.
B. Online Web Deletion Request (Without App Reinstallation)
If you do not have the mobile application installed or wish to submit an account deletion request via the web, you can:
Or email our Grievance Officer directly at [email protected] or [email protected] with the subject line [ACCOUNT DELETION REQUEST] - [Registered Mobile Number].
C. Deletion Timeline & Data Purge Schedule
Immediate Action (Within 60 Seconds): Active sessions, login credentials, and push notification tokens are permanently revoked.
Profile Anonymization (Immediate): Full legal name, email, phone number, and facial profile photo are unlinked and irreversibly anonymized.
Permanent Purge (Within 30 Days): All temporary cache files, device telemetry, and staging records are permanently purged from active production databases.
Statutory Retention Exceptions: Pursuant to Section 8(7) of the DPDP Act 2023, GST electronic invoicing regulations, and state PSARA guidelines, verified financial tax invoices and statutory guard duty logs are retained for the legally mandated period (up to 8 financial years) solely for statutory audit compliance, after which they are destroyed.
8. Data Principal Rights under DPDP Act 2023
As a Data Principal under Indian law, you have the right to:
1
Access: Request a summary of personal data processed and identities of data processors.
2
Correction & Updating: Correct inaccurate, incomplete, or outdated personal information.
3
Erasure: Request erasure of personal data that is no longer necessary for the stated purpose.
4
Grievance Redressal: Lodge complaints with our designated Grievance Officer or the Data Protection Board of India.
5
Nomination: Nominate an individual to exercise rights in the event of death or incapacity.
9. Children's Privacy (Strict Age Restriction)
SupervisionPro is strictly a Business-to-Business (B2B) enterprise security workforce management platform. It is intended exclusively for individuals aged 18 years or older who are legally employed in security operations. We do not knowingly collect, solicit, or maintain personal data from minors under the age of 18. If we become aware that personal data of a minor has been collected, we will immediately delete such data.
10. Statutory Grievance Officer & Official Contact
In compliance with Rule 3(2) of the Information Technology Intermediary Rules, 2021 and Section 8(9) of the Digital Personal Data Protection Act, 2023, our designated Grievance Officer details are:
Working Hours: Monday to Friday, 10:00 AM to 6:00 PM IST (Excluding Public Holidays)
We will acknowledge grievances within 24 hours and resolve them within 15 business days.
11. Policy Updates & Version History
We may update this Privacy Policy periodically to reflect technological changes, new platform capabilities, or evolving legal frameworks. Substantive updates will be highlighted on this page and notified to agency administrators via email or portal alert.
Statutory Grievance Officer & Data Protection Officer
Designated Redressal Authority under DPDP Act, 2023 & IT Intermediary Rules, 2021
