Platform Privacy Policy

Version 1.0.0 — Engineering template; obtain qualified legal review before production use.

1. Scope

This policy describes how the platform processes personal data under India's Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, GDPR.

2. Roles

• Platform operator: data fiduciary for account, billing, and platform analytics data.
• Clubs: independent controllers/fiduciaries for member, enrollment, and coaching data they collect.

3. Data we process

Identity and contact details, enrollment applications, attendance, fee records, coach assessments, gallery tags, device metadata, and consent timestamps.

4. Infrastructure

Data may be stored or processed using Firebase (Google Cloud) and Neon PostgreSQL in regions selected for deployment. Cross-border transfers use appropriate contractual safeguards where required.

5. Children's data

Enrollment for minors requires verifiable parental consent. Clubs must follow POCSO and COPPA-aligned practices for athletes under 18.

6. Retention vs erasure

Member profiles may be anonymized upon verified erasure requests. Legal consent records, liability waivers, and financial obligation audit logs are retained for statutory limitation periods even after profile anonymization.

7. Grievance redressal (DPDPA)

Contact our Grievance Redressal Officer:

• Name: Grievance Redressal Officer
• Email: privacy@sports-club-platform.example

We will acknowledge complaints within 7 days and aim to resolve within 30 days.