Frequently Asked Questions

Whichever country your property is in, every guest document on OurGate is handled the same secure way:

• Explicit consent: Guests review and accept clear terms before any document upload — no ID is collected without an affirmative action.
• Purpose limitation: ID documents are collected only to verify a specific booking and are never used for marketing or shared with third parties.
• Encrypted, access-controlled storage: Documents are stored in a private, access-controlled bucket and served only via short-lived, single-use links to authorized hosts.
• Right to deletion: Guests can request their uploaded documents be deleted at any time, in line with GDPR, CCPA, and DPDP data-subject rights.
• Watermarked, traceable viewing: Every ID a manager opens is overlaid with a live watermark of their name, company, and timestamp — deterrence and traceability against casual sharing.
• Time-boxed document access: A guest's ID stays viewable while their stay is active. After that, reopening it requires an explicit, time-limited approval — not indefinite standing access.
• Logged document access: Every time an ID document is viewed, it's logged — who, when, from where — giving an independent record of access for oversight.
• Direct-to-vault upload: Guest ID photos go straight from their phone to encrypted storage — the raw file never passes through or sits on a host's own systems.

Mishandling guest ID documents carries real regulatory weight almost everywhere you operate, not just reputational risk. Under the EU/UK GDPR, fines for failing to secure personal data can reach €20 million or 4% of global annual revenue, whichever is higher. California's CCPA allows penalties per violation, and India's Digital Personal Data Protection Act, 2023 sets penalties up to ₹250 crorefor failing to take “reasonable security safeguards.” The UK and UAE carry their own real penalty regimes too — see the country-specific sections below. Every one of these frameworks applies to any business handling personal data — hotels and homestays included — which is exactly why the guest ID documents collected at check-in need to be treated with this level of care, wherever your property is.

It's a standing legal requirement, not a UK-specific OurGate preference. Under the Immigration (Hotel Records) Order 1972 (made under the Immigration Act 1971), every hotel, guest house, and similar establishment must keep a written record of the full name and nationality of every guest aged 16 or over. For guests who aren't British, Irish, or Commonwealth citizens, the property must additionally record the guest's passport number and place of issue, and their next destination after departure. The record must be kept for at least 12 months and be available for inspection by police or an authorised officer on request.

Yes, and the same reconciliation applies here as it does in India. UK GDPR (retained EU GDPR as it applies domestically, enforced by the Information Commissioner's Office under the Data Protection Act 2018) requires data minimisation and gives guests a right to erasure. Read alone, that looks like it conflicts with a duty to keep a 12-month guest register. It doesn't, in practice: UK GDPR's right to erasure does not apply where processing (including continued retention) is necessary for compliance with a legal obligation the controller is subject to — which is exactly the situation the Hotel Records Order creates. OurGate is built to satisfy both at once, not to pick one over the other.

By splitting the roles, using the same terms UK GDPR itself uses. As the party legally obligated under the Hotel Records Order to collect and be able to produce guest identity information, you (the Host) are the data controller. OurGate acts as your data processor: we hold the document securely on your behalf, restrict standing access, log every view, and retain it for the minimum 12-month period the Order requires (or longer only if another UK legal obligation genuinely requires it), and nothing longer by default. You remain fully compliant because the record still exists and can still be produced to police on request; you just don't hold an unrestricted copy sitting in your own systems indefinitely.

Both sides carry real, separately enforceable penalties.

It's a legal requirement, not a hotel preference. Indian police acts and state tourism regulations require every hotel/homestay to record a Guest Registration Card with an identity document for each guest, and to be able to produce that record to police or state authorities on request. Failing to keep or produce these records can expose the property to penalties under the Bharatiya Nyaya Sanhita (BNS), Sections 206 and 210 (omission to produce a document or give information to a public servant when legally bound to do so). For foreign nationals, the property must additionally file a C-Form with the local FRRO/police within 24 hours of arrival, under the Foreigners Act.

Yes. The Digital Personal Data Protection Act, 2023 (DPDPA) gives you rights over your personal data, including the right to request its erasure, and requires anyone holding your data to collect and retain only what's necessary. Read on its own, that looks like it conflicts with a police-act rule that says "retain guest ID records." It doesn't, in practice: the DPDPA itself recognizes that data held to meet another legal obligation is exempt from on-demand erasure until that obligation is satisfied (Section 8 and the Act's exemptions for compliance with law). OurGate is built to satisfy both laws at the same time, not to pick one over the other.

By splitting the roles. Under the DPDPA, the hotel is the Data Fiduciary (the party legally obligated to collect your ID and able to answer to police or regulators for it). OurGate acts as the Data Processorand custodian: we hold the document securely on the hotel's behalf, for exactly as long as applicable Indian hospitality and police regulations require, and nothing longer. The hotel remains fully compliant with its retention duty because the record still exists and can still be produced, they just don't hold an unrestricted copy sitting in their own systems indefinitely.

These aren't abstract rules. Both sides carry real, separately enforceable penalties, and a hotel can be exposed on both at once if guest records aren't handled correctly.

For anyone who needs the exact citations rather than the plain-language summary above:

• Retention obligation: State police acts, state tourism/lodging-house regulations, and, for foreign nationals, the Foreigners Act, 1946 (C-Form filing within 24 hours of arrival). Non-production of required records to a public servant can attract liability under Bharatiya Nyaya Sanhita (BNS) Sections 206 and 210 (successors to IPC Section 176).
• Data protection obligation: Digital Personal Data Protection Act, 2023, including the data principal's right to erasure, the data fiduciary's duty of purpose limitation and storage limitation, and the Act's recognition that retention required to comply with another law is not subject to on-demand erasure until that obligation lapses. Read the official Act (PDF, meity.gov.in).
• How OurGate reconciles the two: by acting as Data Processor/custodian on the hotel's behalf, restricting standing access to the retention window required by law, and actioning deletion requests once no active legal retention requirement remains, as described above and in our Privacy Policy and Terms & Conditions.

The GDPR governs how you and OurGate handle guest personal data. As the party that collects the guest's booking and identity information, you (the Host) are typically the data controller, and OurGate acts as a data processor on your behalf, handling storage, access control, and retention of the identity document. Guests have the right to access, correct, port, restrict, or request erasure of their data, and to object to processing based on legitimate interests — see our Privacy Policy for the full list. Hospitality guest-registration rules also vary by EU member state (for example, many countries still require a signed arrival form and, for some, an ID or passport copy for non-nationals), so there is no single EU-wide citation here the way there is for India, the UK, or the UAE — check your local tourism/police registration requirement for exactly how long guest records must be kept in your country, and treat that as the retention floor OurGate should honour for your property.

There's no single federal law requiring it — hotel guest-registration duties in the US come from state law, and requirements vary by state. Real examples: New York General Business Law, Article 12, requires the owner, lessee, proprietor, or manager of any hotel, motel, boarding house, or lodging house to keep a register of guests. California similarly requires hotel operators to keep a register available for inspection by peace officers on request, and restricts disclosure of those records to guests' own requests, a subpoena/warrant/court order, or a California peace officer. Many other states carry comparable innkeeper/lodging-house statutes, often dating back a century or more; check your own state's hotel or transient lodging statute for the specifics that apply to your property.

It depends on your state, and this is the fastest-changing area of US privacy law. If you operate in California, the CCPA (as amended by the CPRA) gives California-resident guests the right to know what personal information is collected about them, request deletion, request correction, and opt out of the sale or sharing of their personal information. OurGate does not sell or share guest personal information, so no "Do Not Sell/Share" mechanism is required on our end. As of 2026, over twenty other states have passed their own comprehensive privacy laws with similar rights — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and more recently Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, and others — so if your property is outside California, check whether your state has one of these laws, since it likely grants your guests a similar deletion/correction right. As with India, DPDPA, and the UK, deletion rights under these laws are generally understood not to override a genuine state-law obligation to retain a guest record, but the exact language and case law varies by state, so treat this as the general pattern rather than a guarantee for every state.

The same way as elsewhere. You (the Host) collect the guest's identity information because your state's hotel/lodging statute requires it, and you remain the "business" (CCPA/CPRA terminology) or "controller" (the term most other state laws use) responsible for that data. OurGate acts as your service provider under CCPA/CPRA (or processorunder most other state laws): we hold the document securely, restrict and log access, retain it only for the period your state's statute requires, and action a guest's deletion request once no active state-law retention requirement remains.

Penalties differ sharply between the hospitality-registration side and the privacy-law side, and by state.

It's a strict, security-linked legal requirement, not a UAE-specific OurGate preference, and it's tied directly to police and immigration reporting rather than just hospitality record-keeping. The exact mechanism differs by emirate. In Dubai, every guest checking into a hotel or a Department of Economy and Tourism (DET, formerly DTCM)-licensed holiday home must be registered, with passport or Emirates ID details submitted through the DET-approved electronic platform, which is linked to Dubai Police and Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) systems, typically within hours of check-in. Abu Dhabi and other emirates run comparable guest-registration requirements through their own tourism and police authorities, with their own portals and timelines, so a multi-emirate operator should confirm the specific requirement for each property's emirate rather than assuming Dubai's process applies everywhere.

Yes, in the same shape as elsewhere. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), in force since January 2022 and detailed further by Cabinet Decision No. 33 of 2024 (its executive regulation), gives individuals rights including access, correction, erasure, restriction, portability, and objection to processing, and requires controllers to collect and retain only what's necessary. Read alone, that looks like it conflicts with a police-linked duty to register and retain guest identity data. It doesn't, in practice: the PDPL's right to erasure does not apply where a legal obligation (such as a guest-registration or security-reporting requirement) requires the data to be kept, and the Act separately recognises exceptions for judicial, security, and public interest purposes. OurGate is built to satisfy both at once.

By splitting the roles, using the PDPL's own terms. As the party legally obligated to register guests with the relevant emirate's tourism and police authority, you (the Host) are the Controller. OurGate acts as your Processor: we hold the identity document securely on your behalf, restrict standing access, log every view, and retain it for the period your emirate's registration requirement (and any related PDPL retention basis) requires, and nothing longer by default. You remain fully compliant because the record still exists and can still be produced or re-submitted through the relevant portal; you just don't hold an unrestricted copy in your own systems indefinitely.

Both sides carry real, separately enforceable penalties.

Contact us at urbanescape09@gmail.com or by phone at 9958780399. For formal data access, correction, deletion, or grievance requests under the GDPR (EU or UK), CCPA/CPRA or another US state privacy law, the UAE PDPL, or India's DPDPA, the same contact reaches our Data Protection Contact (and, for Indian users, our Grievance Officer under the DPDPA and applicable IT Rules).