Privacy Policy

1. Introduction and scope

This Privacy Policy explains how Vandana Security & Manpower Services (“VSMS India”, “VSMS”, “we” or “us”) collects, uses, shares, stores and protects personal data. VSMS India provides Security, Manpower and Facility Services from Jiwaji Nagar, Transport Nagar, Nagda Junction, Nagda, District Ujjain, Madhya Pradesh – 456335, India.

This policy applies to:

• this website, https://vsmsindia.com/ (the “Website”), including its enquiry and application forms;
• enquiries and communications made by telephone, email, WhatsApp or live chat; and
• recruitment enquiries, job applications and CV uploads.

In this policy, “personal data” means information about an individual who can be identified from it. For the purposes of Indian data-protection law, VSMS decides why and how it processes the personal data described in this policy.

Visiting the Website does not by itself mean that you agree to anything beyond what this policy describes. Where VSMS needs your consent, it asks for it separately and for a stated purpose.

2. Legal framework and status of this policy

This policy is written as at 15 October 2026. The Indian laws that matter most to it are at different stages of operation, so this section sets out which apply now and which are scheduled to apply later.

Applying now

• Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), to the extent they apply to VSMS. Rule 4 of the SPDI Rules calls for a published privacy policy; this policy is intended to serve that purpose.
• CERT-In Directions of 28 April 2022 issued under section 70B(6) of the Information Technology Act, 2000, which apply to service providers, intermediaries, data centres, body corporates and government organisations and cover the reporting of specified cyber incidents and the retention of system logs.
• The provisions of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) that have already commenced. These are the provisions on definitions and on the Data Protection Board of India.

Scheduled to apply later

• Rule 4 of the DPDP Rules (consent managers) is scheduled to commence one year after the Rules were published in the Gazette, which is in November 2026.
• The remaining DPDP Rules, including those on notices, security safeguards, breach intimation, erasure, contact information, children’s data, the rights of individuals and transfers outside India (Rules 3 and 5 to 16, 22 and 23), and the corresponding provisions of the DPDP Act, are scheduled to commence eighteen months after publication, which is in May 2027. Until then, the SPDI Rules continue to apply, and section 43A of the Information Technology Act, 2000 is scheduled to be omitted when section 44(2) of the DPDP Act commences.

The dates above are those notified at the date of this policy. If the Central Government changes them, the changed dates apply and VSMS will update this policy. Where this policy describes something as applying “once in force”, it does not bind VSMS as a legal obligation under that law before the relevant date. Nothing in this policy limits rights you have under any other law.

3. Personal data we collect

Business enquiries and forms

When you submit an enquiry or requirement form, VSMS receives what you enter. Depending on the form, this can include your name, organisation or business name, phone number, email address (where requested), the services you are interested in, the type and location of your site, a description of your requirement, and optional details such as roles, approximate numbers of people, shift pattern or working hours, and expected start time. VSMS also records the consent you give.

Together with the form, the Website sends a unique submission reference, the page you submitted from and the page you came from, any campaign parameters present in the address (UTM tags and Google or Meta click identifiers), and the date and time as recorded by the form-handling system.

Recruitment enquiries and applications

When you apply for a vacancy or send a general CV, VSMS receives your name, mobile number, email address, preferred role or service category, preferred work location, relevant experience, an optional message, the vacancy you applied for (or an indication that the application is general), your consent selection, and the CV file you upload together with everything in it, such as education, work history, address, date of birth or a photograph if you choose to include them. The technical information described above is received with applications as well.

The Website’s forms do not ask for Aadhaar numbers, bank or payment card details, health information or biometric information, and the Website does not take payments. Please remove such details from your CV unless VSMS has specifically asked for them for a stated purpose.

Telephone, email, WhatsApp and chat

If you call, email, message VSMS on WhatsApp or use live chat on the Website, VSMS receives your phone number or email address, the content of what you send and the time of the communication. WhatsApp and live chat are operated by third parties, who also receive information under their own notices (see section 9).

Website visits and technical data

When you visit the Website, your browser sends information that VSMS or its providers receive and may log: your IP address, browser type and version, device and operating system, the address of the page that referred you, pages viewed, dates and times, and diagnostic data. Fonts and similar resources are loaded from Google servers, so Google also receives your IP address and browser details when a page loads. If you arrive through a campaign link, the Website reads the campaign parameters in the address and keeps them for your browser session so that they can be attached to a form you submit.

Information about other people

Please give VSMS personal data about another person, for example a colleague named as a contact or a referee, only if you are entitled to do so and have told that person.

4. Why we use personal data

VSMS uses personal data for these purposes:

• to respond to your enquiry, discuss your requirement and prepare a proposal;
• to consider your job application, communicate with you about it and, for general applications, to consider you for roles that open later;
• to operate, secure and maintain the Website, including preventing spam and misuse of forms;
• to understand how the Website and campaigns perform, including which sources lead to enquiries or applications;
• to keep business records, handle complaints and requests, and establish, exercise or defend legal claims; and
• to comply with applicable law and with lawful requests from authorities.

VSMS does not use the details you give in an enquiry or application to send unrelated promotional messages unless you separately agree to receive them.

5. Consent and other lawful grounds

The enquiry and application forms ask you to tick a consent box that is not ticked in advance. The consent covers using the information you provide to respond to your enquiry or to consider your application, in line with this policy. Submitting a form is not treated as agreement to anything else.

The law also allows personal data to be used without consent in limited situations. Examples are using data you have voluntarily given for the purpose for which you gave it, and using data where a law requires it. Where VSMS relies on such a ground, it uses the data only for that ground.

Withdrawing consent. You can withdraw consent at any time by writing to contact@vsmsindia.com, as described in section 13. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. If you withdraw, VSMS may no longer be able to continue with your enquiry or application, and it may still keep data where the law requires or permits.

Marketing. Consent given for an enquiry or an application is separate from any consent to promotional communications. Promotional messages by call or SMS are also regulated by the Telecom Regulatory Authority of India’s commercial communication rules.

6. Recruitment data and CVs

VSMS uses applicants’ information to assess suitability for vacancies, to contact applicants about the recruitment process, and, for general applications, to consider them if a suitable role opens later. Submitting a CV or application does not guarantee an interview, selection or employment.

Access to applications is limited to VSMS personnel who are involved in recruitment and to service providers that store or deliver the information for VSMS (section 9). Where a role is based at, or supplied to, a client’s premises, VSMS may need to share relevant details with that client for that role only. Applications are not published on the Website.

VSMS keeps applications only as long as described in section 10. You can ask for your application to be corrected or deleted at any time, as described in section 13. Please give accurate information and do not apply on behalf of another person without their knowledge.

7. Cookies, analytics and similar technologies

The Website uses cookies and similar technologies (such as local identifiers and browser session storage), some of which are set by third parties. They fall into these groups.

• Necessary technologies keep the Website working and secure, for example by keeping forms and spam checks working, and by holding campaign parameters for your browser session.
• Analytics. VSMS measures how the Website is used with Google Tag Manager and Google Analytics 4. These tools collect information such as pages viewed, approximate location derived from your IP address, and device and browser details, and may use cookies or similar identifiers.
• Advertising measurement, where enabled, helps VSMS see whether advertising on Google or Meta leads to enquiries. It uses click identifiers in the page address and identifiers set by those providers.
• Live chat. Tawk.to provides the chat tool, which uses identifiers to keep your chat session and stores the conversation.
• Embedded and external resources such as Google Fonts, Google Maps or Google Business Profile links, and a verification service where one is enabled (for example Cloudflare Turnstile or Google reCAPTCHA), receive your IP address and browser details.

The Website’s own code does not pass the contents of your forms (such as your name, phone number or email address) to analytics tools.

Your choices. You can block or delete cookies in your browser settings, though chat, forms or spam checks may then not work properly. Google offers a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout, and you can manage advertising settings with Google and Meta. Where the law in force requires your consent for any non-essential technology, VSMS will provide a way for you to give or refuse it.

8. Sharing and disclosure

VSMS shares personal data only for the purposes in this policy and only with:

• VSMS personnel who need it to respond to enquiries, handle recruitment or run the Website;
• service providers acting for VSMS, described in section 9;
• professional advisers such as legal, accounting and audit advisers, under duties of confidentiality;
• a client, where an application relates to a role based at that client’s premises (section 6);
• courts, regulators, law-enforcement agencies and other authorities where the law requires or permits it (section 16); and
• any other person to whom you ask or permit VSMS to give it.

VSMS does not sell personal data.

9. Service providers and third-party services

VSMS uses service providers to run the Website and handle enquiries and applications. Depending on how the Website is configured at any time, these include:

• SoftaLabs, which provides the Website’s content-management and lead-management platform, through which enquiries and applications are received and stored;
• the Website’s hosting and technology providers, which keep servers and security logs;
• Google, for Tag Manager, Analytics, Fonts, Maps and Business Profile, and, where enabled, advertising measurement and reCAPTCHA;
• Meta, for advertising measurement where enabled, and for WhatsApp when you use the WhatsApp link or number;
• Tawk.to, for live chat;
• Cloudflare, for the Turnstile verification service where enabled; and
• email and communication providers used to send and receive messages.

Some of these providers process data on VSMS’s behalf. Others, such as Google, Meta, Tawk.to and WhatsApp, also process data under their own terms and privacy notices, which you should read: Google, Meta, WhatsApp, Tawk.to and Cloudflare.

Several of these providers operate globally and may process data on servers outside India. Indian law permits transfers of personal data outside India except to countries or territories the Central Government restricts by notification (section 16 of the DPDP Act, once in force).

10. Retention and deletion

VSMS has not fixed one retention period for all records. It keeps personal data only for as long as the purposes in this policy require, and then deletes it or removes the means of identifying you, unless the law requires or permits longer retention. In practice:

• Enquiries are kept while VSMS responds to you, discusses your requirement and keeps a record of that discussion, and for as long as may be needed to deal with a dispute or legal claim.
• Applications and CVs are kept while a vacancy is being filled and, for general applications, for as long as VSMS considers it useful to hold them for future roles. You can ask for earlier deletion.
• Technical and security logs are kept by the Website’s hosting and technology providers for security, investigation and legal-compliance purposes. The CERT-In Directions of 28 April 2022 require covered entities to keep system logs for a rolling period of 180 days within India, and, once in force, the DPDP Rules require a Data Fiduciary to keep specified personal data, associated traffic data and logs for at least one year from the date of processing (rules 6(1)(e) and 8(3)) unless a law requires longer.

Deletion on request or when a purpose ends is subject to those minimum periods and to any retention the law requires, including for legal claims and security investigations. When retention is required, the data is kept only for that purpose.

11. Security safeguards

VSMS aims to protect personal data in its possession or under its control with reasonable security safeguards. The DPDP Rules (rule 6, once in force) say these must include, as a minimum: appropriate data-security measures such as encryption or masking; controls on access to the systems used; logging and monitoring that makes access to personal data visible so that unauthorised access can be detected and investigated; measures such as backups to keep processing going if data is lost; and security terms in contracts with processors. VSMS intends to meet that standard by the date those rules commence. Its approach is to limit access to enquiries and applications to the people who need them, and the Website’s forms include technical checks against automated spam.

No method of transmission or storage over the internet is completely secure, and VSMS cannot guarantee absolute security. Nothing in this policy limits any right or remedy that the law gives you and that cannot be limited. Please also protect your own devices and accounts, and avoid sending sensitive information by unsecured means.

12. Personal data breaches and incident response

If VSMS becomes aware of a personal data breach, it will take steps to contain it, assess what happened and reduce harm, and it will notify affected people and authorities where the law requires. Reporting duties depend on the law in force and on the facts of the incident.

• The CERT-In Directions of 28 April 2022 require covered entities to report specified cyber incidents to CERT-In within 6 hours of noticing them or being told about them.
• Once the relevant DPDP provisions are in force (scheduled for May 2027), VSMS must, as a Data Fiduciary, inform each affected individual without delay and inform the Data Protection Board of India without delay, followed by a fuller report within seventy-two hours of becoming aware of the breach (or a longer period the Board allows) (section 8(6) of the DPDP Act and rule 7 of the DPDP Rules). A notice to an individual must describe the breach, its likely consequences, the measures taken, steps the individual can take, and business contact information for questions.

13. Your rights and how to exercise them

What applies now

• Where the SPDI Rules apply to information you have given VSMS, you may ask to review it, ask for inaccurate or deficient information to be corrected or amended as feasible, and withdraw consent you gave by writing to VSMS.
• VSMS also considers and responds to requests to correct, update or delete information you have given it, and to questions about how it is used, even where a statutory right has not yet commenced.

What is scheduled to apply from May 2027

Once sections 11 to 14 of the DPDP Act commence, individuals whose data VSMS processes on the basis of their consent, or of data they voluntarily provided, will have the right to:

• obtain a summary of the personal data being processed, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared (section 11);
• ask for correction, completion, updating and erasure of personal data, subject to retention that is necessary for the specified purpose or for legal compliance (section 12);
• have readily available means of grievance redressal, and to use that route before approaching the Data Protection Board of India (section 13); and
• nominate another individual to exercise these rights in the event of death or incapacity (section 14).

You may also withdraw consent at any time, with the ease of doing so comparable to the ease of giving it (section 6(4)). The law also asks individuals to use these rights responsibly: not to impersonate anyone, to give only verifiably authentic information when asking for correction or erasure, and not to file false or frivolous grievances (section 15).

How to make a request

Email contact@vsmsindia.com with the subject “Privacy request”, or write to the address in section 19. Say what you are asking for, and include the name and the phone number or email address you used with VSMS. VSMS may ask for further information that is reasonably needed to confirm your identity before acting, so that your data is not given to or changed by someone else.

Timing. Where the SPDI Rules apply, a grievance is to be redressed within one month of receipt. When the DPDP rules on grievances commence, VSMS will respond within the period it publishes, which the DPDP Rules say must not exceed ninety days (rule 14(3)). Requests may be limited by law, for example where retention is required for compliance with a law or for a legal claim.

14. Children and people acting for others

This Website is intended for business visitors and for job applicants who are adults. Under the DPDP Act a child is a person who has not completed eighteen years of age, and once the relevant provisions commence a Data Fiduciary needs the verifiable consent of a parent or lawful guardian before processing a child’s personal data, with limited exceptions set by the Rules. VSMS does not knowingly collect personal data of children. If you are under eighteen, please do not submit a form. If you believe a child’s data has been submitted, contact VSMS using section 19 and it will deal with the matter as the law requires.

A parent or lawful guardian may act for a child or for a person with a disability who has a lawful guardian. You may also ask an authorised representative to make a request for you. VSMS may ask for proof of the representative’s authority and identity before acting.

15. Grievances and privacy contact

If you have a concern about how VSMS handles your personal data, or are not satisfied with a response to a request, write to VSMS at contact@vsmsindia.com with the subject “Privacy concern”, or at the address in section 19. VSMS will review the concern, may ask for further information, and will reply in writing. Response periods are described in section 13.

If your concern is not resolved, you may have other remedies under law. Once the relevant provisions of the DPDP Act commence, you may complain to the Data Protection Board of India after first using VSMS’s grievance process.

16. Legal disclosures and government requests

VSMS may disclose personal data where required or permitted by law, for example to comply with a court order or a lawful direction or request from a competent authority, to meet a statutory reporting duty, or to establish, exercise or defend a legal claim. VSMS will limit any such disclosure to what the law requires or permits, and where lawful will tell the person concerned. VSMS does not disregard mandatory legal orders.

17. Links to other websites and external services

The Website links to external websites and services, such as Google Business Profile, WhatsApp, social platforms and AI assistants. VSMS does not control these services, and they operate under their own privacy policies. Information you give to them is governed by their terms, not this policy.

18. Changes to this policy

VSMS may update this policy, for example when its practices, its service providers or the law change. Updates are published on this page and the “Last updated” date at the top is changed when that happens. The date shown for this version is 15 October 2026. If a change materially affects how your personal data is used and the law requires it, VSMS will give you notice or ask for fresh consent.

19. Contact information