Privacy Policy

This Privacy Policy describes how the South Eastern Railway Centralized Deployment Monitoring System (SER-CDMS) (“we”, “us”, “the System”), operated for South Eastern Railway (HQ: Garden Reach, Kolkata) and hosted at https://railway.appentus.cloud/, collects, uses, stores, and protects personal data of system users, deployed manpower (ground staff), vendors, and related stakeholders.

We process personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act), and railway operational requirements for manpower deployment, attendance, and safety monitoring.

1. Who this policy applies to

• Admin and officer users of the SER-CDMS web portal
• Ground staff / manpower using the SER-CDMS mobile application
• Vendor / contractor personnel whose details are maintained for deployment contracts
• Visitors accessing public pages on this website (for example this Privacy Policy)

2. Data we collect

2.1 Account and identity data

• Name, employee ID, role / designation, department, division, zone
• Phone number and optional Aadhaar last-4 digits (full Aadhaar is not stored for mobile login in the current UAT phase)
• Vendor / contractor and contract association
• Login credentials (passwords stored as one-way hashes)

2.2 Deployment and duty data

• Assigned ground location(s) (station, platform, depot, office, yard, workshop)
• Shift / roster information where configured
• Attendance punches, face-interval presence checks, and related verification status

2.3 Location and device data

• GPS coordinates and accuracy when synced from the mobile app or field tracker
• Device / push tokens used to deliver operational notifications
• Approximate last-seen time for live GIS monitoring

2.4 Biometric / face data

• Face enrollment embeddings / match scores used for attendance and 15-minute presence validation
• Selfie images submitted for enrollment or verification (processed according to configured face recognition driver)

2.5 Technical and audit data

• IP address, session / authentication tokens, and security events
• Application logs and audit trail entries for compliance and incident investigation

3. Purpose of processing

• Authenticate users and authorize access to modules
• Monitor on-ground manpower deployment by contractor and location
• Record attendance and face-based presence compliance
• Display live / last-known staff location for operational supervision
• Send alerts, notifications, and video-call invitations related to duty
• Maintain audit, backup, and compliance records required for railway operations
• Improve security, prevent misuse, and investigate incidents

4. Legal basis / legitimate use

Personal data is processed for railway manpower deployment monitoring and related legitimate operational purposes, for performance of employment / contractor arrangements, and where required to comply with applicable law or directions of competent authorities. Where consent is required for a specific processing activity, it will be obtained separately.

5. Sharing of data

We do not sell personal data. Data may be shared only with:

• Authorized South Eastern Railway officers and administrators with a need to know
• Authorized vendor / contractor managers for staff under their contracts (scoped access)
• Technology service providers hosting or supporting the System (for example hosting, SMS/push, video), under confidentiality and security obligations
• Law enforcement or regulators when legally required

Aadhaar-related verification APIs remain deferred until UIDAI access is formally provided; the System must not be used to circumvent UIDAI / Aadhaar Act requirements.

6. Retention

We retain personal and operational records for as long as needed for deployment monitoring, statutory / audit requirements, dispute resolution, and security. Retention periods may be configured in system settings. When data is no longer required, it is deleted, anonymized, or archived according to railway data-retention practice.

7. Security measures

• Password hashing and session / token-based authentication
• Role-based access controls and audit logging
• Encryption in transit (HTTPS) on the live deployment
• Application hardening aligned with OWASP-oriented controls documented in the Compliance module
• Server access restricted to authorized deployment personnel

No method of transmission or storage is 100% secure; we work to protect data using reasonable technical and organizational measures.

8. Your rights

Subject to applicable law and railway operational constraints, data principals may request:

• Access to personal data held about them in the System
• Correction of inaccurate or incomplete data
• Information about processing (as described in this policy)
• Withdrawal of consent where processing is consent-based
• Grievance redressal regarding personal data handling

Staff should raise correction requests through their supervisor / vendor admin or the SER-CDMS administrator. Admin users can update many profile fields inside the authenticated portal.

9. Cookies and similar technologies

The web portal uses session cookies required for secure login and CSRF protection. These are essential for the service and are not used for third-party advertising.

10. Children’s data

SER-CDMS is an enterprise railway operations system for authorized adult personnel. It is not directed at children.

11. Cross-border transfers

Primary hosting for the live environment is intended for infrastructure used by Appentus / South Eastern Railway project deployment. If any processing involves transfer outside India, it will be done only as permitted under applicable law and with appropriate safeguards.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when material updates are published. Continued use of the System after an update constitutes notice of the revised policy for system users.

13. Contact / grievance

For privacy questions or grievances related to SER-CDMS personal data processing, contact:

• System / Project support: Appentus Technologies (implementation partner for this deployment)
• Live portal: https://railway.appentus.cloud/
• South Eastern Railway HQ: Garden Reach, Kolkata — through your designated railway nodal officer

Also see our Terms of Use and Data / account deletion request.