Privacy Policy

datagate.co.in ("datagate.co.in", "we", "us", "our") operates the consent-based employment verification platform at datagate.co.in. The platform is owned and operated by datagate.co.in, Hyderabad, Telangana, India.

datagate.co.in acts as a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). We determine the purpose and means of processing personal data on this platform.

Employers who access employee data through this platform are independent Data Fiduciaries for their own processing activities and are bound by datagate.co.in's Employer Terms and Data Sharing Agreement.

This policy applies to:

• Employees (Data Principals) — individuals who create a verified employment profile on datagate.co.in
• Employers — organisations that request access to employee profiles for background verification or onboarding
• BGV Vendors — background verification agencies assigned by employers to conduct checks through the platform
• Visitors — anyone who accesses datagate.co.in without creating an account

From employees:

• Full name, email address, mobile number, date of birth, gender, nationality, blood group, marital status
• Identity: Aadhaar number (the standalone field is masked — only the last 4 digits are ever submitted or stored), PAN number, passport (where provided)
• Identity documents you upload as proof: this includes a scanned or photographed copy of your Aadhaar card, which — unlike the masked number field above — necessarily contains your full 12-digit Aadhaar number and photograph, since that's what a valid ID document looks like. This image is stored only to satisfy the identity-verification purpose you're uploading it for, is never displayed as plain text back to an employer, and access to it is restricted the same way as your other uploaded documents — only visible to you, and to an employer or assigned BGV vendor after your consent, never exposed publicly
• Family details: parents' names, and — where applicable — spouse and children's names and dates of birth, collected for company health insurance enrollment purposes
• Emergency contact: name, relationship, and phone number of a person you nominate — used only to reach someone on your behalf in an emergency
• Current and permanent address
• Employment history: employer names, designations, dates of joining and exit, UAN, PF account details
• Bank account details for salary processing: bank name, account holder name, IFSC, account number, and a supporting document (passbook or bank statement)
• Education: qualifications, institutions, years of passing, certificate references
• Documents uploaded by you: certificates, payslips, relieving letters, offer letters
• Digital signature (where applicable, for consent records)
• Consent event logs: timestamps of every approval and withdrawal
• Religion and reservation category — optional fields you may fill in where an employer's statutory reporting or equal-opportunity compliance requires it. Leaving these blank is always allowed, they are never used in any verification or hiring decision on this platform, and they are shared with an employer only under the same consent rules as the rest of your profile
• Disability status — an optional field, with "Prefer not to disclose" always available as an answer, used only so an employer can make reasonable workplace accommodations if you choose to share it

From employers:

• Company name, registered address, GST number (where provided)
• Authorised representative name, designation, work email
• Records of consent requests submitted and their stated purposes
• BGV vendor assignments made through the platform

From BGV vendors:

• Agency name, registered address, operating licences (where applicable)
• Authorised contact name and email
• Case records, check outcomes, and final reports submitted through the platform

Automatically collected:

• Your IP address is read momentarily by a small number of security-sensitive actions (such as first-time admin account setup) purely to rate-limit repeated attempts — it is held only for the length of that short rate-limiting window (a couple of minutes) and is not stored against your account, logged for tracking, or retained afterward
• We do not currently capture browser type, device type, or any persistent session/device identifier, and we do not run any device-fingerprinting or analytics tooling on the platform

Every data share on datagate.co.in requires your active, informed consent. The consent mechanism works as follows:

• You receive a notification identifying the employer and their stated purpose before any data is shared
• You must click Approve — we never pre-approve, auto-approve, or infer consent on your behalf
• Each consent is purpose-limited: if an employer's purpose changes, a new consent request is required
• You can withdraw consent at any time from your dashboard — withdrawal is instantaneous
• On withdrawal, the employer's access is revoked immediately and they are notified of their obligation to delete
• Every approval, access event, and withdrawal is cryptographically logged with a timestamp
• What an employer or BGV vendor receives on approval is fixed at that moment — later changes to your profile do not automatically update what they already have. If you want them to see updated information, you provide a fresh consent

Employers you approve: Only after your explicit consent, strictly for the purpose you approved. Employers are bound by our Employer Terms and Data Sharing Agreement.

BGV vendors assigned by your employer: When an employer assigns a BGV vendor to conduct background checks on their behalf, your data (already approved by you for the employer) may be routed to that vendor through the platform — including any employment reference contact details (name, role, email, mobile) you provided, which the vendor may contact solely to verify your stated employment. BGV vendors are separately bound by datagate.co.in's BGV Vendor Terms and operate only within the scope of the employer's authorised check.

Infrastructure and service providers: We use the following sub-processors to operate the platform. All are bound by data processing agreements and act only on our instructions:

Legal authorities: We may disclose data if required by a lawful order from a competent Indian authority. We will notify you of any such request where legally permitted to do so.

We do not share your data with data brokers, advertisers, analytics companies, or any party not listed above.

All personal data processed by datagate.co.in is stored exclusively on servers located in India — specifically on Amazon Web Services' Mumbai region (ap-south-1). No personal data is transferred outside India except where required by a lawful order of a competent authority or where you explicitly consent to cross-border transfer for a specific purpose.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access — request a summary of personal data we hold about you and a list of all entities it has been shared with
• Right to correction — request correction of inaccurate, incomplete, or outdated personal data
• Right to erasure — delete your account and all associated personal data at any time
• Right to withdraw consent — revoke any employer's access at any time, instantly, from your dashboard
• Right to grievance redressal — raise a complaint with our Grievance Officer (see Section 13)
• Right to nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. This is a right guaranteed to you under the DPDP Act; the ability to record a nomination is being built and will be available on the platform soon.

To exercise any of the above rights (other than nomination, noted above), use your account settings or contact grievance@datagate.co.in. We respond within 7 business days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

The following data elements collected on datagate.co.in are classified as sensitive and handled with additional controls:

• Aadhaar number: Collected with your explicit consent for employment verification purposes only. The standalone Aadhaar number field is masked to its last 4 digits before it ever reaches us — that field never holds the full number. Separately, the ID document you upload as proof (your Aadhaar card image) does contain the full number and your photograph, because that's what the document itself looks like; that image is used only for identity verification, is not re-displayed as extracted plain text, and is access-restricted the same way as your other uploaded documents. We do not authenticate Aadhaar against UIDAI databases.
• PAN number: Encrypted in transit (TLS 1.2+) and at rest by AWS's default database-level encryption. Access is restricted to authenticated requests from your own account, the employer you've approved, or platform admins acting on a support request — never exposed publicly or to any party you haven't consented to share it with. Field-level application encryption specific to PAN is on our security roadmap as a further hardening step, on top of the access controls already in place.
• UAN / PF details: Used to source EPFO-linked employment records. Shared only after your approval.
• Bank account details: Collected for salary-processing purposes only. Shared only with the employer you have explicitly approved, and never used for any other purpose.
• Religion, reservation category, and disability status: Optional. Collected only where an employer's statutory reporting or equal-opportunity compliance requires it, or where you choose to share disability status so an employer can make reasonable accommodations. Never used to make or influence a verification or hiring decision.

Beyond the fields listed above, we do not collect biometric data or political affiliations. Blood group is collected for emergency purposes only.

We implement the following technical and organisational measures:

• All data encrypted in transit (TLS 1.2+) and at rest, via AWS's default database and storage encryption
• Access to production systems restricted to authorised personnel only
• Every consent event (request, approval, decline, withdrawal, deletion) is stored with a server-recorded timestamp and a cryptographic integrity hash (HMAC-SHA256), so any after-the-fact alteration of a stored event is detectable — the record either matches its original hash or it doesn't
• Infrastructure on AWS Mumbai region with VPC isolation
• An automated smoke-test suite runs against every deployment through our standard release pipeline; a manual override exists for exceptional emergency fixes
• Periodic security reviews of the platform architecture

If you suspect a security issue involving your account or data, contact us immediately at security@datagate.co.in. We treat all security reports as urgent.

In the event of a data breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.

We may update this policy as the platform evolves or as legal requirements change. For material changes — those that affect your rights or how your data is used — we will make reasonable efforts to notify you, such as an in-app notice or email, before the change takes effect. You can always refer to this page for the current version of our policy — the version date at the top records when it was last updated.

Continued use of datagate.co.in after the effective date of a material change constitutes your acceptance of the updated policy.

In accordance with the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address any complaints or concerns about the processing of your personal data.