Privacy Policy

1. Introduction

Samruddh Bharat Technologies Private Limited ("SBT", "Company", "we", "us", "our") is a government technology company headquartered in Panaji, Goa, building civic and governance platforms for Bharat. This Privacy Policy explains how we collect, use, share, and protect personal data in connection with (a) the government and law-enforcement technology platforms we build and operate, including Smart Force, the 1930 Cyber Fraud Helpline (with the AI voice assistant Indu), and Deep Trace (together, the "Platforms"), and (b) this corporate website, samruddhbharattech.in (the "Website").

This Policy is drafted with reference to India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules made thereunder, and other applicable Indian law. By using the Platforms or the Website, you agree to the collection and use of personal data as described in this Policy.

2. Scope and Our Role

The Platforms are built and operated for, and at the direction of, the respective Police Department or law-enforcement agency that deploys them (each, the "Department"). Personal data processed through the Platforms — for example, complainant data on the 1930 Cyber Fraud Helpline, or case data on Deep Trace — is owned by, and belongs to, the relevant Department. In relation to such data, SBT acts as a Data Processor, processing personal data solely on the instructions of, and for the purposes specified by, the relevant Department, which is the Data Fiduciary under the DPDP Act. Where the DPDP Act's exemption for processing necessary for the prevention, detection, investigation, or prosecution of offences applies (Section 17(1)(c) of the DPDP Act), such processing is undertaken by or on behalf of the relevant Department in that capacity.

In relation to personal data collected directly through this Website — for example, when you fill in the contact form, apply for a role on our Careers page, or subscribe to updates — SBT acts as the Data Fiduciary and determines the purpose and means of that processing.

3. Personal Data We Collect

Depending on how you interact with us, we (or, on the Platforms, the relevant Department through us) may collect:

• Identity and contact data: name, email address, phone number, and government-issued identity proof (including, where applicable, Aadhaar), collected in accordance with the Aadhaar Act, 2016 and applicable rules.
• Complaint and case data: details of a cyber fraud incident or complaint (e.g. transaction details, financial account or UPI information, screenshots, and related evidence) submitted through the 1930 Cyber Fraud Helpline or Smart Force.
• Voice and call data: audio recordings and transcripts of calls made to the 1930 Helpline, including interactions with the AI voice assistant Indu.
• Investigation data: digital footprint and case-linked information processed through Deep Trace by authorised law-enforcement personnel.
• Device and usage data: IP address, browser type, device identifiers, and diagnostic data collected automatically when the Platforms or Website are used.
• Website and recruitment data: information you submit through our contact form or careers page, such as your name, email, resume, and message content.

4. How We Use Personal Data

Personal data is used to: operate and maintain the Platforms; register, verify, and respond to complaints filed through the 1930 Helpline; support investigation and case-tracing through Deep Trace and Smart Force; communicate with complainants and citizens about the status of their complaint or request; detect and prevent fraud and cyber-attacks; comply with legal obligations, including sharing information with law-enforcement or judicial authorities where required; and, for the Website, respond to enquiries and process job applications.

5. Legal Basis for Processing

We process personal data on one or more of the following legal bases recognised under the DPDP Act: (a) your consent, given for a specified purpose; (b) performance of a function of the State, or in the interest of sovereignty, security, or public order; (c) compliance with a legal obligation, or in connection with the prevention, detection, investigation, or prosecution of offences; and (d) other "legitimate uses" recognised under the DPDP Act, such as responding to a request you have made.

6. Sharing and Disclosure of Data

We may share personal data with: the relevant Police Department or law-enforcement agency for which a Platform is operated; other government authorities or courts, where required by law or in connection with an investigation; MeitY-empanelled cloud service providers who host our infrastructure (see Section 7); and professional advisors, strictly on a need-to-know basis. We do not sell personal data, and we do not share personal data with advertisers or unrelated third parties.

7. Cross-Border Data Transfer

All personal data collected or processed through the Platforms and the Website is stored and processed entirely within India, on cloud infrastructure provided by MeitY-empanelled cloud service providers. We do not transfer personal data outside India.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including to comply with legal, regulatory, investigative, or evidentiary obligations. Retention periods for complaint and case data on the Platforms are determined by the relevant Department in accordance with applicable law and departmental record-retention requirements. Website enquiry and recruitment data is retained only for as long as needed to respond to your request or consider your application.

9. Security Measures

We implement appropriate technical and organisational security measures to protect personal data, including encryption in transit and at rest, role-based access controls, and audit logging. Our infrastructure is hosted with MeitY-empanelled cloud service providers, and our systems undergo regular security audits by CERT-In empanelled auditors. While we take these precautions seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach, we will notify the affected Department (as Data Fiduciary) and take reasonable steps to support their notification obligations to the Data Protection Board of India and affected Data Principals, as required under the DPDP Act. For data where SBT itself is the Data Fiduciary (Website data), we will notify affected individuals and the Data Protection Board of India as required by law.

11. Children's and Minors' Data

The Platforms exist, among other things, to help citizens — including minors — report cyber fraud and access police services safely. Where a complainant or user is a minor, we process the minimum personal data necessary to act on the complaint or request, in the interest of the minor's safety and in accordance with the DPDP Act's provisions on processing children's data, including obtaining verifiable parental or guardian consent where required by law and not required by a law-enforcement exemption. This Website (samruddhbharattech.in) itself is a corporate website and is not directed at children.

12. Your Rights as a Data Principal

Subject to applicable law and any law-enforcement exemptions that may apply, you have the right to: (a) access a summary of personal data we hold about you and the processing activities undertaken; (b) seek correction, completion, updating, or erasure of your personal data; (c) withdraw consent, where consent is the basis of processing, without affecting the lawfulness of processing carried out before withdrawal; (d) nominate another individual to exercise your rights in the event of death or incapacity; and (e) file a complaint with the Grievance Officer named below, and thereafter, if unresolved, with the Data Protection Board of India.

13. Grievance Officer

In accordance with the DPDP Act, our Grievance Officer is:

We will acknowledge and respond to your grievance within 15 days of receipt.

14. Escalation to the Data Protection Board of India

If you are not satisfied with our response, or believe your rights under the DPDP Act have not been addressed, you may escalate your grievance to the Data Protection Board of India, constituted under the DPDP Act.

15. Cookies

Our Website uses cookies for basic record-keeping and to understand how the Website is used. Cookies do not contain information that can personally identify you. You can control cookies through your browser settings; disabling cookies may affect some functionality of the Website.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Effective date" at the top of this page. We encourage you to review this Policy periodically.

17. Governing Law

This Policy is governed by the laws of India. Any disputes arising in connection with this Policy shall be subject to the jurisdiction of the courts at Panaji, Goa.

18. Contact Us

For any questions about this Privacy Policy, please contact: