Privacy Policy

Effective Date: 1^st October 2026

1. Introduction

GuardMatic is a Security Operations Management platform owned and operated by Bhawish Technologies Private Limited ("Company", "we", "us" or "our").

This Privacy Policy explains how personal data may be collected, used, stored, disclosed, protected and deleted when individuals interact with GuardMatic.

The Platform supports security operations, including personnel management, attendance, patrols, incident reporting, visitor management, access records, operational reporting and related workflows.

We recognise the importance of protecting personal data and seek to handle it responsibly in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the applicable Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as they come into force.

This Policy should be read together with the applicable customer agreement, subscription agreement and Data Processing Agreement, where relevant.

2. Scope of This Policy

This Policy applies to personal data processed in connection with:

• The GuardMatic website and product enquiries.
• Customer account registration and administration.
• Security personnel and workforce management.
• Attendance and duty management.
• Guard patrol and monitoring workflows.
• Visitor registration and management.
• Incident reporting and investigation.
• Customer support and communications.
• Platform security, troubleshooting and maintenance.
• Other features made available through GuardMatic.

Some information is submitted by organizations using GuardMatic rather than directly to the Company.

Where a Customer determines the purposes and means of processing personal data and the Company processes that information on the Customer's behalf, the Customer may be the Data Fiduciary and the Company may act as its Data Processor.

The actual roles depend on the circumstances and applicable law.

Where the Company determines its own purposes and means of processing, it will fulfil the obligations applicable to that processing.

3. Categories of Personal Data We May Process

The information processed depends on the features enabled by the Customer and how the Platform is used.

3.1 Account and Customer Information

This may include:

• Name.
• Business email address.
• Mobile number.
• Job title or designation.
• Organization name.
• Login credentials and authentication information.
• Account preferences.
• Subscription and billing information.
• Support requests and correspondence.

3.2 Security Personnel Information

Where the relevant features are enabled, the Platform may process:

• Name and contact information.
• Employee or personnel identification number.
• Designation and assigned role.
• Photograph.
• Employer or security agency details.
• Site deployment and shift assignments.
• Attendance records.
• Training or qualification records submitted by the Customer.
• Patrol and duty completion records.
• Work-related incident reports.

Customers are responsible for determining which information is necessary for their employment and security operations and for ensuring that the collection and use of such information are lawful.

3.3 Visitor Information

Depending on the facility's configuration, the Platform may process:

• Visitor name.
• Mobile number and email address.
• Organization or company name.
• Host or person to be visited.
• Purpose of visit.
• Visit date and time.
• Entry and exit timestamps.
• Vehicle registration number.
• Visitor photograph.
• Identity verification status.
• Identity document details or images, where enabled.
• Visitor pass information.
• Visit approval records.
• Relevant security incident information.

Customers should avoid collecting complete identity documents or other excessive information where a less intrusive method is sufficient.

Identity document collection and retention must be assessed against the applicable legal requirements.

3.4 Patrol and Location Information

Where patrol or location features are enabled, the Platform may process:

• Assigned patrol routes.
• Checkpoint identifiers.
• Patrol timestamps.
• Location information.
• Duty completion status.
• Related supervisor verification records.

The extent of location collection depends on the feature configuration.

Customers should inform affected personnel about applicable monitoring practices and ensure that location collection is necessary and lawful.

3.5 Incident and Security Information

The Platform may contain:

• Incident descriptions.
• Photographs and attachments.
• Statements or observations submitted by users.
• Relevant personnel and visitor details.
• Incident timestamps and locations.
• Actions taken.
• Investigation notes.
• Corrective action records.

Such information may concern individuals other than the person who submitted the report. Customers should ensure that access is restricted and that unnecessary personal information is not included.

3.6 Technical and Usage Information

When individuals access the Platform, technical information may be processed, depending on the implementation.

This may include:

• IP address.
• Browser and device information.
• Authentication events.
• Login timestamps.
• Error and diagnostic logs.
• Security alerts.
• Administrative activity.
• Audit trail information.

These records may be used to protect the Platform, troubleshoot problems, investigate misuse and maintain service reliability.

3.7 Sensitive Operational Features

Certain customers may enable additional features, such as CCTV integrations, identity verification or biometric identification.

Where such features are available, their use will be subject to the applicable product configuration, customer agreement and legal requirements.

Customers must assess whether the proposed collection is necessary and lawful and must implement appropriate safeguards.

GuardMatic should not be understood as providing blanket legal authorization for facial recognition, biometric processing or any particular surveillance practice.

4. Sources of Personal Data

Personal data may be obtained:

• Directly from an individual.
• From a Customer or its authorized administrator.
• From a security agency or facility management company.
• From an authorized host or reception employee.
• Through attendance, patrol or visitor management workflows.
• From devices or integrations configured by a Customer.
• From service providers supporting the Platform.
• From other lawful sources relevant to the stated purpose.

Where a Customer submits personal data concerning another individual, the Customer is responsible for ensuring that the submission and subsequent processing are lawful and that any required notice or consent obligations are fulfilled.

The Company will handle such information according to its role and applicable obligations.

5. Purposes of Processing

Personal data may be processed for specified and lawful purposes, including:

Security operations: Managing security personnel, duty assignments, attendance, patrols and related workflows.

Visitor management: Registering visitors, facilitating host approval, issuing visitor passes and maintaining relevant entry and exit records.

Incident management: Recording, investigating and managing security incidents and corrective actions.

Account administration: Creating and managing customer and user accounts.

Service delivery: Providing the Platform and enabling the features requested by the Customer.

Security and fraud prevention: Protecting accounts, investigating suspicious activity and preventing unauthorized access.

Technical support: Diagnosing faults, responding to support requests and improving reliability.

Reporting: Generating operational reports and analytics for authorized users.

Legal compliance: Meeting applicable legal obligations and responding to lawful requests from competent authorities.

Billing and contractual administration: Managing subscriptions, payments and customer relationships.

Service improvement: Diagnosing problems and improving Platform functionality, using appropriate safeguards and only where permitted by the applicable legal basis and agreement.

We will not treat a person's participation in a security or visitor registration process as unrestricted permission to use their information for unrelated purposes.

Where the Company processes personal data on behalf of a Customer, the processing will be governed by the applicable instructions and agreement, subject to Applicable Law.

6. Lawful Basis for Processing

Personal data will be processed on a lawful basis applicable to the relevant processing activity.

Depending on the circumstances, this may include consent where required, certain legitimate uses recognized by the DPDP Act or another applicable statutory provision.

We will not assume that every processing activity requires consent or that every processing activity is authorized merely because it relates to security.

Where consent is relied upon, the applicable requirements concerning notice, informed and specific consent, withdrawal and related obligations must be met.

Where processing is based on another lawful ground, the responsible organization must ensure that the requirements of that ground are satisfied.

Customers remain responsible for determining the appropriate basis for processing that they control.

7. Privacy Notices and Consent

Where required, individuals will be provided with a clear privacy notice explaining the personal data being collected and the purposes for which it will be processed.

Depending on the relevant workflow, the notice may be presented during:

• Visitor registration.
• Security personnel registration.
• Customer account creation.
• Collection of photographs or identity information.
• Activation of optional monitoring features.
• Other relevant data collection activities.

Where consent is required, the responsible organization must implement an appropriate consent mechanism.

The Platform may support the recording of consent status, date and time, notice version and related information, depending on the features enabled.

A record that a notice was displayed is not, by itself, proof that valid consent was obtained.

Where consent is withdrawn, the responsible organization must assess and implement the consequences required by Applicable Law, including any related effect on processing by service providers.

8. Data Sharing and Disclosure

Personal data may be shared where necessary for the stated purposes and permitted by Applicable Law.

Potential recipients may include:

• The Customer operating the relevant facility.
• Authorised facility managers and administrators.
• Security agencies and authorised supervisors.
• Reception and visitor management personnel.
• Hosting and infrastructure providers.
• Messaging and notification providers.
• Technical support providers.
• Identity verification providers, where enabled.
• Professional advisers.
• Competent authorities where disclosure is required or permitted by law.

Access should be limited to the information necessary for the recipient's role.

Where third-party providers process personal data on our behalf, appropriate contractual and security arrangements will be established as required.

Where the Company processes personal data solely on a Customer's behalf, the Customer's agreement and instructions will govern authorized disclosures, subject to Applicable Law.

We do not intend to sell personal data as a standalone commercial product.

9. Data Retention

We retain personal data only for as long as necessary for the applicable purposes, subject to legal obligations, contractual requirements and other lawful grounds for continued retention.

Retention periods may differ by record category.

Examples include:

• Visitor registration and entry/exit records.
• Security personnel attendance records.
• Patrol and location records.
• Incident reports.
• Identity documents.
• Photographs.
• Customer account information.
• Technical and security logs.
• Billing and contractual records.

Customers may configure retention settings where the Platform supports that functionality.

The appropriate retention period must be determined according to the relevant purpose, applicable law, contractual requirements and operational risks.

We do not represent that one fixed retention period is appropriate for every category of personal data.

When personal data is no longer required and no applicable exception or retention obligation applies, it will be deleted or anonymized in accordance with the relevant retention process.

Where necessary, deletion may be delayed because of a legal hold, ongoing investigation, dispute or applicable statutory requirement.

Personal data contained in backups will be handled according to the applicable backup-retention and deletion procedures.

10. Data Security

We will implement appropriate technical and organizational safeguards for the personal data we process, taking into account our role, the nature of the information, the risks involved and applicable legal obligations.

Depending on the service configuration, safeguards may include:

• Authentication and access controls.
• Role-based permissions.
• Encryption in transit and where implemented, at rest.
• Secure configuration and software maintenance.
• Monitoring and audit logs.
• Backup and recovery procedures.
• Access reviews.
• Security incident response procedures.
• Appropriate confidentiality obligations.
• Controls over third-party access.

Customers are also responsible for configuring their accounts, managing user access and ensuring that authorized users follow appropriate security practices.

No electronic transmission or storage system can be guaranteed to be completely secure.

11. Personal Data Breaches

If a personal data breach affects information processed by the Company, we will assess and respond to the incident in accordance with Applicable Law and the relevant customer agreement.

Our response may include:

• Investigating the incident.
• Identifying affected systems and records.
• Containing the incident.
• Taking appropriate remedial measures.
• Informing affected Customers as required.
• Supporting legally required notifications.
• Documenting corrective actions.

Where a Customer controls the relevant processing, it remains responsible for the breach-notification obligations assigned to it by Applicable Law.

The parties will cooperate as reasonably necessary to investigate incidents and fulfil applicable notification requirements.

12. Rights of Individuals

Subject to Applicable Law and the circumstances of the processing, individuals may have rights concerning their personal data.

These may include:

• Access to information about personal data being processed.
• Correction of inaccurate or incomplete personal data.
• Updating personal data.
• Erasure of personal data where applicable.
• Withdrawal of consent where consent is the basis for processing.
• Grievance redressal.
• Nomination of another individual, where applicable under the DPDP Act.

Where the Company acts as a Data Processor for a Customer, requests relating to Customer-controlled data may need to be directed to the relevant Customer.

Where the Company has independent responsibilities, individuals may contact the Company using the details provided in this Policy.

Requests may be subject to reasonable verification and applicable legal exceptions.

Erasure requests do not necessarily require the immediate deletion of all records where retention is required or permitted by Applicable Law.

13. How to Exercise Your Rights

Individuals may submit privacy requests or complaints to the relevant organization using its designated contact details.

For requests concerning personal data controlled by a Customer, please identify the relevant organization or facility wherever possible.

For requests concerning processing controlled by the Company, contact:

Privacy Contact: Wilsun Seelvaraj
Email: wilsun@facilink.co.in
Postal Address: B-609, Raj Tower CHS, I.C. Colony, Borivali West, Mumbai – 400103.

We will review requests and respond within the timelines applicable under law.

If we are acting as a Data Processor, we may forward a request to the relevant Customer or assist that Customer in responding, as appropriate.

14. Children's Personal Data

GuardMatic is primarily intended for organizational security operations.

Customers should avoid collecting children's personal data unless it is necessary for a lawful and specified purpose.

Where children's personal data is processed, the responsible organization must comply with the applicable requirements of the DPDP Act and DPDP Rules, including applicable requirements concerning parental consent and restrictions on certain processing activities, subject to statutory exceptions.

Customers must configure relevant workflows appropriately and avoid unnecessary collection of children's information.

15. Location Information and Monitoring

Certain features may collect location information or records of activities performed by security personnel.

These features should be enabled only for defined and lawful operational purposes.

Customers must determine whether the proposed monitoring is necessary and proportionate and must provide any required notices or obtain any required consent.

Access to location records must be appropriately restricted and retention periods should be configured according to the applicable purpose and requirements.

16. International Processing and Data Transfers

Depending on the hosting configuration and third-party services used, personal data may be processed or stored in India or another jurisdiction.

Any transfer of personal data outside India will be handled in accordance with Applicable Law, including applicable restrictions, government requirements and contractual obligations.

Customers requiring a particular hosting location should confirm the applicable arrangements with the Company before entering into a subscription.

17. Third-Party Websites and Services

The Platform may contain links to or integrations with third-party websites and services.

Those providers may have separate privacy policies and processing practices.

The Company is not responsible for independent processing by third parties outside its control, subject to its own legal obligations and any applicable contractual commitments.

Individuals should review the privacy policies of relevant third-party services where appropriate.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Platform, processing practices, Applicable Law or business operations.

The revised version will identify the updated effective date.

Where required by law, we will provide notice of material changes or obtain additional consent.

The current version will be made available through www.guardmatic.in.

19. Grievances and Complaints

Individuals may submit privacy-related grievances using the contact details below.

Privacy Contact / Grievance Contact: Wilsun Seelvaraj
Email: wilsun@facilink.co.in
Postal Address: B-609, Raj Tower CHS, I.C. Colony, Borivali West, Mumbai – 400103.

We will review and address grievances in accordance with Applicable Law and the applicable grievance-handling process.

Nothing in this Policy limits any statutory rights or remedies available to an individual.

20. Contact Us

For questions concerning this Privacy Policy or our data handling practices:

Product: GuardMatic By FACILINK
Legal Entity: Bhawish Technologies Private Limited
Registered Address: B-609, Raj Tower CHS, I.C. Colony, Borivali West, Mumbai – 400103.

Email: hello@facilink.co.in
Privacy Contact: hello@facilink.co.in
Website: www.guardmatic.in