Privacy Policy
Introduction
This Privacy Policy explains how the GPIL ESS & Access Control mobile application ("Application", package name: in.gpil.ess) collects, uses, protects, and handles user data. We are committed to ensuring that your personal and workplace data remains secure and private.
By using the Application, you agree to the collection and use of information in accordance with this policy. The application is designed primarily for employees, contractors, visitors, and administrative staff associated with GPIL (a subsidiary of the HIRA Group).
Information We Collect
To provide access control, secure authentication, and employee self-service features, the Application collects the following types of information:
- Personal Identification Details: Name, Employee/Labour ID, Designation, and Department.
- Contact Details & Credentials: Phone numbers and email addresses, which are used solely for identity verification (Multi-Factor OTP Authentication).
- Workplace Logs: Check-in and check-out logs, visitor gatepass logs, and attendance sync details linked with our centralized Attrack attendance system.
- Health and Slot Booking Data: Appointment slots and clearance status from the Occupational Health Centre (OHC) to verify fitness for site gate entry.
- Canteen Order Details: Booking orders and transaction bills generated within the canteen booking module.
- Device and Session Information: Application version, OS version, device make, and model. This data is collected purely to ensure secure access authorization and debug interface compatibility.
How We Use Your Information
The collected information is used to facilitate day-to-day workplace access operations and ensure platform security:
- Identity Verification: Using One-Time Passwords (OTPs) to verify and authorize accounts during login.
- Access Control: Verifying gatepasses, safety training completion, and OHC fitness clearances at security checkpoints.
- Employee Services: Managing leave request workflows, salary/payslip downloads, and canteen booking bills.
- Operational Communications: Providing critical announcements on the corporate notice board and sending push notifications via Google Firebase Cloud Messaging (FCM).
Data Protection & Security Controls
We implement a robust suite of industry-standard security measures to safeguard your information from unauthorized access, alteration, or disclosure:
Broken Object Authorization (BOLA) Shields
Strict server-side validation checks ensure that you can only view and manage your own personal data. Cross-user data access is barred.
MFA Rate-Limiting
To prevent brute-force entry, verification endpoints (such as OTP inputs and login checks) are rate-limited, automatically blocking repeated incorrect attempts.
PII Data Masking
Personally Identifiable Information (such as phone numbers and email addresses) is masked at the API boundary, ensuring it remains hidden from non-admin viewers.
Injection Defenses
Notice board inputs are automatically sanitized to strip executable scripts. Excel/CSV exports use formula sanitization to block CSV injection exploits.
Additionally, the Application uses SSL/TLS encryption for all data in transit, standard cross-site request forgery (CSRF) token checks, and follows Web Application Penetration Testing (WAPT) compliance protocols.
Third-Party Data Sharing
We value your privacy. The Application **does not share, sell, lease, or monetize** your personal data with any third-party advertisers or external entities.
Data sharing is strictly limited to infrastructure requirements, specifically with Google Firebase Cloud Messaging (FCM) to safely route push notifications directly to your Android device.
User Rights and Control
As an authorized user of the GPIL ESS & Access Control platform, you hold the following rights regarding your data:
- Right to view your registered profile and access history logs within the app.
- Right to request updates to inaccurate records through your contractor or the GPIL HR department.
- Right to contact the system administrator to request data deletion/archival upon cessation of employment or service contracts.
Contact Us
If you have any questions, feedback, or concerns regarding this Privacy Policy, please contact the GPIL IT Support Desk:
GPIL IT Department
Email: it.support@gpil.in
Website Support: https://support.gpil.in