Privacy Policy

SecureSearch Screening Services Private Limited (“SecureSearch”, “we”, “us”, or “our”) is a provider of background screening and verification services. We support organisations in India and globally by delivering a comprehensive range of verification solutions.

Our services are grounded in established industry practices and a strong understanding of the regulatory and operational environments in which we operate.

We are committed to handling personal data responsibly and in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (of India).

This Privacy Policy explains how we collect, use, share, store, and protect personal data, and outlines the rights available to individuals.

This Policy applies to:

• visitors to our website;
• individuals undergoing background checks; and
• business contacts, vendors and clients.

Personal Data: Any data about an individual who can be identified by or in relation to that data.

Sensitive Personal Data: A subset of personal data that, by its nature, requires additional protection (for example, financial information, health information, biometric data, or government identifiers), as may be specified under applicable law.

Data Principal: The individual to whom personal data relates. In our context, this is typically a candidate, employee, vendor representative, or website visitor.

Data Fiduciary: The person or entity that determines the purpose and means of processing personal data under the Digital Personal Data Protection Act, 2023 (of India). The equivalent role under the EU/UK General Data Protection Regulation and certain other data protection laws is termed “Data Controller”.

Data Processor: The person or entity that processes personal data on behalf of a Data Fiduciary or Data Controller.

Processing: Any operation performed on personal data, such as collection, recording, storage, use, disclosure, transfer, or deletion.

Client: An organisation that engages SecureSearch to perform background screening or related services.

We collect only that personal data that is necessary for the relevant purpose and in line with applicable legal requirements.

Depending on the nature of the engagement, this may include:

• identity details such as name, date of birth, photograph, and government-issued identifiers (where permitted);
• contact details such as address, email, and phone number;
• employment and education history;
• professional qualifications and certifications;
• financial and/or criminal record information, where required and legally permitted; and
• limited technical data when you interact with our website, such as IP address, browser type, and usage information.

We may collect this information directly from you, from our Clients, or from authorised verification sources such as employers, educational institutions, public records, and regulatory bodies.

We collect and process personal data for specified, legitimate, and lawful purposes only. The principal purposes are:

• to verify your identity, employment history, education, professional qualifications, and other information at the request of our Client and subject to your purpose-specific consent;
• to compile and deliver a background screening report to our Client to support their hiring, on-boarding, retention, vendor on-boarding, or compliance decisions;
• to perform contractual obligations under our agreement with our Client;
• to comply with applicable legal, regulatory, and industry standards (including the DPDP Act, the Information Technology Act, and PBSA standards);
• to operate, maintain, and secure our Website and IT systems;
• to respond to your enquiries, requests, and complaints;
• to recruit and on-board our own employees and vendors;
• to detect, investigate, and prevent fraud, security incidents, and unlawful activity; and
• to defend or pursue legal claims and to comply with lawful requests from authorized public authorities.

SecureSearch does not sell personal data, and does not use personal data collected for screening purposes for marketing communications. We collect, store, handle, and process your personal data with the same degree of care and security as we apply to the personal data of our own organisation, employees, and contractors.

We process personal data in accordance with applicable law, including the Digital Personal Data Protection Act, 2023, based on one or more of the following:

Consent
Personal data is processed based on consent provided by you, or, where SecureSearch acts as a Data Processor, on the basis of consent collected by our Client (the Data Fiduciary) from you in accordance with applicable law. Consent may be withdrawn at any time, subject to applicable legal and contractual limitations.

Legitimate use – employment purposes

Processing may be necessary to assess suitability for employment, engagement, or onboarding, in accordance with applicable law.

Legal obligations

Processing may be required to comply with applicable laws, regulations, court orders, or lawful requests from authorities.

Contractual necessity

Processing may be necessary to fulfil contractual obligations with our Clients or with you.

Where SecureSearch acts as a Data Processor, the lawful basis for processing is determined by the Client (Data Fiduciary).

When acting as a Data Processor

When we provide services on behalf of a Client, we process personal data strictly in accordance with the Client’s documented instructions and our contractual obligations. We do not use such data for any other purposes, including marketing or profiling.

When acting as a Data Fiduciary / Controller

When we process personal data for our own purposes (such as for employees, applicants, vendors, or website users), we use the data only for the purposes described in this Policy and to the extent necessary.

Our Data Protection Principles

We apply the following principles to all personal data processing:

• Purpose limitation: Personal data is used only for the purpose for which it was collected.

• Data minimization: We collect only the data that is necessary for the intended purpose.

• Accuracy: We take reasonable steps to keep personal data accurate and up to date.

• Storage limitation: Personal data is retained only for as long as required for the purpose and applicable legal obligations.

Data Sharing: We share personal data only as necessary for the purposes described in this Policy and in accordance with applicable legal, regulatory, and contractual requirements, and only with parties bound by appropriate confidentiality and data protection obligations.

Specifically, we may share personal data with:

• • The Client who engaged us – to deliver background screening reports to the Client or their authorised representatives
  • Verification sources – including, but not limited to government authorities, educational institutions, current and former employers, referees, and regulatory bodies, strictly to the extent required for verification
  • Authorized sub-processors and service providers – such as courier partners, on-site verification vendors, IT and cloud service providers, and analytics providers, engaged under written agreements with appropriate data protection obligations
  • Professional advisers – including auditors, legal counsel, and consultants, bound by confidentiality obligations
  • Law enforcement and regulatory authorities – where required to do so in accordance with applicable law or lawful process
  • Successor entities – in connection with a merger, acquisition, restructuring, or sale of business, subject to continued protection of personal data

We do not sell personal data or share it with third parties for their own marketing purposes.

SecureSearch Screening Services Private Limited (“SecureSearch”, “we”, “us”, or “our”) is a provider of background screening and verification services. We support organisations in India and globally by delivering a comprehensive range of verification solutions.

Our services are grounded in established industry practices and a strong understanding of the regulatory and operational environments in which we operate.

We are committed to handling personal data responsibly and in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (of India).

This Privacy Policy explains how we collect, use, share, store, and protect personal data, and outlines the rights available to individuals.

This Policy applies to:

• visitors to our website;
• individuals undergoing background checks; and
• business contacts, vendors and clients.

We store personal data on secure systems hosted with reputable infrastructure providers, with primary data centres located in India, unless otherwise required by the Client or applicable law.

We protect personal data using technical and organisational measures in accordance with applicable legal and regulatory requirements, including:

• Access controls based on the principle of least privilege, including role-based access and multi-factor authentication
• Encryption of personal data in transit (e.g., TLS) and at rest, where applicable
• Network and endpoint security controls, including firewalls, intrusion detection/prevention systems, anti-malware, patching, and system hardening
• Logging and monitoring of access to systems and data
• Secure handling and storage of physical records
• Limiting access to and processing by background-verified personnel bound by confidentiality obligations, with role-based training and periodic awareness
• Information security practices aligned with ISO/IEC 27001 and privacy controls aligned with ISO/IEC 27701
• Regular internal and external assessments, including vulnerability testing and audits

In the unlikely event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with applicable law, including prescribed timelines.

We retain personal data in accordance with applicable legal, regulatory, and contractual requirements, and only for as long as necessary to fulfil the purpose for which it was collected.

Retention periods

As a Data Processor: Retention is governed by client instructions and contractual terms. Data is returned or securely deleted at the end of the agreed period or earlier upon instruction.

As a Data Fiduciary: Personal data is retained in accordance with applicable laws and record-keeping requirements for as long as necessary to provide services.

Audit and compliance records: Certain records (e.g., logs, supporting documents) are retained in accordance with our internal Records Retention Schedule, including for accreditation and legal defence purposes.

Secure destruction practices followed at SecureSearch

When personal data is no longer required, it is securely destroyed or anonymised in accordance with our information security policies, so that it cannot be reconstructed:

• Electronic records are securely deleted, and backups are purged in accordance with retention cycles
• Physical records are shredded or securely disposed of via authorised vendors
• Destruction logs are maintained for audit and compliance purposes
• Where data is anonymised, it is no longer attributable to an identifiable individual.

Subject to applicable law, you have the following rights:

• Right to access — to confirm whether we process your data and obtain a summary
• Right to correction — to correct inaccurate or incomplete data
• Right to erasure — to request deletion, subject to legal or contractual obligations
• Right to withdraw consent — where processing is based on consent
• Right to grievance redressal — to raise concerns about data handling
• Right to nominate — to appoint another person to exercise your rights in case of incapacity

Where a background check is initiated by an employer or client (acting as the Data Fiduciary), your rights are generally exercised through them. If you contact us directly, we will coordinate with the client and act in accordance with applicable law.

We may verify your identity before processing requests and will respond within timelines prescribed under applicable laws.

This Policy is published on our website at [www.securesearch.in/privacy-policy] so that it is freely available to clients, candidates, and the public at large. In addition, you may obtain a copy of this Policy or raise any privacy-related question, request, or grievance through any of the following channels:

• by email to our Privacy Office at dpo@securesearch.co.in
• by post to: SecureSearch Screening Services Private Limited, Attention: Privacy Office, A-703 & 704, Arihant Aura, Plot Number: 13/1, TTC Industrial Area, Turbhe MIDC, Navi Mumbai – 400 705 India;
• by telephone on +91-86579 58174 during business hours; or
• through the privacy request form available on our website.

On request, we will provide a copy of this Policy by email or by post, free of charge.

Data Protection Officer:

In compliance with the DPDP Act and the Information Technology Rules, our designated Data Protection Officer is:

• Name: Darshana Popat
• Email: dpo@securesearch.in

We acknowledge complaints within 07 days and aim to resolve them within the timelines prescribed by applicable law. If you are not satisfied with our response, you may approach the Data Protection Board of India or other competent authority in accordance with applicable law.

Our website uses cookies and similar technologies to operate the site, analyse usage, and improve performance.

Our website may contain links to third-party websites and services. This Policy does not apply to those third-party sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy notices of any third-party site you visit.

We review this Policy at the periodicity mandated by our Information Security Framework and whenever there is a material change in our processing activities or in applicable law. The “Last Updated” date at the top of this Policy reflects the date of the most recent update. We encourage you to review this Policy periodically.

This Policy is governed by the laws of India. Any disputes relating to this Policy will be subject to the exclusive jurisdiction of the courts at Mumbai, India.