Privacy Policy

MSH Online Services is a Common Service Centre (CSC) authorized facilitator providing government digital service assistance to citizens of Karnataka. We are not a government body — we are a private facilitation agency that assists citizens in applying for government services, uploading documents, and tracking application status on their behalf.

To process your service application, we collect the following information from you:

2.1 Personal Identification Information

• Full name as per Aadhaar / government records
• Mobile number (10 digits, Indian)
• Email address (optional, for status notifications)
• Residential address

2.2 Documents & Files (Sensitive Personal Data)

• Aadhaar card (front and back) — image/scan
• PAN card, Voter ID, Ration card, Birth certificate
• Passport-size photograph
• Bank passbook / statement
• Any other document specifically required for the applied service

2.3 Technical & Usage Information

• IP address and browser type (via server logs)
• Device type and operating system
• Date and time of application submission
• Service type selected

Your personal information is used only for the following purposes:

• Processing your application for the selected government service (PAN, Aadhaar, Voter ID, Labour Card, etc.)
• Sending application confirmation via SMS and email
• Notifying you of status updates (Working / Busy / Done / Rejected) via SMS and email
• Requesting additional documents needed to complete your application
• Assigning a worker to process your application
• Internal audit and record-keeping as required by law
• Responding to your queries or grievances

Our data collection and processing activities are governed by the following Indian laws and regulations:

By submitting an application on this portal, you provide your informed consent for collection and use of your personal data as described in this policy, in accordance with Rule 5 of the IT (SPDI) Rules, 2011.

We may share your information with the following parties only when necessary to process your service request:

We do not share your data with any private companies, advertisers, data brokers, or non-essential third parties. All our service providers are bound by confidentiality obligations.

We implement the following security measures as required under Section 43A of the IT Act, 2000 and Rule 8 of the IT (SPDI) Rules, 2011:

• Access Control: Only authorized admin and assigned workers can access your application data
• Password Security: All worker accounts use bcrypt-hashed passwords (industry standard)
• Prepared Statements: All database queries use parameterized statements to prevent SQL injection
• Secure File Storage: Uploaded documents are stored in a protected directory with PHP execution disabled
• Secure Upload Links: Document upload requests use cryptographically random tokens expiring in 7 days
• Session Security: Admin and worker sessions are server-side managed and expire on logout
• HTTPS: All data transmission is encrypted using SSL/TLS
• Audit Logs: All administrative actions are logged with timestamp, actor, and changes

We retain your personal data only for as long as necessary to fulfill the purpose for which it was collected:

Upon expiry of the retention period, data is permanently deleted from our systems. You may also request earlier deletion (see Section 8).

Under the Digital Personal Data Protection Act (DPDP), 2023 and the IT (SPDI) Rules, 2011, you have the following rights as a Data Principal:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of any inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw consent for processing of sensitive personal data at any time (note: this may prevent us from completing your service request)
• Right to Grievance Redressal: File a complaint with our designated Grievance Officer (see Section 12)
• Right to Nominate: Nominate a person to exercise your rights in the event of death or incapacity (DPDP Act, 2023)

To exercise any of these rights, contact us at support@mshonlineservices.com or call 9740133517 with your application ticket number and a valid identity document.

We will respond to your request within 30 days as required under applicable Indian law.

Our website uses essential session cookies only — these are required for the portal to function (for example, to keep admin and worker sessions active). We do not use:

• Tracking or advertising cookies
• Third-party analytics (Google Analytics or similar) that track individual users
• Browser fingerprinting or cross-site tracking

Server logs automatically record IP addresses and access times for security monitoring. These logs are not used for profiling and are deleted within 90 days.

Our services are intended for individuals 18 years of age and above. For minors applying for services such as SBI Zero Balance Account (Below 18) or student-related documents, a parent or legal guardian must submit the application on the minor's behalf and provide their own consent.

We do not knowingly collect personal data directly from children under the age of 18 without verifiable parental consent, in compliance with the DPDP Act, 2023 (Section 9).

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable Indian law. When we make significant changes:

• The "Last Updated" date at the top of this page will be revised
• For significant changes, we will notify registered users via SMS or email
• Continued use of our services after the effective date constitutes acceptance of the revised policy

We recommend reviewing this policy periodically. Previous versions are available on request.

As required under Rule 5(9) of the IT (SPDI) Rules, 2011 and Section 13 of the DPDP Act, 2023, we have designated a Grievance Officer to address privacy-related complaints:

If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India (once constituted under the DPDP Act, 2023) or file a complaint under the IT Act, 2000 with the relevant Adjudicating Officer.

For any questions, requests, or concerns related to this Privacy Policy or your personal data, please contact us: