Privacy Policy

Last updated: 19-10-2026

This policy explains what personal data GuardMatic (a FACILINK service) handles, why, and your choices. It is written to follow the Digital Personal Data Protection Act, 2023 (India).

1. Who is responsible

Your security agency decides what data to collect about its staff and sites (it is the data fiduciary). FACILINK runs GuardMatic for the agency and processes the data on its instructions.

2. What we collect

• Staff details: name, mobile number, employee code, site, role, and details the agency adds such as date of birth, address, emergency contact, education, ID document, PF UAN, ESIC, police verification and training records.
• Attendance: check-in and check-out time, GPS location at that moment, and a selfie taken live in the app.
• Patrol and work records: QR checkpoint scans, incidents, photos, leave requests, visitor entries.
• Location during duty: only where the agency uses Guard Tracking, and only while the person is on duty with the app open.
• Login data: sign-in time, device and IP address, used for security.
• Contact form: name, email, number, company and message you send us.

3. Why we use it

• To record attendance, patrols and incidents for the agency and its clients.
• To prepare payroll, compliance (PSARA) and client reports.
• To send alerts such as missed patrols and SOS to the right people.
• To keep accounts secure and to give support.

We do not sell personal data and do not use it for advertising.

4. Who can see it

• People in your agency according to their role (for example a supervisor sees only their site).
• The agency's client contacts, only for their own sites and only what the agency allows.
• FACILINK support staff, only when needed to run or fix the service.
• Service providers we use for hosting, email and SMS, under confidentiality.
• Authorities, when the law requires it.

5. How long we keep it

• Check-in selfies: 90 days, then deleted automatically.
• Attendance and work records: while the agency's account is active, for payroll and legal records.
• Removed staff can be restored by the Admin for 24 hours; after that their login is closed for good, while past records stay for reports.

6. Security

Data is sent over HTTPS. Passwords and PINs are stored only in encrypted (hashed) form. ID documents are kept in a private area that cannot be opened from the web. Access is limited by role.

7. Your rights

You can ask to see, correct or delete your personal data, or withdraw consent, through your agency's Admin. If the agency cannot help, use Contact on the login page and we will assist. Some records may need to be kept by law.

8. Changes and contact

We may update this policy; the date at the top shows the latest version. Questions or complaints: use Contact on the login page.