Data Protection Policy

DigiReg ("Platform", "We", "Us") is committed to protecting the personal data of hotel partners, their staff, and guests in full compliance with Indian law. This policy governs how data is collected, stored, processed, and protected across all modules of the DigiReg Hotel Management System.

We believe privacy is a fundamental right. Every feature of DigiReg is designed with data minimisation and security as core principles, not afterthoughts.

This policy is governed by the following Indian laws and regulations:

• Full name, mobile number, email address
• Home / permanent address
• Government ID type and number (Aadhaar, PAN, Passport, Driving Licence, Voter ID)
• ID photographs — front and back images
• Digital guest signature
• Check-in and check-out date & time
• Room number, duration of stay, agreed rate
• Payment details — advance paid, balance due, payment mode, transaction reference
• Booking reference number and reservation linkage
• Special remarks or requests

• Hotel name, contact person name, address, city, state
• Mobile number, email address
• GST number and PAN number
• Username and cryptographically hashed password
• WiFi credentials (stored encrypted)
• SMS API keys (stored encrypted, never exposed in UI)
• Total rooms count and room configuration

• Login timestamps and IP addresses
• Session identifiers and activity logs
• Browser and device information (user-agent)
• Draft form data (temporary, cleared after submission)

Data is collected strictly for the following lawful purposes under Section 4 of the DPDP Act, 2023:

Under the DPDP Act, 2023 and SPDI Rules, 2011, we process data on the following lawful bases:

• Consent — Obtained from guests at check-in via digital signature on the registration form
• Legal Obligation — Hotel establishments are legally required to maintain guest registers under state Police Acts and The Foreigners Act, 1946
• Contractual Necessity — For executing reservations, issuing invoices, and managing room allocations
• Legitimate Interest — For platform security, fraud prevention, session management, and service continuity

As a DigiReg partner (acting as Data Processor under the DPDP Act, 2023), registered hotels agree to:

• Collect guest data only for lawful lodging and compliance purposes
• Display a privacy notice at the front desk or on the check-in interface
• Not share guest data with any third party without explicit written consent
• Ensure all staff accessing the system are bound by confidentiality obligations
• Report any suspected or confirmed data breach to DigiReg within 72 hours of discovery
• Not retain guest data beyond the legally required retention period (generally 1–5 years depending on state regulations)
• Ensure physical and device security for all terminals accessing the platform
• Not use guest data for marketing, promotions, or upselling without a separate, explicit opt-in consent
• Cooperate with DigiReg in any audit or investigation related to data protection

• All data is stored on servers located in India in compliance with data localisation requirements
• Guest ID photographs and signatures are stored as encrypted data
• Database access is restricted by role-based access control (RBAC)
• Each hotel can only access its own data — complete data isolation

• Encryption — All sensitive data encrypted at rest and in transit via HTTPS/TLS
• Access Control — Hotel staff see only their own hotel's guest data
• Password Security — Passwords stored using one-way cryptographic hashing (never plain text)
• Session Management — Automatic session timeout after inactivity
• Audit Logs — All login events and data access actions are logged with timestamps
• API Security — All API endpoints require authenticated hotel sessions
• Draft Data — Form drafts cleared after successful submission or after 30 days

Under the Digital Personal Data Protection Act, 2023, guests and individuals have the following rights:

Collection of Aadhaar numbers is governed by the Aadhaar Act, 2016. DigiReg and its partners:

• Do not use Aadhaar for authentication purposes — only for identity recording as legally permitted
• Do not store Aadhaar data in any central biometric database
• Store all ID numbers in encrypted form with restricted access
• Recommend hotels record only the last 4 digits of Aadhaar where the full number is not legally required
• Do not share ID data with any third party except law enforcement with a valid legal order
• ID photographs are stored locally per hotel and are not shared across the platform

In the event of a data breach, DigiReg will follow this response protocol:

Data may be shared only in the following strictly limited circumstances:

As required under Rule 5(9) of the SPDI Rules, 2011 and Section 13 of the DPDP Act, 2023:

This policy may be updated periodically to reflect changes in Indian law, platform features, or operational practices.

• Partners will be notified of material changes via email at least 30 days before they take effect
• The updated policy will be published at digireg.online/data-protection-policy
• Continued use of the platform after the effective date constitutes acceptance of the updated policy
• Version history will be maintained and available on request

By registering and using the DigiReg platform, hotel partners confirm they have:

• Read and fully understood this Data Protection Policy
• Agreed to comply with all partner obligations as Data Processors under Indian law
• Accepted responsibility for ensuring their staff follow data protection practices
• Acknowledged that violations may result in suspension of platform access