Privacy Policy & Data Protection

1. Overview and Legal Commitment

StayQR24 ("StayQR24", "we", "our", or "us") provides hospitality management, contactless QR self check-in, and billing technology solutions to partner hotels, resorts, and accommodations across India.

We are committed to safeguarding personal information in strict adherence with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the applicable statutory regulations governing hotel guest registration under Indian hospitality and law enforcement rules.

2. Roles Under the DPDP Act, 2023

For the purposes of processing personal data under the DPDP Act:

3. Categories of Personal Data Collected

We collect and process digital personal data necessary for hospitality verification, safety, and accounting:

• Guest Identification Data: Full name, verified mobile phone number, residential address, city, state, pincode, nationality, age, and relationship of accompanying co-guests.
• Government Identity Documents: Digital copies and identity numbers (such as Aadhaar Card, Passport, Voter ID, or Driving License) captured strictly for statutory guest verification mandated by law.
• Facial Verification Imagery: Real-time photographs or selfies captured at check-in to confirm the identity of the checking-in guest.
• Stay & Financial Information: Room allocation, check-in and check-out timestamps, dining and service orders, total invoice value, and digital transaction receipts.
• Hotel Business Data: Hotel name, registered business address, GSTIN, business email, authorized personnel details, and staff credentials.

4. Specified Lawful Purpose of Processing

Personal data is processed strictly for legitimate and specified purposes under Section 4 and Section 6 of the DPDP Act:

5. Consent Notice & Unambiguous Consent

In accordance with Section 5 and Section 6 of the DPDP Act, whenever you use the StayQR self-registration portal, you are presented with a clear consent notice detailing the exact nature and purpose of data processing.

By submitting the registration form and checking the mandatory consent acknowledgment, you provide explicit, free, specific, and unambiguous consent for StayQR24 and the partner hotel to verify and process your personal information.

6. Processing of Children's Personal Data

Under Section 9 of the DPDP Act, processing data of individuals under eighteen (18) years of age requires verifiable parental or lawful guardian consent.

Co-guest details for minors staying at partner hotels are collected strictly from the accompanying parent or guardian who explicitly consents on behalf of the minor for hotel safety, room occupancy, and statutory reporting requirements.

7. Rights of the Data Principal

The DPDP Act confers specific rights upon you regarding your digital personal data:

8. Security Safeguards & Data Storage

StayQR24 employs enterprise-grade technical and organizational security controls pursuant to Section 8(5) of the DPDP Act:

• Transport Security: All data transmitted between your browser and our servers is encrypted using modern TLS / HTTPS (256-bit) encryption protocols.
• Document Isolation: Identification cards and facial captures are maintained in hardened, access-controlled cloud object storage. Documents are never made publicly indexed by search engines.
• Role-Based Access: Only authenticated hotel managers and authorized staff with legitimate administrative duties can view check-in records for their specific registered property.

9. Data Retention & Statutory Preservation

Under Indian hospitality regulations and local police guidelines, hotels are statutorily required to preserve guest arrival and departure registers, ID proofs, and billing records for prescribed audit periods (typically 1 to 3 years, depending on state police directives).

StayQR24 retains your records strictly to enable partner hotels to fulfill these statutory obligations. Upon expiration of the required statutory retention period, records are archived and scheduled for systematic purging.

11. Updates to this Policy

We may periodically update this Privacy Policy to reflect statutory rule amendments issued by the Ministry of Electronics and Information Technology (MeitY) or the Data Protection Board of India. Any updates will be published on this page with an updated "Last Updated" date.