Draft for legal review. The highlighted items in square brackets still need the owner's details, and a lawyer should check this page before launch.
1. Who we are
This policy is from SWASTIK ENTERPRISES, the operator of CheckInKYC and a UIDAI-registered Offline Verification Seeking Entity (OVSE), registration number OR11274063. We take care with personal data and have tried to explain it plainly. It covers three groups of people: visitors to this website, hotel staff who use CheckInKYC, and guests who check in at a hotel that uses it.
2. Visitors to this website
What we collect
You can browse this website without giving us anything. If you ask for a free trial, contact us, or request details, we collect what you type into the form: hotel name, city, number of rooms, your name, phone number, email address and any message you add, together with the language of the page and which button you used. To protect the form from abuse, we keep a short one-way code made from your connection's address, not the address itself.
What we do not do
This website has no advertising, no tracking cookies and no analytics scripts at the time of writing, and its fonts and images are served from the site itself. If that ever changes we will update this policy and ask for consent where the law requires it.
Why we use it
- to reply to your request and contact you about CheckInKYC;
- to send you an email confirming that we received it;
- to set up your trial or answer your questions, and to keep a record of the conversation.
We use it because you asked us to and agreed when you ticked the box on the form. We do not sell it, and we do not use it for unrelated marketing without asking.
How it is kept
Your name, phone, email, hotel name and message are stored encrypted and are visible only to our authorised team. We delete an enquiry 180 days after we receive it, unless you have become a customer, in which case the details become part of your account. The email we send you and the notice to our team pass through the mail server of our hosting provider PrivateSystems (mail.checkinkyc.com).
3. Hotel staff
For each staff member the hotel adds, we keep a username, name and role, a password stored only in scrambled form, and a log of what the account did (for example, signed in, viewed a record, printed a record with a stated reason). The log contains no guest personal data.
4. Guests who check in
Before anything is read, the guest sees a notice and agrees by starting the check. The hotel decides why it needs the details and how long to keep them; we handle them on its behalf to provide the service, and as an OVSE for the verification itself.
What may be read
- By default: the guest's name, whether they are 18 or older (or year of birth), the last four digits of the Aadhaar number, and the photograph in the document.
- Only if the hotel has switched it on, and the guest sees it before sharing: date of birth, gender, address, mobile number or email.
- Stay details the guest or reception enters: dates, number of guests, and a booking reference.
- For a guest who does not use Aadhaar, reception records the type of ID and its last characters.
We do not ask for the full 12-digit Aadhaar number, and the Aadhaar App route does not pass it to the verifier. A hotel may also keep pictures of a card or document, but only when it has turned that on and the guest agrees separately, because those pictures can show the full number.
How long
The hotel sets a retention period after check-out. When it ends, the guest's personal data is deleted automatically. We keep a log of each verification attempt (time, route used and result) without any personal data.
Who sees it
- The hotel's staff, according to their role. Printing a full record needs a stated reason, which is logged.
- Our team, only to run and support the service and only as needed.
- Authorities, where a lawful request requires it. We route such requests through the hotel where we can.
5. How we protect data
- Each hotel's data is encrypted with its own key.
- Staff see only what their role allows, and guests and staff use separate screens.
- Connections use HTTPS, and sensitive actions are logged.
- The service is backed up and monitored, and personal data is deleted on schedule.
No system is perfectly safe. If we learn of a breach that affects personal data, we will tell the affected hotel and the authorities as the law requires.
6. Sharing
We do not sell personal data. We share it only with the hotel concerned, with service providers who help us run CheckInKYC (hosting on DigitalOcean (Bangalore, India) and email through PrivateSystems) under confidentiality, with UIDAI where the verification process requires, and with authorities when the law requires.
7. Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask to see the personal data we hold about you, correct it, have it erased when it is no longer needed, withdraw consent you gave, and complain. A guest should usually ask the hotel first, since it decides what it keeps; you can also write to us and we will help. To use any of these rights, or to complain, write to our grievance contact below. If you are not satisfied with our reply, you may approach the Data Protection Board of India once it is in operation for your case.
Withdrawing consent for contact is simple: tell us and we will stop. A guest who does not want to use Aadhaar can ask reception to check in with another ID.
8. Children
This website is for hotel owners and managers and is not meant for children. Where a guest at a hotel is under 18, the hotel's own rules and the law about minors apply, and the hotel is responsible for them.
9. Changes
We may change this policy. The date at the top shows the latest version. We will tell hotels about changes that matter to them.
10. Contact and grievances
Grievance contact: [NAME OF GRIEVANCE OFFICER], SWASTIK ENTERPRISES, [REGISTERED ADDRESS]. Email: hello@checkinkyc.com. We aim to reply within [NUMBER] working days.