Last Updated: 17 October 2026 • In Compliance with the Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025
1. Data Roles: Fiduciary vs Processor
Under the Digital Personal Data Protection Act, 2023 (DPDP Act):
- Data Fiduciary: The Resident Welfare Association (RWA) / Society Managing Committee is the Data Fiduciary. The RWA determines the purpose and means of collecting maintenance charges and lift usage.
- Data Processor: LiftLedger Technologies Private Limited is strictly a Data Processor processing telemetry solely on behalf of and under the documented instructions of the RWA.
2. Strict Zero Camera Footage Policy
LiftLedger enforces an absolute technological ban on image collection:
- Zero camera frames, video recordings, or facial recognition embeddings are ever stored to flash memory, cloud servers, or local storage.
- Edge sensors (such as Time-of-Flight or local microcontrollers) generate purely abstract integer numbers: person count, entry floor, and destination floor.
3. Individual Resident Consent (Section 6)
General Body approval is not a substitute for individual consent. Each flat resident is an independent Data Principal:
- Residents may withdraw consent for usage-based processing at any time via the Resident Portal.
- Consent withdrawal immediately triggers the society’s configured fallback billing model (e.g. Equal or Area-based allocation) for that flat, with zero disruption to physical elevator access.
4. CERT-In Directions 2022 Compliance
Pursuant to the Indian Computer Emergency Response Team (CERT-In) Directions:
- System access and security audit logs are maintained for a rolling period of 180 days within Indian jurisdiction.
- System clocks are synchronized with traceable Indian standard NTP servers (time.nplindia.org).
- Covered cybersecurity incidents are reported within six hours of awareness.