Protected storage
Document numbers are encrypted and separately fingerprinted for active-duplicate checks. Passwords and raw document values are never placed in tickets, QR codes or analytics.
Limited display
Sales agents and marketing staff never receive full identity numbers. An authorized branch view reveals them only after a valid QR or manual ticket-code lookup.
Retention and requests
Identity ciphertext, fingerprint and last four are removed 90 days after a terminal trip. Use the published privacy contact channel for access, correction or destruction requests.