Draft: needs legal review
Privacy policy
Last updated 27 October 2026
This text is a working draft written for the pilot. It is not legal advice and has not been reviewed by a lawyer. Do not rely on it until it is reviewed and approved.
1. Scope
This policy explains how HotelOS handles personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. For guest data, the hotel is the Data Fiduciary and HotelOS is its Data Processor. For hotel staff accounts and our own customer contacts, HotelOS is the Data Fiduciary.
2. What we collect
Staff: name, phone, email, duties, shifts and sign in records. Guests (for the hotel): name, contact details, stay details, bills and payments, ID details where the law asks for them (staff see only the last four digits), Form C details for foreign guests, requests and reviews.
3. Why we use it
To run the stay and the hotel: bookings, check in, bills and GST invoices, housekeeping and requests, legal reporting such as Form C, and security. Marketing messages go only to guests who gave consent, and they can withdraw it at any time.
4. Consent and notice
Where processing relies on consent, the notice is shown in English or Hindi before data is collected, consent is recorded with time and purpose, and withdrawing it is as easy as giving it.
5. Your rights
You can ask for a summary of your data, correct it, have it erased when it is no longer needed, nominate someone to act for you, and raise a grievance. Guests should contact the hotel first; we help the hotel answer within the time the rules set.
6. Children
We do not knowingly process a child's data except as part of a family booking made by a parent or guardian, and we do not track or target children with advertising.
7. Security
Data is encrypted in transit and at rest, each hotel's data is kept apart by row level security, staff see only what their duties need, and access to sensitive records is logged.
8. Breaches
If a personal data breach happens we inform the hotel without delay so that the Data Protection Board of India and the people affected can be told as the rules require.
9. Retention
We keep data while the hotel uses the service and for as long as laws such as GST and foreigner registration rules require, then erase it.
10. Where data is stored
Data is stored with our hosting providers [hosting region]. Any transfer outside India follows the DPDP Act and any restriction the government notifies.
11. Grievance officer
[Name], Grievance Officer, [email], [phone]. We reply within [7] days. If you are not satisfied you may approach the Data Protection Board of India.