Data Privacy and Management Policy
This policy explains how TSS collects, uses, stores, shares and deletes personal data. It follows the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025.
Document
Policy number
TSS-IT-04
Version
1.0
Effective from
1 September 2026
Next review
March 2027
Owner
IT Team, with the Human Resource Team
Approved by
Board of Directors
Applies to
Every employee, trainee and intern, and all personal data that TSS collects or handles, about employees, interns, candidates, clients, their users or anyone else.
Issued by
Thakur Systems & Structures Private Limited, CIN U62011PN2026PTC254650
Related policies
Information Security Policy (TSS-IT-02), Incident Response Policy (TSS-IT-05), Access Control Policy (TSS-IT-11), Acceptable Use Policy (TSS-IT-01), IT Asset Management Policy (TSS-IT-09)
OVERVIEW
The main obligations under those Rules apply from 14 May 2027, and we will meet them in full by then.
1. KEY TERMS
Personal data is any data about a person who can be identified from it, such as a name, phone number, email address, photo, ID number, bank details, IP address or location.
Data Principal is the person the data is about.
Data Fiduciary is the organisation that decides why and how personal data is used. TSS is the Data Fiduciary for our own employee, candidate and business contact data.
Data Processor is an organisation that handles personal data on someone else’s instructions. When we build or run systems for clients, we usually handle their users’ data as a Data Processor, and we must follow the client’s instructions and our contract with them.
2. OUR PRINCIPLES
Lawful and clear. We use personal data only for lawful purposes, and we tell people what we collect and why, in plain language.
Consent or legitimate use. We rely on consent where it is needed, and on the legitimate uses the DPDP Act allows, such as the purposes of employment.
Only what we need. We collect the minimum data needed for the purpose.
Accurate. We keep data accurate and up to date, and correct it when asked.
Kept only as long as needed. We delete data when its purpose is over, unless the law requires us to keep it.
Secure. We protect personal data with reasonable security safeguards (Information Security Policy).
Accountable. We keep records that show how we meet these principles.
3. EMPLOYEE, INTERN AND CANDIDATE DATA
| WHAT WE HOLD | WHY | HOW LONG WE KEEP IT |
|---|---|---|
| Identity and contact details | Employment, payroll and communication | During employment, then 8 years |
| Emergency contacts | Emergencies | Deleted when you leave |
| Proof of age and parent or guardian consent, for interns under 18 | Checking age and recording consent, as the law requires | During the internship, then 3 years |
| CV, education and work history, interview notes | Hiring decisions and document checks | Candidates not hired: 6 months, unless they agree to longer. Employees: during employment, then 3 years |
| Bank details, PAN, UAN and salary records | Payroll, EPFO, professional tax and income tax | 8 years after the financial year they relate to |
| Attendance and leave records | Working out pay, which is calculated per day, and managing leave | 8 years, with the payroll records |
| Reviews and disciplinary records | Managing employment | During employment, then 3 years |
| WHAT WE HOLD | WHY | HOW LONG WE KEEP IT |
|---|---|---|
| Medical documents for medical leave | Approving leave and adjustments | 3 years after the leave ends |
| Device, sign-in and security logs | Security, investigations and legal requirements | At least 1 year |
| Photos and videos from company events | Internal communication; outside use only with consent | Until the purpose ends or consent is withdrawn |
Why eight years for payroll. Company law requires books of account, and the records behind them, to be kept for at least eight years, and tax law also requires records to be kept for several years. Other employee records are kept for shorter periods.
Who can see it. Employee and intern data is available only to the HR team and the Directors, and to our payroll and accounting advisers under confidentiality. Medical documents are seen only by the HR team.
Interns under 18. The DPDP Act protects anyone under 18 as a child. Before an intern under 18 starts, we get their parent or guardian’s consent to the personal data the internship needs, and check that it really comes from them. We never track or monitor their behaviour, never direct advertising at them, and never use their data in any way that could harm their well-being (Internship Policy).
4. CLIENT AND USER DATA
We handle client data only as the client’s contract and instructions allow, and only for that client’s work.
We do not copy client production data into development or test environments. We use masked, anonymised or made-up test data, unless the client agrees otherwise in writing.
Client data is stored only in the systems and locations, including countries, that the contract allows.
At the end of a project, we return or delete client data as the contract says, and confirm this to the client in writing.
When we build systems that collect personal data for clients, we build privacy in from the start: collecting only what is needed, clear notices and consent screens, access controls, encryption, audit logs, and easy deletion.
5. RIGHTS OF DATA PRINCIPALS
People whose data we hold as a Data Fiduciary have the right to:
ask what personal data we hold about them and how we use it;
have it corrected, completed, updated or erased;
have a complaint about how we handle their data dealt with;
nominate someone to exercise these rights for them in the event of their death or incapacity.
Requests go to the HR team for employee and candidate data, and to the IT team for anything else. We reply within 30 days. For data we hold for a client, we pass the request to the client and help them respond.
6. SHARING DATA
We share personal data only when it is needed and allowed: with payroll and accounting advisers, with EPFO and the tax authorities, with banks for salary payments, with cloud service providers under contract, or when the law requires it.
We never sell personal data.
Every vendor that handles personal data for us must have a written contract with suitable security and confidentiality terms.
7. DATA STORED OUTSIDE INDIA
Some of our tools store data outside India. The DPDP Act allows this, except to countries the Government of India restricts. We check where each approved tool stores data, and we follow any stricter rules in client contracts.
8. MONITORING OF EMPLOYEES
As explained in the Acceptable Use Policy, we collect limited activity and security data from company systems. We do not record audio or video, except in work meetings under our policies, and we do not collect data about your private life.
9. PERSONAL DATA BREACHES
A personal data breach is any unauthorised access to, sharing, loss, change or destruction of personal data. Report any suspected breach to the IT team immediately. The Incident Response Policy explains what happens next. Where the law requires, we will tell the affected people without delay, report to the Data Protection Board of India with a detailed report within 72 hours, and report reportable cyber incidents to CERT-In within six hours. If client data is involved, we tell the client straight away so that they can meet their own obligations.
10. DELETING DATA
When data reaches the end of its retention period, it is deleted from live systems, and from backups as those backups expire.
Paper records are shredded. Devices are securely wiped before reuse or disposal (IT Asset Management Policy).
Data needed for an ongoing legal claim or investigation is kept until the matter is closed.
11. QUESTIONS AND COMPLAINTS
Questions or complaints about personal data can go to the HR team (employee and candidate data) or the IT team (everything else). We will answer as quickly as we can, and within 30 days.