4. Categories of Personal Data We May Collect

Depending on your role, project, location, device settings and the App features used, GK Energy may collect the following categories of personal data:

1. User identity and account information: Name, Employee/freelancer/consultant ID, contractor/Vendor/Sales Partner/ Installation Partner ID, Customer or Beneficiary ID, Project role, Designation, Department, Login credentials, User type, Address, Mobile number, Email address, Account status, PAN, Aadhar, Electricity Bill and Land documents.
2. Attendance, location and site verification data: GPS coordinates, geotagged site locations, checkin/check-out details, visit timestamps, geofence events, route or movement logs during authorised work flows, site visit history and location metadata attached to photos or reports.
3. Device, technical and security data: device identifier, IP address, operating system, app version, browser type, network data, device integrity status, rooted/jailbroken/emulator indicators, login/session records, crash logs, diagnostic logs, audit logs and security event logs.
4. Camera, media and document data: site photographs, installation progress photographs, equipment images, commissioning records, videos if enabled, uploaded documents, signatures, delivery challans, quality check documents, land or site records and other project evidence submitted through the App.
5. Operational and project execution data: daily progress reports, material consumption, inventory movement, quality check logs, performance monitoring records, maintenance records, service requests, incident reports, training acknowledgements, audit notes and approvals.
6. Customer, beneficiary and third-party data: name, contact details, address, site or land details, project identifier, government scheme details, identity documents, land records, signatures, photographs, bank or subsidy/payment details where required for a project, and communications relating to project execution or service delivery.
7. Communications and support data: emails, customer care/support tickets, grievance submissions, feedback, call recordings/notes, app messages, social media messages, consent records and responses to notices or requests.
8. Sensitive personal data or information: passwords, financial information, biometric information or similar information may be processed wherever required for an authorised purpose and subject to additional controls under applicable laws.

GK Energy does not intentionally collect health information, biometric information or data relating to children unless such collection is necessary for an authorised project, service, legal, employment, safety, identity verification or government scheme purpose and is handled in accordance with applicable laws.

5. Device Permissions and App Functions

The App may request device permissions for App functions and project purposes described in this Policy and in the relevant in-app notice.

1. Location: The App may access precise location in the foreground and, where enabled and permitted, in the background for official project execution, geo-verification, site visit validation, attendance validation, workforce safety, installation monitoring, route/site audit and related compliance performance reporting. Background location should be used for authorised purposes, site visit or project workflows and not for unrelated personal surveillance.

2. Camera and media: The App may access the camera and selected files to capture and upload site photographs, equipment photographs, installation status, commissioning evidence, documents and other project records.
3. Storage and offline mode: The App may store offline data temporarily on the device in remote areas with poor connectivity and sync that data with Company systems when connectivity is available.
4. Notifications and communications: The App may send service alerts, task updates, related compliance/performance reminders, security notices and support communications.
5. Device integrity and security checks: The App may detect rooted, jailbroken, emulator-based, cloned or otherwise compromised devices and may restrict access where security risk is identified.

You may control certain permissions through your device settings. If you disable a permission that is necessary for a feature, the relevant feature may not work and this may affect attendance, site verification, installation submission, related compliance performance reporting or service delivery.

6. How We Collect Personal Data

• Directly from Users when they register, log in, submit forms, upload photographs / documents or use InApp features.
• Automatically through the App/s, devices, network and backend systems when Users access or use the App.
• From employees, contractors Sales Partner, Installation Partner, Freelancer, Consultant, Vendors, Project supervisors, Customers, Beneficiaries, Nodal agencies, Government Departments, Project Authorities or other authorised Project Stakeholders.
• From Offline Forms, Survey Forms or field records that are later digitised or uploaded to the App.
• From service providers and technical systems used to host, secure, analyse, support or maintain the App.

7. Purposes and Legal Basis of Processing

GK Energy processes personal data  for lawful, specific and necessary purposes connected with the App, Company operations and authorised projects. Depending on the context, the legal basis may include consent, voluntary provision of data for a specified purpose, employment-related legitimate use, contractual necessity, related compliance performance with laws, performance of a government or project requirement, prevention of fraud or misuse, protection of Company systems, or establishment or defence of legal claims.

8. Beneficiary, Customer and Third-Party Data Handling.

Authorised Users may be required to collect, photographs, scan, upload or verify personal data of beneficiaries, customers, farmers, landowners, local authorities, vendors or other third parties for official project purposes. Such data must be handled strictly as follows:

• Collect the data required for the approved project, tender, scheme, installation, commissioning, maintenance, warranty, audit or related compliance performance purpose.
• Use approved forms, notices, consent language and App workflows. Where direct consent or acknowledgement is required, obtain it before collection unless another lawful basis applies.
• Do not collect, store, copy, screenshot, forward, share, publish or use beneficiary/customer data for personal, informal, unauthorised or non-project purposes.
• Upload project records through the App or other approved systems promptly and delete unauthorised local copies from personal devices or messaging apps unless retention is specifically authorised.
• Report any loss, unauthorised disclosure, device compromise or suspected misuse of beneficiary/customer data immediately to the Privacy/Grievance Officer or information security contact.

Unauthorised storage, sharing, copying or personal use of beneficiary/customer data may constitute a material breach of contract/employment, contractor or vendor obligations and may result in disciplinary, contractual, civil, criminal or regulatory action.

9. Workforce Monitoring and Audit

For authorised employees, contractors, vendors and field personnel, the App may monitor and record login activity, timestamps, GPS/location activity, attendance, operational submissions, device-related activity, usage logs, approvals and audit events. This monitoring is used for official business administration, project execution, attendance validation, workforce safety, fraud surveillance , audit verification, security monitoring, related compliance performance and dispute resolution.

Monitoring will be limited to authorised operational purposes and will be subject to applicable laws, internal policies, access controls and confidentiality obligations. Users must not use the App or Company systems for unauthorised personal activities.

10. Data Sharing and Disclosure

GK Energy does not sell, rent or trade personal data. Personal data may be shared only where necessary, proportionate and authorised for the purposes described in this Policy or as permitted by applicable laws.

1. Internal recipients: authorised employees, managers, HR, finance, project teams, supervisors, audit teams, legal teams, IT/security teams and senior management on a need-to-know basis.
2. Affiliates and group entities: where required for internal administration, project management, reporting, related compliance, security or business continuity.
3. Customers, government departments, nodal agencies, local authorities and project stakeholders: where required by tenders, schemes, contracts, project reporting, audits, inspections, subsidies, commissioning, warranty or related compliance requirements.
4. Service providers and data processors: cloud hosting providers, IT Infrastructure Teams, IT support vendors, app developers, analytics providers, security vendors, payment or banking service providers, communication providers and other vendors engaged under appropriate confidentiality, security and data processing obligations.
5. Professional advisers: lawyers, auditors, accountants, insurers, consultants and other advisers where reasonably necessary for professional services, audits, claims or
6. Law enforcement, regulators, courts and public authorities: where required or permitted by laws, legal process, court order, regulatory requirement or to protect rights, safety and security.
7. Business transaction parties: actual or potential buyers, investors, lenders, successors, advisers or counterparties in connection with merger, acquisition, financing, restructuring, sale of assets, insolvency or similar transaction, subject to appropriate safeguards.

Where personal data is shared with a service provider or data processor on GK Energy’s behalf, GK Energy will use appropriate contracts requiring the recipient to process personal data  for authorised purposes, maintain confidentiality, implement reasonable security safeguards, assist with rights requests and breach response where applicable, and return or delete data as required.

11. International Transfers and Hosting

The App and related systems may be hosted or supported in India or other jurisdictions, depending on the cloud, IT support, project and vendor arrangements used by GK Energy. Where personal data is transferred, accessed or stored outside India, GK Energy will take steps required by applicable laws, contract and project/tender requirements, including  compliance with any restrictions notified by the Government of India and any higher protection or localisation requirement applicable to specific projects or data categories.

12. Security Safeguards

GK Energy implements reasonable administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, misuse, loss or destruction. Safeguards may include role-based access controls, authentication, encryption or other appropriate protection of data in transit and at rest, masking or minimisation where practicable, device integrity checks, logging and monitoring, backup and continuity measures, contractual controls for processors, internal access approvals, security reviews and incident response procedures.

No electronic system, internet transmission, mobile device, wireless network or cloud service can be guaranteed to be completely secure. Users must protect their credentials, devices and official data and must immediately report suspected compromise or misuse.

13. Personal Data Breach Response

If GK Energy becomes aware of a personal data breach, it will take reasonable steps to investigate, contain, mitigate and remediate the incident. Where legally required, GK Energy will notify affected stakeholders in the manner and within the timelines required by applicable law or contract.

Users must promptly report any suspected loss of device, credential compromise, unauthorised access, accidental disclosure, malware, phishing, data leakage or misuse of App data to the Privacy/Grievance Officer or information security contact.

14. Retention, Deletion and Backup

GK Energy retains personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by laws, contract, tender conditions, government scheme requirements, audit requirements, warranty or maintenance obligations, dispute resolution, investigation or legal hold.

15. Data Principal Rights and Choices

Subject to applicable laws, verification and exceptions, individuals may have rights to:

• request correction, completion or updating of inaccurate, incomplete or outdated personal data;
• request erasure of personal data where retention is no longer necessary for the specified purpose or legal compliance;
• withdraw consent where processing is based on consent, without affecting lawful processing carried out before withdrawal;
• raise a grievance with GK Energy through the published grievance mechanism;
• nominate another individual to exercise rights in the event of death or incapacity where applicable;

Requests may be submitted to the Privacy/Grievance Officer using the contact details in Section 3. GK Energy may request information necessary to verify the requester’s identity and locate the relevant records. Withdrawal of consent or disabling of device permissions may affect App features, attendance validation, service delivery or project processing; however, GK Energy may continue processing where required or authorised by law, contract, employment obligation, audit requirement, security need, government/project requirement or legal claim.

17. User Obligations and Prohibited Conduct

• Use the App only for authorised Company, project, employment, contractor or service purposes.
• Keep login credentials confidential and do not share accounts, OTPs, passwords, tokens or devices with unauthorised persons.
• Do not upload false, misleading, unauthorised or excessive personal data.
• Do not copy, extract, scrape, photograph, screenshot, download, forward, publish, disclose or store App data outside approved systems unless expressly authorised.
• Do not reverse engineer, tamper with, intercept, modify, reproduce, redistribute or attempt to bypass the App, APIs, databases, workflows or security controls.
• Do not use the App on rooted, jailbroken, emulator-based, cloned or compromised devices, or with unauthorised packet interception, debugging, screen mirroring or screen recording tools.
• Promptly report security incidents, data inaccuracies, unauthorised disclosures, lost devices, compromised credentials or suspected misuse.

Violation of these obligations may result in suspension or termination of App access, disciplinary action, contractual remedies, legal proceedings and/or reporting to competent authorities, as applicable.

18. Device Security and Access Control

GK Energy may suspend, restrict, monitor or terminate App access where it reasonably believes that a device, account or use of the App presents a security threat, policy violation, unauthorised access attempt, suspicious activity, device compromise, employment/engagement termination or cybersecurity risk. Where necessary, GK Energy may remotely terminate active sessions, revoke tokens or wipe Company/App data from managed or enrolled devices to protect Company systems, project records and personal data.

19. Confidentiality and Ownership of Project Records

All App workflows, software, databases, APIs, reports, project documentation, geo-tagged records, photographs, audit logs, operational submissions and related records created or processed for GK Energy or its projects are confidential and proprietary to GK Energy or the relevant customer/project authority, as applicable.

Users have no right to retain, disclose or use such records except for authorised project or service purposes. Nothing in this Section limits any mandatory privacy rights that an individual may have in relation to their own personal data under applicable laws.

20. Limitation of Liability

To the maximum extent permitted by applicable laws, GK Energy will not be responsible for loss or unauthorised access arising from user gross negligence, credential sharing, compromised personal devices, unauthorised third-party apps, phishing, malware, telecom or internet failure, device tampering, unauthorised screenshots, external cyber-attacks or circumstances beyond GK Energy’s reasonable control. Nothing in this Policy excludes or limits any liability, obligation or individual right that cannot be excluded or limited under applicable laws.

21. Updates to This Policy

GK Energy may update this Policy from time to time to reflect changes in laws, App features, business operations, security practices, project requirements or regulatory guidance. The updated Policy will be published in the App, on the relevant website or through another appropriate channel with a revised “Last Updated” date. Where a material change requires consent or additional notice under applicable laws, GK Energy will provide such notice or seek consent as required.

22. Governing Laws and Jurisdiction

This Policy is governed by the laws of India. Subject to any mandatory statutory rights, regulatory remedies or project-specific dispute process, disputes arising out of or in connection with this Policy or the App shall be subject to the exclusive jurisdiction of the competent courts at Pune, Maharashtra.

23. Contact Information

GK Energy Limited

Office 1901, 19th Floor, A Tower, Gokhale Business Bay (GBB),
Paschimanagri, Kothrud, Pune, Maharashtra 411038

Email: info@gkenergy.in | Phone: 020-24268111 | Website/App link: https://gkenergy.in/