Privacy Policy

Last updated: 21 September 2026

This Privacy Policy explains how iSec Services Private Limited, trading as iChek Services ("iChek", "we", "us"), collects, uses, shares and protects personal data when you use our website ichek.info, our background verification services, our customer portals and our Address Verification API.

We handle personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made under them. iChek is ISO 27001 certified, and information security is central to how we work.

1. Our two roles
2. Data we collect
3. How we use it
4. Consent
5. Who we share it with
6. How long we keep it
7. Security
8. Your rights
9. Cookies
10. The Address API
11. Children
12. Grievance Officer
13. Changes

1. Our two roles

We handle personal data in two different capacities, and your rights differ slightly between them:

As a Data Fiduciary, when we decide why and how data is processed. This covers visitors to our website, our own customers, people who contact us, and job applicants.
As a Data Processor, when we carry out verification on behalf of a client, such as an employer or a business. The client decides who is checked and why, and we act on their instructions. Requests about that data are usually handled with the client, and we will help them respond.

2. Data we collect

2.1 Candidates and people being verified

Depending on the checks our client has ordered, we may collect and verify: name, date of birth, gender, photograph, current and permanent address, phone number, email address, government identity numbers (such as Aadhaar, PAN or passport number), educational records and certificates, employment history and references, criminal and court records, database and watchlist results, and drug test results from an accredited laboratory.

2.2 Our business customers

Name, company name, work email, phone number, billing address, company type, GST details where applicable, and the records of orders placed and invoices raised.

2.3 Address Verification API users

Account name, email address, password (stored only as a one-way hash, never in readable form), API keys, the domains you allow the widget on, and the usage counts for your plan. We also store the addresses, phone numbers and PIN codes your systems submit for checking, along with the result of each check.

2.4 Website visitors

Anything you type into our contact form, and technical information your browser sends, such as IP address, browser type, pages viewed and the time of your visit.

2.5 Payments

Payments are processed by our payment partner. We never see or store your full card number, CVV or UPI PIN. We keep only the order details and the confirmation the payment partner returns.

3. How we use it

To carry out the verification checks our clients order, and to prepare their reports.
To run the Address Verification API: checking addresses and PIN codes, scoring orders for delivery risk, and counting usage against your plan.
To create and manage accounts, confirm email addresses, and provide support.
To take payment, raise invoices and meet our tax and accounting obligations.
To keep our services secure: preventing fraud and abuse, investigating incidents and keeping audit logs.
To answer your enquiries and, where you have agreed, to send service updates.
To meet legal and regulatory requirements, and to respond to lawful requests from authorities.

We do not sell personal data. We do not use verification data for advertising, and we do not use it to train artificial intelligence models for anyone other than ourselves for quality control.

A background check is only carried out where the person has given written consent, usually as part of a job application or engagement. Our clients are responsible for obtaining that consent and for keeping the record of it, and they confirm this to us in their agreement before any check begins. If you believe a check has been run on you without your consent, contact us and we will investigate.

We share personal data only as far as the service requires:

Verification sources: universities, boards, previous employers, police stations and courts, accredited laboratories, and licensed database providers, which we contact to confirm the information being checked.
The client who ordered the check, in the form of a verification report.
Service providers who work for us under contract: our hosting provider, email delivery, and our payment partner. They may only use the data to provide that service to us.
Authorities, where we are required by law, a court order, or a lawful request, or where it is necessary to establish or defend a legal claim.
A buyer or successor, if our business is sold or merged, with the same protection continuing to apply.

Data is normally stored and processed in India. If a check requires an enquiry outside India, for example verifying a foreign degree, only the details needed for that enquiry are sent, under appropriate safeguards.

6. How long we keep it

What	How long
Verification case files and reports	As agreed with the client, and by default for up to 3 years from the date of the report, unless the law requires longer
Invoices and payment records	8 years, as required by tax law
Address API accounts and check results	While the account is open, and for 12 months after it is closed
Contact form enquiries	2 years
Job applications	1 year, unless you ask us to keep them on file for longer
Security and audit logs	Up to 2 years

When a retention period ends, we delete the data or anonymise it so that it can no longer identify anyone.

7. Security

We are ISO 27001 certified and operate a documented information security management system. Our measures include encryption of data in transit (TLS), access limited to staff who need it for their work, unique logins with audit trails, passwords stored only as salted one-way hashes, secure disposal of records, background-checked staff bound by confidentiality agreements, and regular reviews of our systems and suppliers. No system can be guaranteed completely secure, but we will tell you and the relevant authority about a breach affecting your personal data without undue delay.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you may ask us to:

tell you what personal data of yours we hold and who we have shared it with;
correct data that is wrong, incomplete or out of date;
erase data we no longer need;
withdraw a consent you previously gave, which does not affect anything done before you withdrew it;
nominate someone to exercise these rights on your behalf if you die or become incapacitated.

Write to our Grievance Officer at pravin@ichek.info (see section 12). We may ask for proof of identity before we act, and we will reply within 30 days. Where we processed the data for a client, we will pass your request to that client and help them answer it.

9. Cookies

Our website uses only what it needs to work: a session cookie when you log in to a portal, and local storage in your browser to remember that you are signed in. We do not use advertising or tracking cookies. Third-party components on the site, such as our chat widget, may set their own cookies, which are governed by their providers' policies. You can block or delete cookies in your browser settings, though parts of the site may then stop working.

10. The Address Verification API

When a business uses our API or checkout widget, their customers' delivery addresses and phone numbers are sent to us to be checked and standardised. In that service:

the business is the data fiduciary and is responsible for telling its customers, and we act on its instructions;
we check the PIN code against publicly available India Post data, which we cache to reduce lookups;
each account's data is kept separate and is accessible only with that account's keys;
we use the data to return the result, to count usage, and to improve the accuracy of our checks. We do not share it with other customers.

11. Children

Our services are for businesses and for adults. We do not knowingly collect the personal data of anyone under 18 except where a check lawfully requires historical records, such as school records, and the person's guardian has consented.

12. Grievance Officer

If you have a concern about how we handle personal data, contact our Grievance Officer:

Mr. Pravin Dhumal, Grievance Officer
iSec Services Private Limited
607-608, Reliable Business Center, Anand Nagar, Jogeshwari (W), Mumbai - 400102, India
Email: pravin@ichek.info · Phone: +91 97731 98381

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

13. Changes to this policy

We may update this policy as our services or the law change. The date at the top shows when it was last revised. If a change materially affects you, we will tell you by email or with a notice on the website.

Contact us

iSec Services Private Limited (trading as iChek Services)
CIN: U72200MH2001PTC294487 · GSTIN: 27AABCI0493D1ZU
607-608, Reliable Business Center, Anand Nagar, Jogeshwari (W), Mumbai - 400102, Maharashtra, India
Email: contactus@isec.co.in · Phone: +91 97731 98381
Business hours: Monday to Saturday, 9 am to 6 pm IST (closed on the 2nd and 4th Saturday)