Aadhaar KYC & e-Sign Consent Notice

When you click a Legally Rent verification link, you are asked to verify your identity through DigiLocker (a Government of India platform) and, later, to sign the rental agreement with an Aadhaar OTP e-sign. This notice explains — before you consent — exactly what that involves. The data fiduciary is Chaosology Technologies Private Limited.

Why we ask

To create a legally reliable rental agreement: the parties’ identities are verified against Aadhaar, and the agreement is electronically signed with Aadhaar e-sign (a legally recognised signature under the IT Act, applied through a CCA-licensed provider). Verification is required for this service — if you prefer not to verify with Aadhaar, don’t proceed, and the agreement simply won’t be executed through Legally Rent.

What we receive when you verify

Your verification result and KYC record from DigiLocker: name, date of birth, address and photo as per Aadhaar, and your Aadhaar number.
You authenticate directly with DigiLocker/UIDAI — your Aadhaar OTP never touches our systems.

How we protect it

Your Aadhaar number is stored encrypted (AES-256-GCM); day-to-day systems and staff see only the masked last 4 digits.
The rental agreement itself prints only XXXX XXXX last-4 — never the full number.
The full number is decrypted only at the moment it is needed to initiate your Aadhaar e-sign with the licensed e-sign provider, and every decryption is audit-logged.

Who it is shared with

Only the licensed verification and e-sign providers that perform the KYC and signature (currently DigiLocker-based KYC and a CCA-licensed e-sign provider), under contract, for this purpose alone. We never sell identity data, and we don’t use it for marketing.

How long we keep it

For the life of your account and as long as the executed agreement requires (an agreement is a legal record both parties may need for years). You can request erasure of your data — see your rights below — subject to records we are legally required to retain.

Your rights

Ask what we hold, correct it, or request erasure (DPDP Act 2023) — write to [email protected].
Withdraw consent before verification completes by simply not proceeding; after execution, withdrawal doesn’t undo a signed agreement, but stops any further use.
Escalate unresolved grievances — see Grievance Redressal.