**Privacy Policy For DocScan.in**

Last Updated: 05-12-2025

DocScan.in (“Platform”), owned and operated by DocScan.in (“Company”, “We”, “Us”, “Our”), is committed to protecting your privacy and ensuring the responsible handling of personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our platform and services.

By accessing or using DocScan.in, you agree to the terms of this Privacy Policy.

1. Definitions

1. Personal Data – Any data about an individual who can be identified directly or indirectly (e.g., name, passport number, Aadhaar, PAN, images).
2. Data Fiduciary – The entity that determines the purpose and means of processing personal data.
3. Data Processor – The entity that processes personal data on behalf of the Data Fiduciary.
4. User/Subscriber – Individuals or businesses who register for and use DocScan.in.
5. Data Principal – The individual whose personal data is uploaded (e.g., passport or ID holders).

2. Role Under DPDP Act 2023

• Subscribers (travel agents or businesses) act as the Data Fiduciary.
• DocScan.in acts as the Data Processor, processing personal data solely for providing scanning, OCR, storage, and reporting services.

We do not sell, share, or use data for any purpose other than service delivery.

3. Types of Personal Data We Process

The Platform processes the following categories of personal data uploaded by Users:

3.1 User-Provided Business Information

• Name
• Email address
• Phone number
• Billing information
• Business name & address

3.2 Customer Documents (Uploaded by Users)

• Passport (MRZ, bio page, photo)
• Aadhaar & PAN card
• Visa pages
• Other ID documents
• Photos, scanned images, PDFs

3.3 System-Generated Information

• OCR-extracted text
• Metadata
• Activity logs (timestamp, IP for security)

DocScan.in does not collect personal data directly from the Data Principal.

4. Purpose of Data Processing

DocScan.in processes data only for the following purposes:

1. Document scanning & OCR data extraction
2. Generating reports (Excel/CSV)
3. Providing secure online storage
4. Improving scanning accuracy & system performance
5. Account creation, billing, and customer support
6. Fraud prevention & system security monitoring
7. Meeting legal obligations

We do not engage in any profiling or automated decision-making that affects users’ rights.

5. Lawful Basis of Processing

Under DPDP Act 2023:

• Users must obtain valid consent from their customers before uploading any personal data.
• DocScan.in, as a Data Processor, processes the data only under the User’s instructions.

The User is solely responsible for ensuring lawful collection of customer data.

6. Consent Responsibilities

6.1 User (Data Fiduciary) Responsibility

The User must:

• Obtain free, informed, and unambiguous consent from Data Principals.
• Provide the Data Principal with their own privacy notice.
• Respect requests for data access, correction, erasure, or withdrawal of consent.

6.2 DocScan.in (Data Processor) Responsibility

We will:

• Process personal data only on written/electronic instructions.
• Assist Fiduciaries with compliance when required.
• Not process data for our own purposes.

7. Data Sharing & Disclosure

DocScan.in does not:

• Sell data
• Share data with advertisers
• Use data for analytics beyond service improvement

Data may be shared only with:

• Authorized internal staff (restricted & monitored)
• Cloud hosting providers (secure servers)
• Government agencies, only when required by law
• Third-party service providers, strictly under confidentiality and data-protection agreements

8. Data Security Measures

We implement strong administrative, technical, and organisational security measures including:

• Encryption in transit (HTTPS/SSL)
• Secure cloud storage
• Access control & role-based permissions
• Audit logs
• Firewall & anti-malware protections
• Regular vulnerability reviews

However, no system can guarantee 100% security.

9. Data Retention & Deletion

• User and customer documents are retained only for the duration of the subscription or as required by law.
• Upon cancellation/expiry of subscription, data is deleted after [X] days unless the User downloads it.
• Users may request earlier deletion.

DocScan.in does not retain data beyond what is required for service operations.

10. Rights of Data Principals (DPDP Act 2023)

Although DocScan.in does not directly interact with Data Principals, we support Users in honouring the following rights:

1. Right to Access
2. Right to Correction
3. Right to Erasure
4. Right to Grievance Redressal
5. Right to Nominate in case of incapacity or death

Users must submit these requests via their DocScan.in account or email.

11. Cross-Border Data Transfer

If data is stored or processed on servers located outside India, such transfer will comply with:

• DPDP Act rules on international data transfer
• Adequate data protection safeguards

We ensure that hosting partners meet global security and compliance standards.

12. Cookies & Tracking

DocScan.in may use cookies for:

• Login sessions
• Security
• Improving user experience

We do not use cookies for advertising or behavioural profiling.

13. Third-Party Links

Our Platform may contain links to external websites.
We are not responsible for the privacy practices of those websites.
Users should review their respective policies.

14. Children’s Privacy

DocScan.in does not knowingly process data of minors below 18 unless uploaded by a Data Fiduciary (e.g., family/group travel documentation).
Fiduciaries are responsible for obtaining parental consent where required.

15. Data Breach Notification

In the event of a personal data breach:

• DocScan.in will notify the User (Data Fiduciary) without undue delay.
• Users must then notify affected Data Principals as required by law.

16. Grievance Redressal

For privacy-related issues, users may contact:

Grievance Officer:
Name: [Appoint Officer Name]
Email: support@docscan.in
Response Time: Within 7 working days

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.
Continued use of the Platform after updates signifies acceptance of the revised policy.

18. Governing Law & Jurisdiction

This Policy is governed by laws of India.
Any disputes arising shall be subject exclusively to the jurisdiction of the courts in Ahmedabad, Gujarat.