Law Enforcement and Government Requests

Summary

This summary is here to help you. It does not replace the full text below.

• We disclose user data to authorities only when the law requires it and the request is valid, written, specific and from a competent authority.
• Foreign authorities must normally use a mutual legal assistance treaty or an equivalent formal route.
• In a genuine emergency involving an imminent risk of death or serious harm, we may disclose limited data without waiting for formal process.
• We tell affected users about a request unless the law or a court order forbids it.
• Hotel guest registers are kept by the hotel under its own legal duty. Authorities seeking a hotel's guest register should go to the hotel.
• We push back on requests that are too broad, and we never build backdoors into Stayantra.
• Requests go to info@stayantra.com.

1. Who this page is for

This page explains how Stayantra handles requests for user data from police, courts, regulators and other government authorities. It is for authorities who want to make a request, and for users who want to know how we protect their data when we receive one.

Requests are handled by the Stayantra company that holds the data: [Pending: Nepal Stayantra company legal name] for hotels in Nepal and users who live in Nepal, and [Pending: UK company legal name] for everyone else. Some data is held jointly by both. See our Privacy Policy.

2. Our principles

• Legality. We disclose data only where the law requires or clearly allows it.
• Necessity. We disclose the minimum data needed to answer a valid request.
• Transparency. We tell affected users unless we are legally prevented from doing so.
• No backdoors. We do not build, and will not build, hidden access to Stayantra systems or data for any government, and we do not weaken our security or encryption for that purpose.

3. The legal basis for disclosure

Nepal. Under the Individual Privacy Act 2075 (2018), personal information may be disclosed without the person's consent only in the circumstances that Act allows, including to an official investigating an offence and to a court, in line with the Act's provisions on consent and on the disclosure of personal information (sections 12 and 26). We require the request to come from a competent official acting within their legal powers.

United Kingdom. We respond to valid legal process under UK law, such as a court order, a production order, or a request that meets the conditions of the UK GDPR and Data Protection Act 2018 for the prevention or detection of crime.

Other countries. We respond to legal process that is valid under the law that applies to the Stayantra company holding the data. Authorities outside Nepal and the United Kingdom should use the formal routes described in section 5.

In every case, data protection law continues to apply, and we assess each request before we disclose anything.

4. What a request must include

We require every request to:

• be in writing, on official letterhead or through an official channel, and sent from an official email address or by post;
• come from a competent authority with the legal power to make it;
• state the legal basis for the request;
• identify the specific account, booking or person concerned, for example an email address, phone number or booking reference;
• describe the specific data sought and the time period it covers;
• include the requesting officer's name, rank or position and contact details;
• say whether we are prohibited from telling the user, and on what legal basis.

We may ask for confirmation or further information before we act. We do not respond to informal requests, such as a phone call alone.

5. Requests from outside the country

We normally require foreign authorities to make requests through a mutual legal assistance treaty (MLAT) or another formal international cooperation route, so that a court or authority in the country where the data is held can confirm the request. Where an international agreement allows a foreign authority to make a request directly to us, we will consider it under that agreement and the law that applies to us.

6. How we respond

• We review every request for validity and scope.
• We narrow requests that are too broad. If a request asks for more data than it needs, or is unclear, we ask for it to be narrowed or clarified, and we may challenge it.
• We refuse invalid requests. If a request does not meet the requirements of this page or the law, we decline it and explain why where we can.
• We disclose only what is necessary and keep a record of every request and our response.

What we can provide depends on what we hold. Our Privacy Policy explains what data we keep and for how long. We do not have access to full card numbers, which are held by payment providers.

7. Emergencies

If an authority tells us there is an imminent risk of death or serious physical harm to a person, we may disclose limited data without waiting for formal legal process, where the law allows. The authority must explain the emergency and how the data will help prevent the harm. We disclose only what is needed to address the emergency and ask the authority to follow up with formal legal process.

8. Telling affected users

We tell users when an authority asks for their data, so they have a chance to seek legal advice or challenge the request, unless:

• the law or a court order prohibits us from telling them; or
• telling them would create a risk of death or serious harm, or put a child at risk.

If a prohibition ends, we tell the user then.

9. Hotel guest registers

In Nepal and many other countries, hotels have their own legal duty to keep a guest register and to report guest details to the police or immigration authorities. For example, hotels in Nepal record foreign guests' details in the immigration system. Hotels do this themselves; Stayantra does not submit guest details to authorities on a hotel's behalf.

For check-in records, the hotel decides how the data is used, and Stayantra processes it on the hotel's behalf. Authorities seeking a hotel's guest register or check-in records should contact the hotel directly. If an authority asks us for data we hold only on a hotel's behalf, we will normally refer the authority to the hotel and tell the hotel, unless the law prohibits this.

10. Preservation requests

We will preserve specific data for a limited period while an authority obtains formal legal process, if the authority sends us a written preservation request that meets the requirements in section 4. We will not disclose preserved data until we receive valid legal process. If none arrives within a reasonable time, normally 90 days, the data returns to its normal retention schedule.

11. Transparency reporting

We may publish statistics on the number and types of government requests we receive and how we responded, to the extent the law allows.

12. How to contact us

Send requests to info@stayantra.com, with the subject line "Law enforcement request". Postal requests can be sent to the registered office of the relevant Stayantra company: [Pending: Nepal registered office address] in Nepal, or [Pending: UK registered office address] in the United Kingdom.

This address is for authorities only. Users with questions about their own data should contact info@stayantra.com.

13. Changes to this page

We may update this page when the law or our practices change. The date at the top shows the current version.