Legal & Compliance
India's Digital Personal Data Protection Act, 2023 sets the rules for how businesses collect, use, and protect personal data. Here's exactly how VahanTag meets those rules.
Last updated: 16 October 2026
India's first comprehensive data protection law
The Digital Personal Data Protection Act, 2023 (DPDPA) is India's primary law governing how organisations collect, process, and store personal data of Indian citizens. Enacted on 11 August 2023, it introduces rights for Data Principals (the individuals whose data is processed) and obligations for Data Fiduciaries (entities like VahanTag that determine the purpose and means of processing).
VahanTag, operated by VahanTag Technologies (Sole Proprietorship), is a Data Fiduciary under the Act. We have designed our product and processes to be compliant with the DPDPA and its accompanying Digital Personal Data Protection Rules, 2025.
Consent-first
We collect data only after obtaining free, informed, specific, and unambiguous consent.
Purpose limitation
Every piece of data is collected for a stated purpose and used only for that purpose.
Data minimisation
We collect only what is strictly necessary. Scanners remain completely anonymous.
Every field has a declared purpose — nothing more is collected
| Data | Purpose | Legal basis |
|---|---|---|
| Mobile number | OTP authentication; WhatsApp/SMS alerts on QR scan | Consent |
| Full name & delivery address | Order fulfilment and shipping; shared with courier and Razorpay only | Contract |
| Vehicle registration & owner name | Link QR sticker to vehicle for alert routing | Consent |
| Emergency contact names & mobiles (up to 3) | Notify designated contacts only on Emergency SOS trigger | Consent |
| Order & payment records | Transaction records; retained 7 years under GST Act | Legal obligation |
| Data | Purpose | Notes |
|---|---|---|
| GPS location | Context for the alert sent to the vehicle owner | Only if permission is granted by the scanner |
| Issue category | Included in the alert (e.g. "Lights left on") | Selected from a fixed list — no free text identity |
| Session identifier & timestamp | Fraud prevention and audit log | Randomly generated; not linked to scanner identity |
| Mobile number (SOS only) | Displayed on the alert page for emergency contacts to call the scanner | Optional opt-in during Emergency SOS; visible for 2 hours, then permanently removed |
Scanning is completely anonymous by default. VahanTag does not collect the scanner's name or any personally identifiable information. During an Emergency SOS, a scanner may optionally share their mobile number through an explicit opt-in — this number is displayed on the alert page for 2 hours and then permanently removed. The vehicle owner's phone number is also never revealed to the scanner.
Four specific consent gates, each built into the user flow
The DPDPA requires consent to be free, informed, specific, and unambiguous. We don't bury consent in a footer or a pre-ticked box. Each consent moment is designed as a deliberate gate in the user journey.
Before an OTP is sent, the sign-in screen displays:
"By continuing you agree to our Terms & Privacy Policy."
The user actively taps "Send OTP" to proceed. No OTP is sent without this action, making it an unambiguous opt-in. The data collected — mobile number — is directly disclosed with its purpose (authentication and alert delivery).
The checkout form collects name, mobile, and address. Each field includes an inline hint stating its purpose (e.g., "For order updates on WhatsApp/SMS"). The user must actively fill and submit the form. The review screen presents all data before the payment is initiated, giving a second opportunity to review and withdraw.
Processing basis: contract performance (fulfilment of the order). Order and payment records are retained for 7 years as required under the GST Act — a legal obligation, not a business choice.
Activation involves third-party data (emergency contacts). The DPDPA treats these individuals as Data Principals with their own rights. Our activation flow handles this in two layers:
Per-contact inline confirmation
Each emergency contact card displays: "By adding this contact, you confirm they have been informed and agreed to receive emergency alerts from VahanTag." This text is shown before the contact is saved, at the point where the user is entering their details.
Activation confirmation checkbox
The final confirmation screen requires a mandatory checkbox: "I confirm that… each emergency contact has been informed and has agreed to receive emergency alerts from VahanTag." The Activate button is disabled until this box is checked. A timestamped record of this confirmation is stored with the activation event.
Public contact — extra explicit consent
Marking a contact as "public" (visible to anonymous scanners during an Emergency SOS) requires an additional toggle with its own consent text: "By enabling this, you also confirm they have agreed that their name and mobile number may be visible to anyone who triggers an Emergency SOS." This extra disclosure is tracked separately in our activation record.
Emergency contacts who wish to remove their data can do so at any time by emailing support@vahantag.me.
During an Emergency SOS, the scanner sees an opt-in checkbox: "Share my number with emergency contacts". If checked, a mobile number input appears with the text: "Visible on the alert page for 2 hours, then permanently removed." The scanner must actively check the box and enter their number — no pre-ticking, no default opt-in. The SOS works fully without sharing a number.
Legal basis: Section 6 consent — free, specific, informed, unconditional, and unambiguous. The scanner is informed of the 2-hour visibility window and that the number cannot be recalled after submission.
Under the DPDP Act, 2023 — Section 11 to 14
Right to Access
Request a summary of the personal data VahanTag holds about you, along with information on how it has been processed.
Right to Correction
Request correction of inaccurate or incomplete personal data. You can update emergency contacts and primary contact directly in the app.
Right to Erasure
Request deletion of your personal data. Account data is deleted within 90 days. Order records are retained for 7 years as required by the GST Act.
Right to Withdraw Consent
Withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing already completed.
Right to Nominate
Nominate another person to exercise your data rights on your behalf in the event of death or incapacity.
Right to Grievance Redressal
File a complaint with VahanTag's Grievance Officer. We respond within 24 hours and resolve within 15 days.
How to exercise your rights
Email support@vahantag.me with the subject line "Data Principal Rights Request". State your request (access, correction, erasure, or withdrawal) and we will respond within 30 days.
Email Us →Technical and organisational measures
All data stored in India
All personal data is stored exclusively on servers and cloud infrastructure located within India. VahanTag does not transfer or store any personal data outside the territory of India. This is in line with the data localisation intent of the DPDPA framework.
We share data only where necessary to operate the service
Under the DPDPA, VahanTag is the Data Fiduciary. The following entities act as Data Processors on our behalf and receive personal data only to the extent required to perform their function. We do not sell, rent, or share data for marketing or advertising.
Razorpay — Payment Gateway
Receives name, mobile, and payment details to process transactions. PCI-DSS certified. Card/UPI details never stored by VahanTag.
WhatsApp / SMS Gateway — Messaging
Receives mobile numbers to deliver OTPs, scan alerts, and SOS notifications.
Shipping / Courier Partners
Receive name, address, mobile, and order ID for physical delivery of tags.
Google Analytics — Web Analytics
Receives anonymised browsing data (pages visited, device type, approximate region). Only activated after cookie consent is accepted.
In accordance with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
If you have a complaint about how your personal data has been collected, stored, or used by VahanTag, you may contact our designated Grievance Officer directly. All complaints are acknowledged within 24 hours and resolved within 15 days.
Contact the Grievance Officer
Name: Atish Amte
Email: atish@vahantag.me
Phone: +91-9156136155
Address: A-505, Silver Coin, Lane 30/31, Ganesh Nagar, Dhayari, Pune — 411041, Maharashtra, India
Response: within 24 hours · Resolution: within 15 days
If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India once it is constituted, as provided under the DPDPA.
Quick answers on DPDP compliance at VahanTag
Yes. VahanTag is built from the ground up to comply with India's Digital Personal Data Protection Act, 2023 and the DPDPA Rules, 2025. We collect only the data needed to deliver our service, obtain explicit consent at every collection point, store all data domestically within India, and provide a clear process for Data Principals to exercise their rights.
Scanning is completely anonymous by default. We do not collect the scanner's name, phone number, or any PII. During an Emergency SOS, a scanner may optionally share their mobile number via an explicit opt-in, which is displayed on the alert page for 2 hours and then permanently removed. The only other data optionally collected is GPS location (only if the scanner grants permission), the issue category they select, a randomly generated session ID (not linked to identity), and a timestamp.
The DPDPA places the consent obligation on the person submitting third-party data. VahanTag's activation flow requires: (1) inline confirmation text on each contact card, and (2) a mandatory checkbox at the confirmation screen affirming each contact has been informed and agreed. A timestamped record is stored. Emergency contacts can request removal at any time via support@vahantag.me.
No. All personal data is stored exclusively on servers and cloud infrastructure located within India. We do not transfer or store any personal data outside the territory of India.
Email support@vahantag.me with the subject line "Data Principal Rights Request". State whether you want erasure, withdrawal, or both. Account data is deleted within 90 days. Order records (required by the GST Act) are retained for 7 years.
No. VahanTag does not sell, rent, or trade personal data to any third party for marketing or any other commercial purpose. Data is shared only with processors that are strictly necessary to operate the service (payment gateway, SMS/WhatsApp gateway, courier partners, analytics).
VahanTag's Grievance Officer is Atish Amte. Email atish@vahantag.me or call +91-9156136155. We acknowledge within 24 hours and resolve within 15 days. If unsatisfied, you may escalate to the Data Protection Board of India once constituted.