Kota Rental Legal Center
Customer Privacy & Document Policy
This Policy details how Kota Rental collects, handles, protects, and permanently purges customer personal details, driver credentials, and government identity documents under applicable Indian privacy laws.
1. Overview & Corporate Scope
Kota Rental Technologies (“Kota Rental”, “we”, “our”, or “us”) operates vehicle reservation platforms, logistics hubs, and handover depots across Kota, Rajasthan. This Privacy Notice governs the collection, processing, storage, and deletion of personal data when you access our website, book vehicles, provide driver credentials, or receive doorstep flatbed delivery.
We operate strictly under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and the Motor Vehicles Act, 1988. We collect only what is strictly necessary to confirm vehicle bookings, enforce physical driver qualifications, and prevent motor vehicle fraud.
2. Categories of Information We Collect
We collect information directly from you when you book a vehicle or submit required credentials:
| Data Category | Specific Data Elements | Statutory / Operational Purpose |
|---|---|---|
| Customer Profile | Full legal name, phone number, email address. | Reservation confirmation, SMS/WhatsApp updates, deposit receipt. |
| Driver Credentials | Valid Driving License (front and back image). | Mandatory verification under Section 3 of the Motor Vehicles Act, 1988. |
| Government Identity | Masked Aadhaar (first 8 digits obscured) or Voter ID / Passport. | Identity verification to prevent vehicle theft, unauthorized transfer, and fraud. |
| Payment Telemetry | Razorpay payment ID, order ID, transaction status, bank/UPI reference. | Payment verification and automated security deposit refund disbursement. |
| Logistics & Location | Selected chauraha, delivery notes, vehicle fuel and odometer readings. | 24/7 doorstep tow-truck delivery and vehicle return fuel reconciliation. |
Payment Security: Kota Rental never collects, stores, or sees full debit/credit card numbers or CVVs. All transactions are securely handled via RBI-authorized, PCI-DSS Level 1 compliant payment gateways (Razorpay).
3. Purpose Limitation: How We Use Your Data
In compliance with Section 4 of the DPDP Act, your data is collected strictly for specified, lawful business purposes:
- Contract Execution: Provision of reservation confirmations, vehicle allocation, tow-truck delivery routing, and return inspection.
- Regulatory Compliance: Fulfilling state transport authority mandates requiring rental agencies to verify driver eligibility.
- Security Deposit Settlement: Processing prompt deposit returns within 2 hours of return inspection.
- Customer Assistance: Providing 24/7 roadside mechanical assistance and flatbed recovery during active trip windows.
4. Driver & Identity Document Verification Safeguards
To eliminate public accessibility and prevent unauthorized document harvesting:
One-Time Cryptographic Tokens
Upload links are secured with 32-byte cryptographic hashes that expire 24 hours post-payment or 3 hours before pickup. Unauthenticated users cannot view or submit forms.
UIDAI Masked Aadhaar Acceptance
We explicitly welcome Masked Aadhaar cards downloadable from UIDAI where only the last 4 digits are visible, preserving full biometric and national ID privacy.
Mandatory Physical Match at Handover: As per security guidelines, the physical driving license and government ID must be shown to the dispatch driver at handover to verify physical possession.
5. Automated Data Retention & Erasure Schedule
Under Section 8(7) of the DPDP Act, personal data is permanently purged once operational and statutory requirements are fulfilled:
| Data Category | Retention Window | Purge Procedure |
|---|---|---|
| Unpaid Document Uploads | 24 Hours | Files uploaded without a confirmed booking are automatically erased from secure cloud storage. |
| Completed Rental Documents | 7 Days post-return | Government ID & License images are permanently purged once the vehicle is returned and security deposit settled. |
| Accounting & Tax Invoices | Statutory Period | Standard billing transaction records (excluding identity document images) are retained solely for tax audits. |
8. Your Statutory Rights Under the DPDP Act, 2023
As a customer (“Data Principal”), you possess full legal rights:
Request a complete summary of your personal data processed by Kota Rental.
Request correction of outdated information or early erasure of identity documents once deposits are settled.
Lodge an inquiry directly with our Grievance Officer, with response guaranteed within statutory timelines.
Designate another individual to exercise data rights on your behalf in the event of incapacity.
9. Non-Disclosure & Zero Commercial Sale of Data
9.1. Kota Rental does not sell, lease, license, monetize, or trade customer personal information, telephone numbers, driving licenses, or identity credentials with third-party advertisers, data brokers, or marketing networks.
9.2. Customer data is utilized exclusively for identity authentication, vehicle reservation, statutory compliance under the Motor Vehicles Act, 1988, and dispute resolution.
10. Storage Infrastructure & Cryptographic Security
All identity proofs are protected through enterprise security controls:
- AES-256 Server-Side Encryption: Stored in private encrypted object buckets with no public bucket read access.
- Time-Limited Signed URLs: Authorized depot managers inspect verification proofs exclusively via short-lived, 5-minute cryptographic presigned URLs.
- Strict Internal Auditing: Every verification inspection creates an immutable audit record containing staff ID, timestamp, and IP address.
11. Statutory Grievance Redressal Officer
Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 12 of the DPDP Act, 2023, the designated Grievance Officer details are published below:
Grievance Officer & Legal Counsel, Kota Rental Technologies