1Introduction & Scope
Welcome to PG-SETU ("PGSetu", "we", "our", "us"), operated by PGSetu PropTech Technologies Pvt. Ltd. (website: staysetu-ruby.vercel.app). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our platform.
This policy applies to all users of our platform, including:
- Property Owners / PG Managers: Using our ERP CRM dashboard.
- Tenants / Residents: Using the tenant portal and marketplace.
- Visitors: Browsing our property marketplace.
2Information We Collect
(a) Account & Identity Data
Name, phone number, email address, date of birth, gender, profile photo, and masked Aadhaar number (last 4 digits visible).
(b) Property & Listing Data
For owners: property details, ownership proofs, GST details (if applicable), and bank account details for settlements.
(c) Resident/Tenant Data
Check-in/check-out records, emergency contacts, KYC documents, rent payment history, and grievance records.
(d) Payment Information
Transaction IDs, payment modes (UPI/bank transfer). Note: We do NOT store full credit/debit card numbers.
(e) Device & Usage Data
IP addresses, browser types, operating systems, and pages visited on our platform.
(f) Communications
WhatsApp messages sent via our official bot, email correspondence, and support tickets.
3Legal Basis for Processing
We process your personal data under the following legal frameworks:
- Information Technology Act, 2000 and the SPDI Rules, 2011 (India).
- Consent: Where you have provided explicit consent.
- Contractual Necessity: To fulfill our agreements with owners and tenants.
- Legitimate Interests: To improve our services, prevent fraud, and ensure security.
4How We Use Your Information
- Account Management: Creating and maintaining user accounts.
- KYC Verification: Validating identities to ensure platform safety.
- Billing & Payments: Processing rent, deposits, and service fees.
- Platform Analytics: Understanding user behavior to improve our UI/UX.
- Communications: Sending OTPs, payment reminders, and essential updates.
- Safety & Security: Monitoring for unauthorized access or fraudulent activities.
6. Aadhaar & KYC Data (Special Policy)
We strictly adhere to UIDAI regulations regarding Aadhaar data collection and storage:
- All KYC data is encrypted at rest using 256-bit encryption.
- We never store full 12-digit Aadhaar numbers long-term. Only masked formats (e.g., XXXXXXXX1234) are retained.
- Live photos and biometric data (if collected during e-KYC) are not retained beyond the immediate verification process.
7International Data Transfers
While PG-SETU operates in India, some of our cloud infrastructure (such as Supabase or Firebase) may involve servers located outside India (e.g., the United States). In such cases, we ensure that adequate Standard Contractual Clauses and security measures are in place to protect your data.
8Data Retention
| Data Type | Retention Period |
|---|---|
| Account Data | Until account deletion request is processed. |
| KYC Records | 5 years (as per regulatory/law enforcement requirements). |
| Payment Records | 7 years (as per tax and financial laws). |
| Usage Logs | 90 days. |
9Your Rights
Depending on your jurisdiction, you have the right to:
- Access: Request copies of your personal data.
- Correction: Request correction of inaccurate data.
- Deletion: Request erasure of your data (subject to legal retention requirements).
- Restrict Processing: Request limitations on how we use your data.
- Data Portability: Request transfer of your data to another organization.
- Withdraw Consent: Withdraw previously given consent for data processing.
11Children's Privacy
Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal identifiable information from anyone under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us.
12Security Measures
The security of your data is important to us. We implement robust security measures including:
- 256-bit Encryption: For data in transit and at rest.
- Role-Based Access Control (RBAC): To ensure employees/staff only access data necessary for their roles.
- Audit Logs: Tracking access to sensitive information.
- No Full Aadhaar Storage: Minimizing risk by not storing highly sensitive unmasked IDs.
13Grievance Officer
In accordance with the Information Technology Act, 2000 and rules made there under, the name and contact details of the Grievance Officer are provided below:
We will acknowledge your complaint within 24 hours and aim to resolve it within 30 days.
14Changes to Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. You are advised to review this Privacy Policy periodically for any changes.
15Contact Us
If you have any questions about this Privacy Policy, please contact us at: vikramtomar0505@gmail.com.