Legal Document Template · Status: Needs Final Lawyer Review
This document is a standardized B2B SaaS legal framework prepared for BaseraBook compliant with the Digital Personal Data Protection (DPDP) Act 2023 (India) and the General Data Protection Regulation (GDPR). It must be reviewed and customized by your designated legal counsel prior to commercial enforcement.
BaseraBook Privacy Policy
Effective Date: September 28, 2026 · Compliant with India DPDP Act 2023 & EU GDPR
1. Overview & Data Roles
BaseraBook respects your fundamental right to privacy. In operating our property management software, BaseraBook functions as:
- Data Fiduciary / Data Controller for registered property owners' account information, subscription records, and direct platform communications.
- Data Processor for resident (tenant) records, occupancy logs, and financial transaction notes uploaded into the workspace by PG Owners.
2. Information We Process
A. Property Owner Account Data
Full name, email address, property name, physical address, business contact phone, and authentication credentials.
B. Resident Information (Uploaded by Owner)
Resident name, mobile number, emergency contact, room and bed assignment, monthly rent, security deposit amount, joining date, and government ID type/number.
C. Financial & Payment Metadata
Transaction reference numbers, payment mode (UPI, Cash, Bank Transfer), timestamps, and gateway IDs (Razorpay Order ID, Stripe Customer ID). BaseraBook does not store complete debit/credit card numbers or CVVs.
3. Lawful Basis for Processing
We process your personal information under the following legal bases:
- Contractual Performance: Providing cloud property management, automated rent receipts, and subscription services.
- Legal Obligation: Retaining financial records, tax invoices, and dispute evidence pursuant to Indian and international tax statutes.
- Explicit Consent: Provided by you upon registration and managing optional cookie analytics.
4. Authorized Sub-processors
BaseraBook engages strictly vetted cloud infrastructure providers bound by contractual data protection agreements:
Supabase Inc.
Database hosting, row-level security, and authentication services.
Vercel Inc.
Global edge hosting, serverless computing, and CDN security.
Razorpay Software Pvt. Ltd.
Domestic INR payment gateway and recurring subscription management.
Stripe Inc.
International multi-currency payment processing and customer portal.
5. Your Data Protection Rights
Both Indian DPDP Act 2023 and GDPR guarantee you the following enforceable rights:
- Right to Data Portability: You may instantly export your complete property, resident, and financial records in standard JSON format via your dashboard settings or the
/api/user/exportendpoint. - Right to Correction: You can edit and rectify any inaccurate property, room, or resident details directly in real-time.
- Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal records via
/api/user/delete-account. Historical financial audit logs are retained strictly as required by applicable tax retention mandates.
6. Grievance Officer & Data Protection Officer (DPO)
In compliance with Section 10 of the India Digital Personal Data Protection Act 2023, BaseraBook has appointed a dedicated Grievance Officer and Data Protection Officer to address any privacy complaints or data access requests:
Designation: Data Protection & Grievance Redressal Officer
Entity: BaseraBook Technologies
Official Email: baserabook.team@gmail.com
Redressal SLA: All formal privacy inquiries are acknowledged within 24 hours and resolved within 7 business days.