Digital Vehicle Identity • Compliance • Assistance
PRIVACY POLICYDATA PROTECTIONINFORMATION SECURITYGOVERNMENT PILOT READINESS
Privacy, Data Protection, Information Security & Government Data-Integration Policy
Effective Date: 29 September 2026 | Version: 2.0
This Policy describes the privacy, data protection and information-security principles adopted for the VahanPass platform and related services. VahanPass is intended to provide a digital vehicle identity, compliance and assistance layer that can support vehicle owners, drivers, authorized organizations and, where formally approved, government departments and enforcement personnel.
This document is intentionally written to separate current platform principles from future/conditional government integrations. VahanPass will not represent itself as a Government of India or State Government service, and will not claim government approval, authorization or live government API access unless the relevant written authorization, agreement and technical access actually exist.
Legal status: This is a detailed policy draft for operational and government-pilot readiness. It must be finalized against the actual legal entity, technology architecture, contracts, data flows and applicable Indian law by qualified legal/privacy counsel before being relied upon as a final legal instrument.
Document Control
Item
Details
Policy Owner
VahanPass (Legal Entity Name)
Version
2.0
Effective Date
29 September 2026
Review Cycle
At least annually and whenever there is a material change in law, government agreement, architecture, data source or processing activity.
Privacy Contact
[Insert Data Protection / Privacy Contact Name]
Registered Office
[Insert Registered Office Address]
1. Scope & Applicability
This Policy applies to personal and vehicle-related information processed through VahanPass websites, mobile/web applications, QR-based vehicle identity services, verification interfaces, dashboards, administrative systems, support channels and assistance features.
Vehicle owners and registered users.
Drivers and authorized vehicle users.
Customers purchasing or activating a VahanPass QR identity.
Mechanics, roadside-assistance providers and service partners, where applicable.
Authorized government officers and department users in an approved pilot or deployment.
Employees, contractors and administrators who have authorized access to VahanPass systems.
Technology/service providers processing information on behalf of VahanPass under appropriate contractual controls.
2. Core Privacy & Data Protection Principles
Purpose LimitationCollect and use information for defined, legitimate and documented purposes.
Data MinimisationRequest only information reasonably required for the relevant service or authorized purpose.
TransparencyExplain what information is processed, why it is processed and how users can raise requests.
Security by DesignConsider security, privacy and access controls during product and architecture decisions.
Access ControlGive staff and officers only the access required for their approved role.
AccountabilityMaintain policies, records, logs and review processes appropriate to the service.
AccuracyWhere data is used for decisions or disclosures, appropriate processes will be used to maintain relevant accuracy and consistency.
Retention ControlDo not retain personal information indefinitely without a legitimate reason or applicable legal/contractual requirement.
3. Categories of Information We May Process
Category
Examples
Typical Source
Identity & Account
Name, mobile number, email, account ID, OTP/authentication records.
User or authorized organization.
Vehicle Identity
Registration number, vehicle type, QR identifier, activation status.
User, authorized source or VahanPass record.
Compliance
RC, insurance, PUCC, fitness, permit, driving-licence or other relevant status.
User-provided information or authorized external source, subject to access.
Document Files
Document images/files where upload is enabled.
User or authorized operator.
Verification Event
Date/time, QR/vehicle identifier, result, officer/user identifier and audit information.
VahanPass system.
Location
Approximate/precise location associated with an enabled feature or verification event.
User device/system, subject to feature and notice.
Safety/Assistance
Emergency event, roadside request, mechanic request and related status.
User/device/service provider.
Technical/Security
IP address, browser/device data, login events, security logs and diagnostic information.
System automatically.
Communication
Support tickets, complaints, messages and service interactions.
User/support channel.
4. Purpose of Processing
Purpose
Examples
Digital Vehicle Identity
Associate a controlled QR identifier with a vehicle record and provide authorized vehicle information.
Compliance Management
Show document/status information and provide expiry or maintenance reminders.
Verification
Return information based on VahanPass records and, when authorized, approved external/government data sources.
Government Enforcement Support
Support an approved field-verification workflow, audit trail, dashboard and compliance analytics.
Safety Features
Support emergency/safety alerts and assistance features selected or enabled by the user.
Service Delivery
QR activation, replacements, orders, payments, support and service requests.
Security
Detect unauthorized access, abuse, malicious activity and account compromise.
Legal/Regulatory
Comply with applicable legal obligations, lawful orders and contractual requirements.
5. Legal/Operational Basis & Consent
VahanPass will determine the appropriate lawful basis and notice/consent mechanism for each processing activity under the law applicable to that activity. Where consent is the applicable basis, the consent request will be presented clearly and separately from unrelated information and users will be given an appropriate method to withdraw consent.
Processing may also be required or permitted for other lawful purposes, including performance of a service requested by a user, compliance with legal obligations, protection of security, or an applicable government/contractual arrangement. The precise basis will be documented for relevant processing activities.
Important: A privacy policy is not itself a substitute for a proper consent flow. The VahanPass product must implement the appropriate notice, consent, withdrawal and rights mechanisms in the actual UI wherever required.
6. Government & Authorized Data Integration
VahanPass may propose or implement integration with government or authorized data sources only through the applicable approval, agreement, API onboarding and security requirements of the competent authority/provider.
6.1 Potential Data Sources
Vehicle registration/VAHAN-related data, where authorized.
Driving licence/Sarathi-related data, where authorized.
Insurance/PUCC/fitness/permit status, where the authorized source provides it and the scope permits it.
eChallan information, only where a valid integration arrangement and technical access exists.
Other government or authorized databases expressly approved for the relevant pilot/deployment.
6.2 Government Data Principles
VahanPass will request only approved parameters and documented purposes.
API credentials and certificates will be protected and access-controlled.
Government data will be treated according to the applicable data-sharing terms and retention requirements.
VahanPass will not scrape, bypass, reverse engineer or otherwise obtain restricted government data through unauthorized means.
VahanPass will not modify official records unless an authorized integration expressly permits the relevant action.
Data received from a government system will not be presented as independently verified by VahanPass beyond what the source and approved integration support.
If the authorized source is unavailable or stale, the user interface will show an appropriate status such as "Verification Pending" or "Unable to Fetch Current Data" rather than falsely showing a successful live verification.
Government approval status: This policy does not by itself create or imply government authorization. Any government pilot, API access or department deployment requires its own approval, agreement and technical onboarding.
7. Government Pilot Data Governance
Control Area
Proposed Governance
Purpose
Defined in the pilot proposal/agreement and limited to the approved operational use.
Data Fields
Documented in an API/data-parameter matrix with purpose and justification.
Access
Role-based access for authorized officers/administrators.
Audit
Relevant verification and administrative actions recorded for audit and evaluation.
Retention
Based on applicable law and the government/enterprise agreement.
Sharing
Restricted to approved departments/parties and approved purposes.
Security
Security architecture, vulnerability assessment, penetration testing and remediation appropriate to the approved deployment.
Exit
At pilot closure, data return/deletion/retention will follow the agreement and applicable law.
8. QR Code, Token & Vehicle Identity Security
QR codes should contain a controlled identifier/token/link rather than unnecessary personal information.
Protected information should be fetched server-side after validation and authorization.
QR activation should associate the identifier with the intended vehicle record.
Replacement should allow the old QR identifier to be revoked or marked inactive where appropriate.
Suspicious scan patterns, repeated failed access, abnormal requests and unauthorized attempts may be recorded for security analysis.
QR codes should not be described as "non-clonable"; the security objective is server-side validation and controlled access.
9. Information Security Framework
Identity & AccessMFA where appropriate, strong authentication, RBAC, least privilege and access reviews.
Network SecurityWAF/firewall controls, segmentation where appropriate, secure ingress/egress and monitoring.
EncryptionEncryption in transit and appropriate protection/encryption for sensitive information at rest.
LoggingSecurity-relevant events, administrative actions and operational events recorded according to documented requirements.
Backup/DRProtected backups, recovery procedures, restoration tests and disaster-recovery planning.
10. Security Architecture & Scalability Controls
For a larger deployment, VahanPass may use a layered architecture consisting of WAF, load balancing, stateless application servers, API gateway, queueing, caching where permitted, verification services, database infrastructure, backups and disaster recovery.
Capacity principle: registered vehicles and simultaneous requests are different workloads. Capacity, concurrency and API rate limits will be established through workload modelling and load testing rather than unsupported fixed server-count claims.
Illustrative Control Flow
User/Officer → WAF → Load Balancer → Application Layer → API Gateway → Verification Engine → Authorized Data Source → Result → Audit Log
11. Administrative & Officer Access
Each authorized administrator/officer should use an individual account where practical.
Shared administrator credentials should not be used for routine access.
Access should be granted according to role and approved responsibilities.
Privileged actions should be logged.
Inactive accounts should be disabled or reviewed.
Credentials, API keys and secrets should not be stored in source code or exposed in client-side code.
Where appropriate, MFA, session timeout, IP/network restrictions and device controls should be used.
12. Data Accuracy & Verification Status
VahanPass may display data received from users, internal records or authorized external sources. The interface will distinguish between:
VerifiedUsed only where the relevant verification process successfully completed and the source/record supports the result.
PendingUsed where a verification request is still being processed.
UnavailableUsed where a required source/service cannot currently be reached.
User ProvidedUsed where information has been supplied by the user and has not been independently verified.
Where a result may affect an individual or enforcement action, the relevant authority/officer should use the applicable official process and source records required by law or department procedure.
13. Data Retention & Deletion
VahanPass will define retention periods by data category and purpose. Retention may be influenced by applicable law, government agreements, audit requirements, security requirements, contractual obligations and dispute/incident preservation requirements.
Data Type
Retention Approach
Account Data
For the active service relationship and thereafter as required by law, contract, security or legitimate record-keeping requirements.
Verification Logs
According to the approved operational/audit requirement, pilot agreement and applicable law.
Uploaded Documents
Only as required for the service/purpose and applicable retention requirements.
Security Logs
According to security, legal and applicable CERT-In requirements.
Government Data
According to the applicable government data-sharing agreement, source requirements and law.
No indefinite retention: VahanPass will not use an open-ended retention period as a substitute for a documented retention schedule.
14. User Rights, Consent Withdrawal & Requests
Subject to the applicable law and the nature of the processing, VahanPass will provide appropriate mechanisms for users to:
Understand what personal data is processed and for what purpose.
Withdraw consent where consent is the applicable basis.
Request correction of inaccurate information where applicable.
Request erasure/deletion where applicable and where retention is not required by law or another valid requirement.
Raise a grievance regarding personal-data processing.
Use the designated communication channels for privacy/security requests.
Requests may be submitted to privacy@vahanpass.com. Reasonable identity verification may be required before responding to a request involving protected information.
15. Data Sharing & Third Parties
VahanPass may use technology providers, hosting providers, communication providers, payment providers, analytics/security providers and service/assistance partners where necessary to provide the service. Appropriate contractual, access-control and security measures should be used for relevant processors/service providers.
Third parties should receive only the information necessary for their defined function.
Government data should not be repurposed for unrelated commercial activity where the applicable authorization prohibits it.
Service providers should be subject to appropriate contractual confidentiality and security obligations.
Transfers or disclosures required by law will be handled through the applicable legal process.
16. Payment & Commercial Information
Where VahanPass accepts payments for QR stickers, subscriptions or services, payment information will be processed through the applicable payment mechanism/provider. VahanPass should avoid storing sensitive payment credentials when the payment provider can securely process them directly.
17. Cookies, Sessions & Device Information
VahanPass may use essential cookies, sessions, local storage and similar technologies for authentication, security, preferences and service functionality. Device/browser information and technical logs may be collected for security, diagnostics and reliability. Any non-essential tracking introduced in the future should be covered by an appropriate notice and consent mechanism where required.
18. Location Data
Location data will be used only for features that require it, such as an authorized field-verification record, roadside assistance, nearby-service discovery or a safety feature. The actual product should request only the level of location precision needed for the selected feature and should clearly communicate the purpose to the user.
Important: VahanPass should not describe continuous location tracking as necessary unless the actual feature genuinely requires it and the applicable notice/permission has been implemented.
19. Safety & Emergency Features
Where VahanPass provides a safety-monitoring or emergency-alert feature, the feature may process technical events such as sound/impact indicators, device state, time and vehicle/user association as required by the implementation.
Safety detection should be presented as an assistance feature, not as a guaranteed accident-detection system.
Users should be able to understand when the feature is active.
False positives and missed detections are possible in sensor/AI-based systems.
Emergency notifications should identify the limitations of automated detection where appropriate.
20. Security Incident & Personal Data Breach Response
VahanPass will maintain an incident-response process proportionate to the system and applicable requirements:
Detect: Identify suspicious activity or a potential incident.
Alert: Notify the responsible security/operations personnel.
Assess: Determine affected systems, information and severity.
Contain: Restrict compromised accounts, systems, tokens or access paths.
Investigate: Preserve relevant logs and evidence.
Mitigate: Remove the cause and address vulnerabilities.
Recover: Restore services and verify system integrity.
Notify: Make required notifications to authorities/affected individuals/contractual stakeholders as applicable.
Review: Perform a post-incident review and implement corrective actions.
Security principle: An incident will not be hidden merely because disclosure is inconvenient. Reporting and notification will follow the requirements applicable to the incident, law and government/enterprise agreement.
21. Business Continuity, Backup & Disaster Recovery
Critical data should be backed up according to a documented schedule.
Backups should have appropriate access controls and protection against unauthorized modification.
Recovery procedures should be documented and periodically tested.
Recovery objectives should be defined based on service criticality and approved SLA rather than invented as fixed guarantees.
Government pilot deployments may require additional recovery, availability or reporting requirements.
22. Vulnerability Management & Security Testing
Before a government/enterprise production deployment, VahanPass should maintain a security assurance process that may include:
Architecture ReviewReview trust boundaries, data flows and privileged paths.
Threat ModellingIdentify abuse cases and security risks.
Secure Code ReviewReview authentication, authorization, input handling and secrets.
Vulnerability AssessmentIdentify known infrastructure/application weaknesses.
RemediationTrack, prioritize and resolve findings.
Re-testConfirm important findings have been addressed.
Security ReportMaintain appropriate evidence for the relevant customer/government review.
23. Government Pilot Security Documentation
For a government pilot, VahanPass may provide a security pack containing:
System architecture and data-flow diagram.
API/data-parameter matrix.
Authentication and authorization model.
Encryption and key/secret management approach.
Network/WAF/security controls.
Logging and audit strategy.
Backup and disaster-recovery approach.
Incident-response plan and escalation contacts.
Vulnerability assessment / VAPT evidence where required.
Privacy policy, data retention schedule and user notice.
Third-party/vendor security controls where applicable.
Pilot SOP, officer training and access-management process.
24. Government Pilot Governance
Area
Proposed Pilot Control
Pilot Scope
Defined geography, department, vehicle population, duration and features.
Authorized Users
Named roles/accounts with controlled permissions.
Data Sources
Only data sources expressly approved for the pilot.
KPIs
Verification time, successful scans, system availability, data accuracy, officer usage and operational outcomes as agreed.
Support
Defined technical and operational contacts and escalation procedure.
Incident Reporting
Incident notification and escalation according to the pilot agreement and applicable requirements.
Data Exit
Return/deletion/retention at pilot closure according to the agreement and law.
Commercial Deployment
No assumption of long-term deployment solely from a pilot; any production expansion requires the applicable approval/procurement/contractual route.
25. Government API Failure & Data Availability
Because VahanPass may depend on external/authorized systems, an unavailable external source must not result in a misleading verification.
Situation
VahanPass Response
API Available
Process the approved request and show the permitted result.
API Timeout
Retry according to approved limits; show pending/unavailable status if not completed.
API Rate Limit
Respect provider limits and queue/retry within the approved rules.
API Down
Show "Verification temporarily unavailable" or equivalent.
Unexpected Data
Do not silently transform it into a positive verification; log and investigate as appropriate.
26. Children & Vulnerable Persons
VahanPass is not intentionally designed to independently collect children's personal data. Where a service involves children or other situations requiring additional legal safeguards, the applicable legal requirements and authorization mechanisms will be followed.
27. Employee, Contractor & Vendor Confidentiality
Personnel with access to VahanPass information should be subject to appropriate confidentiality, access-control and security obligations. Access should be removed or reviewed when a person changes role or leaves the organization.
28. Data Processing by Service Providers
Where VahanPass uses a service provider to process personal data on its behalf, the relationship should be documented through an appropriate contract or terms addressing confidentiality, security, permitted processing, incident notification, assistance and deletion/return obligations as appropriate.
29. Grievance Management
Privacy and data-related complaints may be submitted through the designated grievance channel. VahanPass will maintain a process for recording the complaint, verifying relevant information, assigning responsibility, investigating, responding and documenting closure or escalation.
This Policy will be reviewed when there is a material change in the platform architecture, data sources, government agreement, security model, legal requirements or processing purposes. Material changes should be documented through version control and, where required, communicated to affected users or stakeholders.
32. Government Submission Checklist
Legal EntityCompany/LLP/proprietorship details
Data FlowWhat data enters, moves and leaves
SecurityArchitecture, access, encryption, logs
API MatrixParameter + purpose + justification
Final Privacy Policy and User Notice.
Terms & Conditions.
Consent and withdrawal workflow.
Data retention schedule.
Grievance procedure.
Security architecture.
Incident-response plan.
Backup and disaster-recovery plan.
VAPT/security-testing evidence when required.
Government pilot proposal and scope.
Government/API authorization documents when approved.
Officer/user access-control SOP.
33. Important Legal Disclaimer
This document is a detailed operational and legal-policy draft. It is not a legal opinion and does not itself establish government authorization, API access, certification, procurement approval or regulatory compliance. Final wording must be reviewed against the actual VahanPass entity, technical implementation, contracts, data flows, government requirements and applicable Indian law before production or government submission.