Policy Version: 1.0
Policy Owner: Data Protection Officer
Effective Date: 01st August 2026
Last Reviewed: 01st August 2026
Review Frequency: Annual or upon any material change in applicable data protection law
Gateway Distriparks Limited (“GDL”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of individuals whose personal data is processed in connection with our business and operations.
GDL has established this Personal Data Grievance Redressal Policy (“Policy”) to provide Data Principals with a readily accessible, transparent and effective mechanism for:
This Policy has been prepared considering the requirements of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and other applicable laws and regulations.
This Policy applies where GDL acts as a Data Fiduciary in relation to digital personal data processed in connection with its operations. It may cover personal data relating to, among others:
The Policy covers personal data processed in connection with GDL’s Inland Container Depots, Container Freight Stations, rail and road logistics operations, corporate offices, websites, digital platforms and other business processes.
Depending upon the processing activity, GDL may act as:
3.1 Data Fiduciary
GDL acts as a Data Fiduciary where it determines the purpose and means of processing personal data.
Examples may include personal data processed for:
3.2 Data Processor
In certain circumstances, GDL may process personal data solely on behalf of and under the instructions of another Data Fiduciary.
Where a grievance concerns personal data for which another organisation is the relevant Data Fiduciary, GDL may:
GDL has designated the following officer as the primary contact for matters relating to processing of personal data and privacy grievances:
Data Protection Officer / Grievance Officer
Name: Atul Kumar Bansal
Designation: Data Protection Officer
Company: Gateway Distriparks Limited
Email: dpo@gatewaydistriparks.com
Telephone: +91-11-40554400, Ext. 405
Business Hours: Monday to Friday, 10:00 AM to 6:00 PM IST
Address: 4th Floor, Prius Platinum, Saket District Centre, New Delhi – 110017, India
The Data Protection Officer / Grievance Officer shall act as the principal point of contact for Data Principals seeking information regarding GDL’s processing of their personal data or raising privacy-related grievances.
A Data Principal may raise a grievance relating to an act or omission concerning GDL’s processing of their personal data or the exercise of rights available under applicable law.
Grievances may include, but are not limited to:
5.1 Access to Personal Data
A request for information regarding personal data being processed by GDL, including information available to the Data Principal under applicable law.
5.2 Correction of Personal Data
A request to correct inaccurate or misleading personal data maintained by GDL.
5.3 Completion of Personal Data
A request to complete personal data that is incomplete.
5.4 Updating of Personal Data
A request to update personal data maintained by GDL.
5.5 Erasure of Personal Data
A request to erase personal data where such erasure is permissible under applicable law and the information is no longer required to be retained for a lawful purpose.
5.6 Withdrawal of Consent
A grievance concerning:
5.7 Unauthorised Processing
A concern that personal data has been collected, used, disclosed or otherwise processed without an appropriate lawful basis.
5.8 Excessive Collection
A concern that GDL has collected personal data that is not necessary for the specified purpose.
5.9 Unauthorised Disclosure or Sharing
A concern relating to unauthorised disclosure, transfer or sharing of personal data with another person or organisation.
5.10 Personal Data Security
A grievance relating to suspected:
5.11 Retention and Erasure
A concern that personal data is being retained beyond the period required for the specified purpose or applicable legal/regulatory requirements.
5.12 Children’s Personal Data
A grievance concerning processing of personal data relating to a child, including matters concerning verifiable consent of a parent or lawful guardian where required under applicable law.
5.13 Nomination
A request or grievance concerning the exercise of the right of nomination available under the DPDP Act and applicable Rules.
5.14 Other Privacy Concerns
Any other act or omission by GDL concerning processing of personal data or exercise of Data Principal rights.
A Data Principal may submit a personal-data grievance through one of the following channels:
By Email dpo@gatewaydistriparks.com
By Post Data Protection Officer / Grievance Officer Gateway Distriparks Limited 4th Floor, Prius Platinum Saket District Centre New Delhi – 110017 India
Online Through the GDL Privacy / Data Principal Rights / Grievance Request Website: www.gatewaydistriparks.com
GDL may implement additional electronic mechanisms, including a privacy request portal or Data Principal Request Management system, for submission and tracking of grievances.
To enable GDL to identify the Data Principal and investigate the grievance, the Data Principal should provide information reasonably necessary for processing the request.
This may include:
A Data Principal should not submit passwords, OTPs, PINs, complete banking credentials or personal data that is not reasonably necessary for resolution of the grievance.
GDL may take reasonable and proportionate measures to verify the identity of the Data Principal before disclosing, correcting, updating or erasing personal data.
Depending upon the request, verification may be undertaken through:
Additional identification documents should be requested only where reasonably necessary.
GDL shall endeavour to avoid collecting additional personal data solely for verification where identity can reasonably be established using information already available with GDL.
GDL shall follow the process below for handling privacy grievances.
A grievance received through the designated channel shall be recorded in the privacy grievance management system/register.
GDL shall ordinarily acknowledge receipt of a grievance within three working days.
Where technically feasible, a unique grievance or ticket reference number shall be provided to the Data Principal.
Where required, GDL shall verify the identity and authority of the person submitting the grievance.
The grievance shall be classified according to its nature, such as:
The grievance shall be assigned to the relevant GDL department or responsible person for investigation.
Depending upon the grievance, this may include:
The Data Protection Officer / Grievance Officer shall retain oversight of the grievance.
The relevant department shall investigate the grievance and may examine, where appropriate:
Where appropriate, corrective action may include:
GDL shall communicate the outcome of the grievance to the Data Principal, including, where appropriate:
The grievance shall be closed only after the outcome has been recorded and communicated to the Data Principal.
GDL shall maintain appropriate technical and organisational measures to ensure timely redressal of personal-data grievances.
The following service levels shall normally apply:
GDL will endeavour to resolve grievances substantially earlier than the maximum permitted period.
Where additional information is required from the Data Principal, GDL shall communicate the requirement promptly.
A complex grievance involving multiple systems, locations, processors, third parties, legal obligations or security investigations may require additional investigation; however, GDL shall manage such grievances within the applicable legally prescribed period.
Where a grievance indicates an actual or suspected personal data breach, it shall receive priority escalation and shall not wait for the ordinary grievance resolution cycle.
The Data Protection Officer / Grievance Officer shall coordinate, as appropriate, with:
The matter shall be handled in accordance with GDL’s Personal Data Breach Response / Incident Response Procedure.
Where required under applicable law, GDL shall provide the prescribed intimation concerning a personal data breach to affected Data Principals and to the Data Protection Board of India within the applicable timelines and in the prescribed manner.
Upon receiving a valid request from a Data Principal and after necessary verification, GDL shall take appropriate action in accordance with applicable law.
Correction
Inaccurate or misleading personal data may be corrected.
Completion
Incomplete personal data may be completed.
Updating
Outdated personal data may be updated.
Erasure
Personal data may be erased where the purpose for which it was processed is no longer being served and retention is not required under applicable law.
GDL may continue to retain personal data where retention is necessary for:
Where a request cannot be fully acted upon, GDL shall communicate the applicable reason to the Data Principal.
Where GDL processes personal data on the basis of consent, a Data Principal shall be provided with a mechanism to withdraw such consent.
The ease of withdrawing consent should be comparable to the ease with which consent was provided.
Following withdrawal of consent, GDL shall cease processing based on that consent within a reasonable time unless processing is otherwise required or permitted by applicable law.
Withdrawal of consent shall not affect processing lawfully undertaken before such withdrawal.
Where GDL has engaged a Data Processor for processing based solely on the withdrawn consent, GDL shall take appropriate steps in accordance with applicable law and contractual arrangements.
Employees, former employees and job applicants may raise privacy grievances relating to matters including:
A privacy grievance is distinct from a general employment grievance.
Where the matter relates solely to employment conditions, salary, leave, appraisal, workplace conduct or another HR matter without a personal-data issue, it may be handled under GDL’s applicable employee grievance policy.
Considering GDL’s logistics operations, privacy grievances may arise from personal data processed through:
Such grievances shall be handled under this Policy where GDL is responsible as the Data Fiduciary for the relevant processing.
Where GDL processes personal data of a child and the applicable DPDP requirements apply, appropriate measures shall be taken to obtain verifiable consent of the parent or lawful guardian where required.
Privacy grievances involving children’s personal data shall be handled with enhanced care and priority.
GDL may take appropriate steps to verify:
Where applicable under the DPDP Act and DPDP Rules, a Data Principal may nominate one or more individuals who may exercise prescribed rights on their behalf in the event of death or incapacity.
GDL may prescribe an appropriate procedure and verification mechanism for recording and acting upon such nominations.
Where the Data Principal is dissatisfied with the response provided, the matter may be escalated for further review by the Data Protection Officer.
The escalation request should include:
The DPO may obtain assistance from Legal, Information Security, HR, Compliance, IT or relevant senior management as required.
Where the applicable provisions of the DPDP Act and DPDP Rules are in force, a Data Principal should first provide GDL an opportunity to redress their grievance through the grievance-redressal mechanism provided under this Policy.
If the Data Principal remains dissatisfied after exhausting GDL’s grievance-redressal mechanism, they may approach the Data Protection Board of India in accordance with the procedure prescribed under applicable law.
GDL shall update its website with the relevant electronic complaint mechanism or official Board details as and when required.
While exercising rights or submitting grievances, Data Principals are expected to comply with their applicable duties under the DPDP Act.
A Data Principal should, among other things:
Nothing in this section is intended to discourage any individual from raising a genuine privacy concern.
GDL shall treat privacy grievances confidentially and restrict access to persons who reasonably require the information for investigation and resolution.
Information submitted as part of a grievance may be used for:
GDL shall maintain an appropriate Personal Data Grievance Register or electronic case-management record.
The register may record:
Access to the grievance register shall be appropriately controlled.
Records relating to grievances shall be retained for a period reasonably necessary for:
Grievance-related personal data shall not be retained indefinitely unless required by applicable law.
GDL shall maintain appropriate technical and organisational measures for effective grievance redressal, which may include:
No person shall be subjected to retaliation merely for raising a genuine privacy grievance or exercising a right available under applicable data protection law.
This Policy should be read together with GDL’s applicable:
Where a grievance relates to fraud, whistle-blowing, sexual harassment, employment conditions or other matters governed by a separate GDL policy, the matter may additionally or alternatively be handled under that specific policy.
The Data Protection Officer shall be the owner of this Policy and shall periodically review:
Material trends and significant privacy risks identified through grievances should be reported to appropriate senior management.
GDL may modify this Policy from time to time to reflect:
For questions, Data Principal requests or grievances concerning processing of personal data, please contact:
Mr. Atul Kumar Bansal Gateway Distriparks Limited 4th Floor, Prius Platinum Saket District Centre New Delhi – 110017, India
Working Hours: Monday–Friday, 10:00 AM–6:00 PM IST
“Committed to responsible processing of personal data and protection of Data Principal rights.”