Privacy Policy

DigiReg ("we", "us", "our", "Platform") is a cloud-based Hotel Management System operating at digireg.online. We provide hotel partners with digital tools for guest check-in, room management, reservations, billing, OTA channel management, and administrative operations.

DigiReg acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, responsible for determining the purpose and means of processing personal data on the platform.

This Privacy Policy applies to:

• Hotel Partners — registered hotels and lodging establishments using DigiReg
• Hotel Guests — individuals whose data is collected at check-in or reservation
• Hotel Staff — front desk and management personnel accessing the platform
• Platform Visitors — anyone visiting digireg.online
• Admin Users — DigiReg super administrators managing the platform

This policy covers all modules: Check-In Registration, Reservations, Billing & Invoicing, Room Management, OTA Channel Management, Draft Saving, and the Admin Dashboard.

• Full name, mobile number, email address
• Home / permanent residential address
• Government-issued photo ID type and number (Aadhaar, PAN, Passport, Driving Licence, Voter ID)
• Photographs of ID documents — front and back
• Digital signature captured at check-in
• Check-in date, time, and check-out date and time
• Room number, duration of stay, agreed room rate
• Booking reference, payment amounts, payment mode, transaction references
• Special requests or remarks (e.g. early check-in, dietary needs)

• Hotel name, registered address, city, state
• Contact person name, mobile number, email address
• GST number and PAN number
• Login username and cryptographically hashed password
• WiFi credentials (stored in encrypted form)
• SMS API keys (stored encrypted, never exposed in the user interface)
• Room configuration, rates, and room type details
• OTA channel integration settings

• IP address and login timestamps
• Browser type, device information, and operating system
• Session identifiers and activity logs
• Temporary draft form data (auto-cleared after 30 days or on submission)
• API request logs for security and auditing purposes

Under the Digital Personal Data Protection Act, 2023 and IT (SPDI) Rules, 2011, all data processing is conducted on the following lawful bases:

As Data Processors under Indian law, hotel partners using DigiReg must:

• Collect and use guest data only for lawful lodging, compliance, and operational purposes
• Display a physical or digital privacy notice at the reception / check-in point informing guests that their data will be recorded
• Obtain guest consent — fulfilled via the digital signature on the DigiReg check-in form
• Ensure all staff with platform access are trained on and bound by data protection obligations
• Not share, sell, or disclose guest data to any third party without explicit guest consent or legal compulsion
• Not use guest data for marketing, loyalty programmes or promotions without a separate explicit opt-in
• Report any actual or suspected data breach to DigiReg within 72 hours of discovery
• Maintain physical and device security for all computers and mobile devices used to access the platform
• Cooperate fully with DigiReg in any data protection audit, investigation, or legal inquiry
• Ensure data is not retained beyond the legally prescribed periods (see Section 9)

Under the Hotel and Lodging House (Licensing and Control) Rules applicable in most Indian states and the Foreigners Act, 1946, hotel establishments are legally mandated to maintain a guest register recording identity proof details for every guest.

• Aadhaar numbers are not used for authentication — recorded only for identity compliance as legally permitted
• ID photographs are stored securely per hotel and are not shared across hotels or with any third party
• We strongly recommend hotels record only the last 4 digits of Aadhaar where the full number is not legally required
• DigiReg does not operate any central biometric database
• Physical photocopying of Aadhaar cards is not recommended — use the DigiReg camera capture feature instead
• ID data is shared with law enforcement only upon a valid legal order

• The digital signature captured in DigiReg constitutes the guest's consent to data collection for lodging compliance
• Signatures are stored as encrypted image data linked to the specific guest record
• Signatures are not used for any purpose other than the guest register record

• All data is stored on servers physically located in India — compliant with data localisation requirements
• Each hotel's data is completely isolated — no cross-hotel data access is possible
• Database backups are encrypted and stored in India

• DigiReg staff access to production data is strictly limited and logged
• Regular security reviews and vulnerability assessments conducted
• Partner hotel staff are responsible for device and login credential security

We retain data only as long as legally required or necessary for platform operations:

As a commitment to our hotel partners and their guests, DigiReg makes the following absolute guarantees:

DigiReg integrates with a limited number of third-party services strictly for operational purposes. Data shared is the minimum necessary:

Under the Digital Personal Data Protection Act, 2023, all individuals (Data Principals) have the following rights:

• Contact your hotel directly for access or correction of your check-in record
• Contact DigiReg at privacy@digireg.online for platform-level data requests
• All requests acknowledged within 3 business days and resolved within 30 days
• If unsatisfied with DigiReg's response, you may approach the Data Protection Board of India

DigiReg uses only essential session cookies required for platform functionality. We do not use advertising cookies, tracking cookies, or analytics cookies from third parties.

DigiReg's hotel management platform is designed for use by adults only — hotel partners, staff, and adult guests.

• We do not knowingly collect personal data from individuals under 18 years of age as independent platform users
• Guest data for minor family members may be recorded as part of a family check-in — with the consent of the accompanying adult
• Under the DPDP Act, 2023, processing of data of children requires verifiable parental consent
• If we discover that data of a child has been collected without parental consent, we will delete it promptly

In the event of a data breach, DigiReg follows this structured response protocol:

This Privacy Policy may be updated periodically to reflect changes in Indian law, platform features, or operational practices.

• Hotel partners will be notified of material changes via email at least 30 days before they take effect
• The updated policy will always be available at digireg.online/privacy-policy
• Continued use of the DigiReg platform after the effective date of a policy update constitutes acceptance of the revised policy
• Version history is maintained and available upon request
• For minor clarifications or formatting changes, no advance notice may be given — the "Last Updated" date will reflect any change

As required under Rule 5(9) of the IT (SPDI) Rules, 2011 and Section 13 of the DPDP Act, 2023, DigiReg has designated a Grievance Officer:

This Privacy Policy is governed exclusively by the laws of the Republic of India. The following acts and regulations apply:

• Digital Personal Data Protection Act, 2023 (DPDP Act) — primary data protection law
• Information Technology Act, 2000 and IT (Amendment) Act, 2008
• IT (Reasonable Security Practices) Rules, 2011
• Indian Contract Act, 1872 — for partner agreements
• Consumer Protection Act, 2019 — for guest rights
• Income Tax Act, 1961 — for financial data retention