Aadhaar and passport data, handled the way the law expects.
Vasuttam acts as a data processor for the property (the data fiduciary). This page explains what guest personal data the PMS collects, why, how long it is kept and how guests can exercise their rights.
We never store the full 12-digit Aadhaar number
The Aadhaar QR / OCR scan captures name, date of birth, gender and address for the guest registration card. Only the last four digits are retained, in line with the UIDAI advisory on masked Aadhaar and Section 8 of the Aadhaar Act, 2016. Offline XML and DigiLocker verification are preferred over card photographs.
Guest identity data is collected only for lawful stay purposes
Identity documents are collected to satisfy the Sarais Act / state police lodging registers and, for foreign nationals, the Foreigners Act Form-C filing. They are not used for marketing, profiling or resale.
Digital GRC includes a DPDP consent notice
The guest registration card shown on screen or on the pre-arrival link states what is collected, why, how long it is kept and how to withdraw consent, as required by the Digital Personal Data Protection Act, 2023 and the DPDP Rules.
Document images purge automatically
Scanned ID images are deleted after the statutory retention window configured by the property (default 90 days after checkout). Form-C records and GST invoices are kept for the periods the FRRO and CGST Act require. Guests may request erasure through the property; requests are fulfilled within 30 days.
Encrypted at rest, role-restricted on screen
Identity images are encrypted at rest and in transit. Only front-desk and manager roles can open them; housekeeping, POS and read-only roles cannot. Every view and export is written to the property audit log with staff name and timestamp.
Stored in India, breaches reported
Guest personal data is hosted in Indian data-centre regions. In the event of a personal data breach we notify the Data Protection Board of India and affected properties as the DPDP Act and CERT-In directions require.
| Data | Source | Retention |
|---|---|---|
| Name, DOB, gender, address | Aadhaar / passport / DL / Voter ID scan | Stay register retention (property-set) |
| Aadhaar last 4 digits | Aadhaar QR / OCR | Same as register |
| ID document image | Camera / scanner / pre-arrival upload | 90 days after checkout (default) |
| Passport & visa details | MRZ / visa scan | FRRO Form-C statutory period |
| Phone, email | Booking / GRC | Until erasure request |
| GSTIN, company name | Corporate BTC billing | CGST Act invoice retention |
Guest rights under the DPDP Act: access, correction, erasure, grievance redressal and nomination. Guests raise requests with the property; the property fulfils them in the PMS and Vasuttam executes deletion across backups within 30 days. Escalations: privacy@vasuttam.com, then the Data Protection Board of India.