The data controller responsible for your personal data is:

Housing and Urban Development Authority (HIMUDA), Government of Himachal Pradesh, Nigam Vihar, Shimla-171002, Himachal Pradesh, India.

We process personal data in our capacity as a public authority for the delivery of housing and urban development services, in compliance with applicable Indian law including the Digital Personal Data Protection Act, 2023 (DPDP Act) where applicable, and other government guidelines.

2. Data We Collect

We collect only the data necessary to provide our services and fulfil our legal and administrative functions. This may include:

• Account and identity: Name, email address, phone number, and (where required) verification details used to create and manage your citizen account on our portal.
• Application and allotment data: Information you submit in applications for schemes, allotments, e-draws, e-auctions, transfers (ownership, plot/flat, tenancy, lease deed), and related documents or proofs as required by the scheme.
• Payment and financial: Transaction references, payment status, and related records for fees, EMD, installments, or other dues processed through our systems or authorised payment gateways. We do not store your full card or bank credentials.
• Technical and usage: IP address, browser type, device information, and logs of access to our website and APIs (e.g. for security, audit, and troubleshooting), in line with our Activity Logs policy.
• Communications: Records of correspondence, grievances, or support requests you send to us.

We do not collect more data than is necessary for the stated purposes. Where consent is required, we will ask for it clearly and separately.

3. Purpose & Legal Basis

We use your data for the following purposes on the stated bases:

• Service delivery: To register you, process applications, conduct e-draws/e-auctions, manage allotments and transfers, and process payments — necessary for the performance of our public functions and, where relevant, for the performance of a contract with you.
• Legal and regulatory compliance: To comply with laws, rules, and government orders applicable to HIMUDA (e.g. retention, audit, disclosure to competent authorities).
• Security and integrity: To protect our systems and users (e.g. authentication, fraud prevention, audit logs) in line with our security and governance policies.
• Communication: To send you service-related notifications, OTPs, password reminders, and (where you have opted in) other relevant updates.
• Improvement and analytics: Aggregated or anonymised usage data may be used to improve our services; we do not use your personal data for marketing or profiling beyond what is necessary for the above.

4. How We Use Your Data

Your data is used only for the purposes set out in this policy. We do not sell your personal data. Access to your data is restricted to authorised personnel and systems that need it to perform their duties. We apply appropriate technical and organisational measures (including encryption, access controls, and audit logging) as described in our Security & Governance Policies.

5. Storage & Security

We store your data on secure infrastructure within India. We implement:

• Encryption in transit (TLS/HTTPS) and at rest where applicable.
• Strong authentication, password policies, and (where offered) passkeys/MFA.
• Access controls and activity logging so that access to personal data is traceable.
• Regular backups and disaster-recovery measures as per our Data Backup and Retention policies.

Despite these measures, no system can be guaranteed completely secure. If we become aware of a breach that is likely to affect your rights, we will take steps to mitigate harm and notify as required by law.

6. Data Sharing

We do not sell or rent your personal data. We may share your data only in the following circumstances:

• Government and competent authorities: When required by law, court order, or lawful demand from a government or regulatory body.
• Payment processors: With authorised payment gateways (e.g. Razorpay, banks) only to the extent necessary to process payments; such processors are bound by their own privacy and security obligations.
• Service providers: With trusted vendors who assist us (e.g. hosting, email delivery) under strict confidentiality and data-processing arrangements; they are not permitted to use your data for their own purposes.
• With your consent: Where we have obtained your clear consent for a specific disclosure.

We do not transfer your personal data outside India except where necessary for a specific service and in compliance with applicable law.

7. Cookies & Tracking

Our website may use cookies and similar technologies for:

• Strictly necessary: Session management, authentication, security (e.g. CSRF, rate limiting), and load balancing. These are essential for the site to function.
• Preference and functionality: Remembering your choices (e.g. language, display options) where we offer them.
• Analytics: We may use limited analytics to understand usage patterns and improve the site; where used, we aim to minimise identification of individuals.

We do not use third-party advertising or tracking for targeted ads on this portal. You can control cookies through your browser settings; disabling certain cookies may affect some features of the site.

8. Retention

We retain your personal data only for as long as necessary to fulfil the purposes in this policy and as required by law or government retention schedules. Our Retention & Archival Policy describes our approach to retention and archival. After the retention period, we securely delete or anonymise your data unless we are required to retain it for legal or audit purposes.

9. Your Rights

Subject to applicable law (including the DPDP Act and any exemptions for government functions), you may have the right to:

• Access: Request a summary of the personal data we hold about you and the purposes for which it is used.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure and withdrawal: Request deletion of your data or withdrawal of consent where processing is based on consent, to the extent permitted by law (e.g. we may be required to retain certain data for legal or audit reasons).
• Grievance: Raise a grievance with us; we will respond in accordance with our grievance redressal process and applicable timelines. You may also have the right to approach the relevant authority under the DPDP Act.

To exercise these rights, please contact us using the details in Section 13. We may need to verify your identity before processing your request. We will respond within the timeframes required by applicable law.

10. Children

Our services are intended for use by persons who are eligible to enter into contracts under Indian law. We do not knowingly collect personal data from children below the age of 18 without parental or guardian consent. If you believe we have inadvertently collected such data, please contact us and we will take steps to delete it.

11. Third-Party Links

Our website may contain links to other websites (e.g. other government portals, payment gateways, or information resources). This Privacy Policy does not apply to those sites. We are not responsible for their privacy practices. We encourage you to read the privacy policy of any third-party site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. The "Last updated" date at the top will be revised when we make material changes. We encourage you to review this page periodically. Continued use of our services after the publication of changes constitutes acceptance of the updated policy to the extent permitted by law. Where required by law, we will seek your consent for material changes that affect how we use your data.

13. Contact & Grievances

For any questions, requests related to your personal data, or to lodge a privacy-related grievance, please contact us:

• HIMUDA – Housing and Urban Development Authority, Himachal Pradesh
• Address: Nigam Vihar, Shimla-171002, Himachal Pradesh, India
• Email: himuda@hp.gov.in
• Phone: +91 177 2620115

You may also use our Contact Us or Grievance channels. We will endeavour to respond within the timelines prescribed under applicable policy or law.