Privacy Policy

1. Introduction and Scope

This Policy describes how the Company collects, uses, stores, processes, and discloses Personal Data of Users in connection with:

• (a)the Company's mobile application made available on app distribution platforms;
• (b)the Company's platform for management and operation of sports turfs, academies, matches, tournaments, and related activities; and
• (c)any offline interactions, registrations, or engagements with the Company through affiliated academies, turf partners, or events.

This Policy applies to all Users in accordance with this Policy and Applicable Law, including the Digital Personal Data Protection Act, 2023.

Where the User is a minor (i.e., below the age of eighteen (18) years), the Company processes such minor's personal data strictly on the basis of verifiable consent provided by the minor's parent or legal guardian through a one-time password (OTP)-based authentication mechanism.

By accessing or using the Platform or services, or by providing personal data, You (and where applicable, Your Guardian) agree to the collection and processing of personal data in accordance with this Policy.

If You do not agree with this Policy, please do not access or use the services.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed below:

“Applicable Law”

means all applicable laws, rules, and regulations in force in India, including the Digital Personal Data Protection Act, 2023 and rules made thereunder.

“Company”

means Maidan Play Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at H NO-39 BLOCK NO-23 F/F, OLD RAJENDRA NAGAR DELHI, Rajender Nagar, New Delhi- 110060, India (CIN: U93110DC2026PTC469981);

“Guardian”

means the parent or legal guardian of a Minor User;

“Guardian Consent”

means consent provided by a Guardian through an OTP-based verification mechanism or such other verifiable means as may be implemented by the Company.

“Minor”

means a User under 18 years of age;

“Partner”

means any third-party academy, coach, turf, or facility provider offering services through the Platform;

“Personal Data”

means any data about an individual who is identifiable by or in relation to such data, including but not limited to name, date of birth, contact details, address, and any other information provided to the Company.

“Platform”

means the website, mobile application, and related services operated by the Company;

“Player”

means a Minor or other individual enrolled in, or participating in, any Service, whether directly or through a Guardian;

“Processing”

means any operation or set of operations performed on Personal Data, including collection, storage, use, sharing, disclosure, or deletion.

“Public Content”

means any content, including but not limited to photographs, videos, match recordings, reels, performance statistics, leaderboards, and related information, that may be made publicly accessible through the Platform or Digital media, including but not limited, to Social Media.

“Sensitive Personal Data”

means such Personal Data which is of a sensitive nature, including but not limited to: (a) health-related information such as blood group, medical conditions, allergies, or any other information that may impact a User's physical well-being; (b) financial and payment-related information collected under Clause 3.10, to the extent retained by the Company; (c) Progress Reports and other restricted performance data referred to in Clause 3.4; and (d) biometric and camera-derived data referred to in Clause 3.15.

“Services”

means the sports-related services made available through the Platform, including training sessions, academy programmes, tournaments, workshops, events, and turf or facility bookings, whether provided by the Company or by a Partner;

“User”

means any individual who accesses, registers on, or interacts with the Platform or services, including Players, Guardians, coaches, and other participants.

3. Categories of Personal Data Collected

The Company collects the following categories of Personal Data in connection with the use of its Platform and services:

3.1 Player Information

The Company collects the following Personal Data relating to Players:

• (a)Full Name
• (b)Date of Birth
• (c)Gender
• (d)School Name
• (e)Residential Address
• (f)Email Address
• (g)Mobile number

This information is used to create and manage Player profiles, enable participation in sports activities, and facilitate communication and coordination.

3.2 Guardian Information

In the case of Players who are Minors, the Company collects the following Personal Data relating to the Guardian:

• (a)Full Name
• (b)Relationship with the Player
• (c)Contact Number
• (d)Email Address

This information is used for obtaining verifiable Guardian Consent, communication, and ensuring the safety and well-being of the Player.

3.3 Health and Safety Information

The Company collects the following health-related information:

• (a)Blood Group
• (b)Information relating to allergies or medical conditions

Such information is collected for safety purposes, including emergency response and appropriate care during sports activities.

Access to such Sensitive Personal Data is governed by Clause 6.6.

3.4 Performance and Activity Data

The Company may collect and generate data relating to a Player's participation in activities, including match participation details, performance statistics, scores and rankings, training and activity records, and participation in tournaments or leagues facilitated by the Company.

For Players enrolled in academy programmes, the Company may also generate periodic Progress Reports containing attendance records, skill assessments, coach observations, and recommended areas for improvement. Progress Reports are accessible only to the Player's Guardian, assigned coach(es), and authorised Company personnel, and shall not be shared with other partner academies or third parties without the Guardian's explicit consent, except where required for inter-academy programmes operated by the Company.

Match participation details, performance statistics, and rankings may be displayed publicly within the Platform, including leaderboards and tournament content, subject to applicable consent. Progress Reports and training records are treated as restricted information and are not publicly accessible, except where expressly consented to by the User and/or Guardian.

3.5 Media and Content Data

The Company may collect, create, or process:

• (a)Photographs
• (b)Videos of matches, training sessions, and events
• (c)Reels and edited media content
• (d)Team photographs and tournament-related content

Such data may be used for internal purposes as well as shared as Public Content, subject to separate consent obtained from the User and/or Guardian. Such data shall be processed in accordance with the consent obtained under Clause 4.3.

3.6 Technical and Usage Data

The Company may automatically collect certain technical information when the Platform is used, including:

• (a)Device type
• (b)Operating system
• (c)Platform usage data and interaction logs

Such data is used to improve functionality, performance, and user experience of the Platform.

3.7 Mandatory Nature of Data Collection

The Personal Data specified under Clauses 3.1, 3.2, and 3.3 is mandatory for the provision of Services. Failure to provide such information may result in inability to access or use certain features of the Platform or participate in activities.

3.8 Data Minimisation

The Company collects only such Personal Data as is necessary, relevant, and proportionate for the purposes set out in this Policy and does not knowingly collect excessive or unrelated Personal Data.

3.9 Booking and Participation Data

The Company may collect and maintain data relating to bookings and usage of facilities, including:

• (a)turf, facility, workshop, and event bookings;
• (b)session participation records;
• (c)time, location, and duration of usage; and
• (d)associated user and guardian details.

Such data is used for scheduling, coordination, service delivery, and operational management of the Platform.

3.10 Payment and Transaction Data

The Company collects payment-related information necessary to process fees, including transaction amount, payment method, transaction ID, and payment status. Card, UPI, and bank account details are collected and processed directly by the Company's third-party, PCI-DSS compliant payment gateway partners; the Company does not store full card or bank account numbers on its own systems.

Where a User pays a Partner directly rather than through the Company's payment flow, the Company may still receive limited transaction confirmation details from the Partner for booking verification and record-keeping purposes.

The Company's payment gateway partners are authorised Payment Aggregators regulated by the Reserve Bank of India.

3.11 Coach and Partner Personnel Data

Where coaches or partner personnel are onboarded through the Platform, the Company collects their name, contact details, qualifications, and such other information as is reasonably required for onboarding, scheduling, and verification purposes.

3.12 Location Data

Where permitted through your device settings, the Company may collect precise or approximate location data (including GPS-based location and location derived from IP address) to enable features such as locating nearby turfs, academies, or facilities. Such data is collected only with device-level permission and is used solely for this purpose.

3.13 Device Permissions

Mobile operating systems such as iOS and Android require the Company to obtain the User's permission before accessing certain device data, including camera, photo storage, and location. The permission process is governed by the relevant mobile operating system; continued use of the Platform after granting such permission constitutes consent to the corresponding data access.

3.14 CCTV and On-Premises Monitoring

Where a Partner facility (such as an academy or turf) uses CCTV or similar monitoring for safety and security purposes, footage may be collected and retained by the relevant Partner in accordance with its own policies. Users are encouraged to review the relevant Partner's premises policies where applicable.

3.15 Biometric and Camera-Derived Performance Data

Where the Platform uses camera-based motion tracking or video analysis to generate performance insights, such as movement patterns or technique analysis, such visual data may be processed using AI-based tools. This data is used solely for performance and training purposes and is subject to the same safeguards as other Sensitive Personal Data under this Policy.

4. Legal Basis and Consent

4.1 Basis of Processing

The Company processes Personal Data on the basis of consent obtained from Users and, where applicable, their Guardians, in accordance with Applicable Law.

By registering on the Platform or otherwise providing Personal Data, You consent to the collection, use, storage, and processing of such Personal Data for the purposes set out in this Policy.

4.2 Guardian Consent for Minors

In the case of a Minor, the Company processes Personal Data only upon obtaining verifiable consent from the Minor's Guardian.

Such consent is obtained through a one-time password (OTP)-based verification mechanism on the Guardian's registered contact details.

The Guardian represents and warrants that:

• (a)they are the lawful parent or guardian of the Minor;
• (b)they have the authority to provide consent on behalf of the Minor; and
• (c)all information provided is accurate and complete.

The Company shall not be responsible for verifying the authenticity of the Guardian beyond the OTP-based verification mechanism.

4.3 Separate Consent for Media and Public Content

The creation, use, and dissemination of Media and Public Content shall be subject to separate, explicit, and granular consent obtained from the User and/or Guardian through clearly identifiable opt-in mechanisms.

Users and/or Guardians shall have the option to grant or withhold consent, and such consent shall not be pre-selected by default.

4.4 Separate Consent for Promotional and Advertising Use

The Company may separately seek consent from the User and/or Guardian for the use of photographs, videos, reels, match footage, or related media content featuring Players for promotional, advertising, marketing, or sponsored campaigns on Digital media, including but not limited, to Social Media.

Such consent shall be:

• (a)separate from consent for internal or organic publication of content;
• (b)optional in nature; and
• (c)capable of being withdrawn prospectively at any time.

The Company shall take reasonable steps to ensure that promotional content involving Minors is age-appropriate and compliant with applicable platform policies and Applicable Law.

Where feasible, the Company may avoid the use of directly identifiable information of Minors in promotional campaigns.

4.5 Withdrawal of Consent

Users and/or Guardians may withdraw their consent at any time by contacting the Company or through such mechanisms as may be made available within the Platform. Withdrawing consent shall be as easy as providing it.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

However, the User acknowledges that:

• (a)withdrawal of consent may result in restriction or inability to access certain features or services; and The limitations on removal of previously published Public Content are set out in Clause 9.5(b).

4.6 Deemed Acceptance of Policy

By accessing or using the Platform, Users acknowledge that they have read, understood, and agreed to this Policy.

4.7 Minor Data Handling

The Company does not knowingly collect or process Personal Data of Minors without obtaining verifiable Guardian Consent.

Minors are permitted to access and use the Platform only under the supervision of, and with the consent of, their Guardian.

If the Company becomes aware that Personal Data of a Minor has been collected without verifiable Guardian Consent, it shall take reasonable steps to delete such data or obtain appropriate consent in accordance with Applicable Law.

4.8 Guardian-Controlled Access for Minors

Where a Player is a Minor, access to the Platform and to the Minor's participation details, performance data, and other related features is provided through the Guardian's account, subject to Guardian Consent obtained via the OTP-based verification mechanism described in Clause 4.2.

4.9 No Targeted Advertising to Children

In accordance with the Digital Personal Data Protection Act, 2023, the Company shall not undertake tracking, behavioural monitoring, or targeted advertising directed at Minors.

5. Purpose of Processing of Personal Data

The Company processes Personal Data for the following purposes:

5.1 Purpose-wise Processing

5.2 Use of Public Content

Where separate consent has been obtained, the Company may use Media and Performance Data as Public Content for:

• (a)showcasing Player participation and achievements;
• (b)publishing match highlights, reels, and tournament content;
• (c)displaying rankings, leaderboards, and statistics; and
• (d)promoting the Company's Services.

This includes content generated from tournaments and competitive events conducted or facilitated by the Company.

5.3 Internal Operations and Improvements

The Company may use Personal Data to:

• (a)improve Services, features, and user experience;
• (b)ensure safety, security, and integrity of the platform;
• (c)monitor usage patterns and engagement; and
• (d)maintain internal records and compliance.

5.4 Anonymised and Aggregated Data

The Company may process Personal Data in an anonymised and aggregated manner for analytical, statistical, and business purposes, provided that such data does not identify any individual.

5.5 Use of AI and Automated Processing

The Company may use artificial intelligence, machine learning, or other automated systems to provide, improve, and personalise Services, including for performance analytics, recommendations, and customer support. Personal Data processed through such systems is subject to appropriate technical and organisational safeguards in accordance with this Policy.

6. Data Sharing and Disclosure

6.1 Internal Access Controls

The Company restricts access to Personal Data on a need-to-know basis and in accordance with role-based access controls.

• (a)Administrators and Super Administrators shall have access to Personal Data as necessary for managing operations, user accounts, and platform functionality.
• (b)Developers and Technical Personnel shall have access only to such data as is required for maintenance, troubleshooting, and improvement of the Platform. Wherever feasible, Personal Data shall be masked or anonymised.
• (c)Leadership and Management Personnel may access data in anonymised or aggregated form for review, analytics, and decision-making purposes.
• (d)Marketing Personnel shall only have access to anonymised and aggregated data and shall not have access to personally identifiable information of Users.

6.2 Sharing with Service Providers

The Company may share Personal Data with third-party service providers engaged for the purpose of:

• (a)hosting and infrastructure services, including cloud storage providers;
• (b)maintenance and support of the Platform; and
• (c)security, monitoring, and system administration.

Such service providers shall be bound by appropriate contractual obligations to:

• (a)process Personal Data only in accordance with the Company's instructions; and
• (b)implement reasonable security safeguards.

6.3 Legal and Regulatory Disclosures

The Company may disclose Personal Data where required to do so under Applicable Law or in response to valid requests by:

• (a)law enforcement agencies;
• (b)courts or judicial authorities;
• (c)government or regulatory bodies.

The Company may also disclose Personal Data where necessary to protect the rights, safety, or property of the Company, its Users, or others, including to prevent or investigate fraud, abuse, or misuse of the Platform.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred to the relevant third party, subject to such party providing an adequate level of data protection in accordance with Applicable Law.

6.5 No Sale of Personal Data

The Company does not sell, rent, or trade Personal Data of Users to third parties.

6.6 Restricted Disclosure of Sensitive Personal Data

Sensitive Personal Data shall:

• (a)be accessible only to authorised personnel such as coaches and designated support staff; and
• (b)not be disclosed to any third party except where necessary for emergency situations or as required under Applicable Law.

6.7 Sharing with Partners for Service Delivery

Where a Service is delivered by a Partner, the Company shares relevant Player, Guardian, and booking-related Personal Data with such Partner to the extent necessary to enable the Partner to verify the booking, deliver the Service, and provide any benefits the User is entitled to.

Partners are contractually required to use such Personal Data solely for the purposes set out in this Clause and in accordance with Applicable Law.

7. Data Storage, Security and Transfers

7.1 Data Storage

Personal Data collected by the Company is stored on secure servers and infrastructure managed by the Company and its authorised service providers.

Such infrastructure may include cloud-based storage solutions, and the Company implements appropriate safeguards to ensure the security and integrity of Personal Data.

7.2 Security Measures

The Company adopts reasonable technical and organisational measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction, including:

• (a)role-based access controls;
• (b)data masking and anonymisation, where applicable;
• (c)secure authentication mechanisms; and
• (d)monitoring and security practices designed to prevent data breaches.

However, while the Company strives to protect Personal Data, no method of transmission over the internet or method of storage is completely secure, and the Company does not guarantee absolute security.

7.3 Access Restrictions

Access restrictions applicable to Personal Data, including Sensitive Personal Data, are set out in Clauses 6.1 and 6.6.

7.4 Cross-Border Data Transfers

Personal Data may be stored and processed on servers located outside India, including through cloud service providers.

In such cases, the Company shall ensure that such transfers are carried out in accordance with Applicable Law and that appropriate safeguards are implemented to protect Personal Data.

7.5 Data Retention

The Company retains Personal Data only for as long as necessary to fulfil the purposes outlined in this Policy, unless a longer retention period is required or permitted under Applicable Law.

Upon expiry of the retention period, the Company shall take reasonable steps to delete or anonymise such Personal Data.

The Company may retain certain Personal Data for a reasonable period thereafter for compliance, dispute resolution, and enforcement of legal rights.

7.6 Data Breach Notification

In the event of a personal data breach, the Company shall notify the Data Protection Board of India and the affected Users, as required under the Digital Personal Data Protection Act, 2023, describing the nature of the breach and the measures taken to mitigate its impact.

8. Rights of Users

8.1 Right to Access and Correction

Users (and, in the case of Minors, their Guardians) have the right to:

• (a)request access to Personal Data held by the Company; and
• (b)request correction or updating of inaccurate or incomplete Personal Data.

8.2 Right to Withdrawal of Consent

Users and/or Guardians have the right to withdraw consent to the processing of Personal Data at any time, in accordance with, and subject to the conditions set out in, Clause 4.5.

8.3 Right to Erasure

Users and/or Guardians may request deletion of Personal Data held by the Company.

The Company shall take reasonable steps to delete such Personal Data, subject to:

• (a)compliance with Applicable Law;
• (b)legitimate business requirements; and
• (c)retention requirements for legal, regulatory, or dispute resolution purposes.

8.4 Right to Nominate

In accordance with Applicable Law, Users have the right to nominate another individual who shall exercise their rights under this Policy in the event of death or incapacity.

8.5 Exercising Your Rights

Users and/or Guardians may exercise their rights by contacting the Company at the contact details provided in Clause 12 of this Policy.

The Company may take reasonable steps to verify the identity of the person making the request before processing such request.

9. Data Deletion and Account Closure

9.1 Account Deletion Request

Users and/or Guardians may request deletion of their account and associated Personal Data by:

• (a)using the account deletion functionality within the Platform, where available; or
• (b)submitting a request to the Company through the contact details provided in Clause 12.

9.2 Processing of Deletion Requests

Upon receipt of a valid deletion request, the Company shall take reasonable steps to:

• (a)delete Personal Data associated with the User; or
• (b)anonymise such data so that it no longer identifies the User,

subject to Clause 9.4 below.

9.3 Effect of Account Deletion

Upon deletion of an account:

• (a)the User shall no longer be able to access the Platform or Services;
• (b)certain data may be retained in anonymised form for analytical and operational purposes; and
• (c)residual data may remain in backups for a limited period, after which it shall be securely deleted or overwritten.

9.4 Exceptions to Deletion

The Company may retain certain Personal Data, notwithstanding a deletion request, where such retention is necessary for:

• (a)compliance with Applicable Law;
• (b)legal, regulatory, or audit requirements;
• (c)resolution of disputes or enforcement of legal rights; or
• (d)prevention of fraud or misuse of the platform.

9.5 Public Content and Deletion Limitations

Users and/or Guardians acknowledge that:

• (a)any Media or Public Content that has been published based on prior consent may continue to remain accessible on public platforms; and
• (b)while the Company shall make reasonable efforts to remove such content upon withdrawal of consent, it may not be possible to control or prevent further access, sharing, or dissemination by third parties.

9.6 Verification of Requests

The Company may require verification of the identity of the User or Guardian before processing any deletion request, to prevent unauthorised requests.

10. Cookies and Technical Tracking

10.1 Collection of Technical Data

The categories of technical and usage data collected by the Company, and the purposes for which such data is used, are set out in Clause 3.6.

10.2 No Use of Tracking Cookies

The Company does not use cookies or similar tracking technologies for behavioural advertising.

10.3 Limited Use of Similar Technologies

The Company may use limited technical tools or similar technologies strictly for:

• (a)enabling core Platform functionality;
• (b)maintaining security and preventing misuse; and
• (c)improving performance and user experience.

Such use does not involve tracking Users across third-party applications or services.

10.4 Future Use of Tracking Technologies

In the event the Company introduces the use of cookies or third-party tracking technologies in the future, the Company shall update this Policy and, where required under Applicable Law, obtain appropriate consent from Users and/or Guardians.

11. Third-Party Links and Services

The Platform and Services may contain links to third-party websites, platforms, or services, including social media platforms.

The Company does not control and is not responsible for the privacy practices, policies, or content of such third-party services.

Users are advised to review the privacy policies of such third parties before sharing any Personal Data with them.

12. Contact Details and Grievance Redressal

For any queries, concerns, or requests relating to this Policy or the processing of Personal Data, Users and/or Guardians may contact the Company at:

• Email: support@maidanplay.com

The Company has appointed a Grievance Officer in accordance with Applicable Law. Details of the Grievance Officer are as follows:

• Name: Amit Mishra
• Email: amitmishra@maidanplay.com

Grievances must be reported within 7 (seven) days of the relevant event, failing which the Company may be unable to address them.

The Company shall endeavour to acknowledge and resolve grievances within 15 (fifteen) days of receipt, or within such timeframe as may be required under Applicable Law.

13. Changes to This Policy

The Company may update or modify this Policy from time to time to reflect changes in its practices, Services, or Applicable Law.

Any material changes to this Policy shall be communicated to Users through appropriate means, including through the Platform or other communication channels.

Continued use of the Platform or Services after such updates shall constitute acceptance of the revised Policy.