Privacy Policy

Version 1.1.1, Effective Date: 1st August 2025

Who We Are

FACILITI is operated by Faciliti Technologies Private Limited, having its registered office at 44, 2nd Floor, Regal Building, Connaught Place, New Delhi 110001. We provide a privacy-first facility operating system used by residential societies, campuses and enterprises to manage unified access, security operations, asset records and related services. FACILITI interoperates with the quickprism® identity layer for DigiLocker-based verification.

Scope

This Policy explains how we handle personal data on the FACILITI admin dashboard and mobile applications, our public website, and our support channels.

Roles under law

For each site that deploys FACILITI, the site operator (client) determines why and how personal data is processed and acts as the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP). FACILITI acts as a data processor/service provider and processes data on the client's documented instructions. For our corporate website, account, billing and vendor management, FACILITI is the data fiduciary/controller.

What we collect

Visitors and guests:

  • quickprism® alias or quickID (pseudonymous identifier),
  • Verification event status (for example, DigiLocker verified),
  • Visit metadata such as timestamp, site or branch, pass type and event outcome,
  • Device and network metadata are strictly for security and fraud prevention.

Residents or members (if enabled by the client):

  • Basic account profile provided by the client, access permissions, and visit history.

Security staff and supervisors:

  • Work account identifiers, attendance or roster events, checkpoint scans, incident actions and acknowledgements.

Client administrators:

  • Name, business contact details, role and permissions, activity audit trails.

Support and billing:

  • Support tickets, call, chat or email records, plan and invoice data.

Website telemetry

We do not run marketing cookies or trackers. On the dashboard, we use essential security cookies to verify that an authorised user is accessing the dashboard.

Important design choice

When quickprism is used, identity proofing occurs on the user's device or within Quickprism. FACILITI does not receive raw Aadhaar, PAN or similar identity documents. FACILITI receives an alias or verification result, along with event metadata, needed for security operations. Entities using FACILITI do not receive the user's private data for non-security purposes.

Why we process data

  • to provide verified access, pass issuance and accurate entry or exit logs,
  • to operate security alerts, blocklist checks and incident workflows,
  • to present operational dashboards, analytics and audit reports required by clients or law,
  • to provide support, troubleshooting, safety monitoring and service improvement,
  • to comply with legal obligations and enforce terms.

Legal grounds

Processing is based on one or more lawful grounds under applicable law, including client notices and consents, performance of a contract with the client, compliance with legal obligations and other legitimate purposes permitted by DPDP. Clients are responsible for presenting appropriate on-site notices and obtaining any consents.

Data minimisation and retention

By default, no raw personal identity data is stored on FACILITI servers. Access to personal data is secured using the quickID protocol. The following data remains available to the client within its FACILITI account for as long as the client uses FACILITI services: visit logs, incident records, audit trails, support records and billing data. When a client ceases using FACILITI, access to the account is revoked, and associated data is either deleted or irreversibly anonymised by our termination processes and applicable legal obligations.

Sharing and sub-processors

We do not sell personal data. We share data only with:

  • The client and its authorised personnel are to operate their sites,
  • Sub-processors bound by confidentiality and data-processing terms, used for hosting, security and service delivery,
  • Authorities, when required by law or to protect rights, security and safety.

Current sub-processors and regions

  • Amazon Web Services (AWS) India regions,
  • Microsoft Azure India regions,
  • De Nada Venture's servers are located in India.

Hosting and storage location

We use Amazon's AWS and Microsoft's Azure to process data on servers physically located within the jurisdiction of the Republic of India. De Nada Venture's private servers, used for specific transactions, are also located in India.

International transfers

No cross-border data transfers are performed.

Security

  • Encryption in transit and at rest, key management and access segregation,
  • Role-based access control and least-privilege by default,
  • Continuous logging, anomaly detection and incident response runbooks,
  • Regular vulnerability management and independent assessments by CERT-In empanelled auditors,
  • VAPT 2025 and SAR 2025 audit cycles.

Your rights

Subject to applicable law, data principals may request access, correction, updating, erasure, grievance redressal and nomination where available. The client handles some requests as the data fiduciary. We respond within statutory timelines and, where none are prescribed, within 30 days.

Client responsibilities

For each site where the client uses the services, the client acts as the data fiduciary and will (a) provide appropriate notices and consents to data principals; (b) determine lawful bases and retention; (c) configure role-based access; (d) respond to data principal requests and instruct FACILITI as needed; and (e) ensure accuracy, security and minimisation of any data the client inputs into the services.

Contact path

Data principals, such as visitors, residents, and personnel, should first contact the relevant site operator (the data fiduciary) for access, correction, or other rights. If a request concerns the FACILITI platform or remains unresolved, please get in touch with FACILITI at [email protected] for privacy and data rights, [email protected] for product issues, or [email protected] for security matters. Client administrators may use their assigned customer success channel for priority support.

Children

FACILITI is intended for managed premises. Where children's data may be involved (for example, school campuses), clients are responsible for obtaining required consents and notices. FACILITI processes such data only on the client's instructions.

Grievance officer or data protection officer

Mr. Varen Aggarwal

Email: [email protected]

Changes to this policy

We reserve the right to update this policy to reflect any changes in law, technology, or business practices. The effective date and version will be revised, and any material changes will be communicated on our website or via the admin console.

Contact

Faciliti Technologies Private Limited

44, 2nd Floor, Regal Building, Connaught Place, New Delhi 110001.

[email protected] | [email protected] | [email protected]

Last Updated: February 2026