Privacy notice

The MHADA Rental Portal ("the portal", "we", "us") is operated by the Maharashtra Housing and Area Development Authority, a statutory authority constituted under the Maharashtra Housing and Area Development Act, 1976.

This privacy notice explains how we collect, use, share and safeguard your personal data when you use the portal.

Identity data — full name, date of birth, gender, Aadhaar number (masked after verification), PAN, photograph.

Contact data — mobile number, email address, residential address.

Financial data — household income declaration, bank account for rent collection or refunds, transaction history.

Property data (landlords) — ownership proof, property tax receipts, society NOC, property photographs.

Usage data — pages viewed, application status, payment history, grievance history.

Device data — IP address, browser type, operating system, approximate location (from IP).

To verify your identity and eligibility under MHADA rental schemes.

To match you with properties and landlords, and to process rental applications.

To generate and register rent agreements, collect and disburse rent and deposits.

To comply with obligations under the Aadhaar Act, the IT Act, the Registration Act, the Maharashtra Rent Control Act, the Prevention of Money Laundering Act, and income tax rules.

To communicate with you about your account, applications, payments, and policy changes.

To detect and prevent fraud, abuse and unauthorised access.

Aadhaar is used strictly for offline e-KYC or OTP-based authentication through UIDAI-authorised channels, with your explicit consent at the point of use.

We store a hash of your Aadhaar for de-duplication. The Aadhaar number itself is masked across all interfaces and is never displayed in full.

Aadhaar data is not used for profiling, advertising, or shared with any party other than MHADA and UIDAI.

With landlords or tenants you have a pending application or active agreement with — only after mutual consent is recorded.

With payment processors, banks and registrars to the extent required to complete rent, stamp duty and registration transactions.

With police and law-enforcement when a valid written request under law is received.

With auditors and statutory authorities when required by law.

We do not sell your personal data. We do not share it with advertising networks.

Account and profile data — for the life of the account, plus three years after the last activity.

Rent agreement data — for a minimum of eight years after the agreement ends, as required under the Registration Act.

Payment records — for eight years from the date of the transaction, as required by income tax rules.

Grievance records — for three years after closure.

After the applicable retention period, data is irreversibly anonymised or deleted.

All traffic is served over HTTPS (TLS 1.2 and above).

Data is encrypted at rest using industry-standard algorithms.

Access to production systems is restricted to named staff and logged.

Vulnerability scans and third-party security audits are conducted periodically.

Despite reasonable safeguards, no system is fully impregnable — please notify us immediately if you suspect your account is compromised.

You can access, correct or download a copy of your personal data from the profile section of your dashboard.

You can request erasure of your data, subject to the retention obligations described above.

You can withdraw consent for optional communications at any time.

You can raise a complaint with the grievance officer below, and separately with the Data Protection Board of India once it begins operations under the Digital Personal Data Protection Act, 2023.

We use a small number of cookies and browser local-storage entries strictly to keep you signed in, remember your language preference, and measure anonymised usage.

We do not use third-party advertising cookies or behavioural tracking scripts.

The portal is intended for adults (18+). We do not knowingly collect data from children. If you believe a minor has created an account, write to us and we will delete it.

We may update this notice. Material changes will be notified in the portal and by email 30 days before they take effect.

The version and last-updated date at the top of this page always reflect the current policy.

Name: Public Information and Grievance Officer, MHADA

Email: grievance@mhada.gov.in

Address: Griha Nirman Bhavan, Bandra (East), Mumbai 400 051

Acknowledgement of any privacy complaint is issued within 24 hours.