Privacy Policy

DC Sports Infrastructure (“Durosport”, “we”, “us”, or “our”) operates the Durosport Play platform available at play.durosport.in and as a mobile application (collectively, the “Platform”). This Privacy Policy explains how we collect, use, store, protect, and share your personal data when you use our Platform.

This policy is published in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the DPDP Rules, 2025, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

1. Who We Are

Durosport Play is a B2B2C SaaS platform that helps sports academies, schools, and coaching centres manage their operations, including student enrollments, batch scheduling, attendance, skill assessments, fee payments, and parent communication. We act as a Data Fiduciary (as defined under the DPDP Act) for the personal data processed through our Platform.

2. Data We Collect

We collect only the personal data necessary to deliver and improve our services. The categories of data we collect depend on your role on the Platform:

2.1 Academy Administrators

• Full name, email address, phone number
• Academy/organisation details (name, address, sports offered, logo)
• Billing and payment information (processed via our payment gateway)
• Subscription and plan details

2.2 Coaches

• Full name, email address, phone number
• Professional qualifications and certifications
• Sports specialisations and experience
• Session attendance and assessment records

2.3 Students (including Children)

• Full name, date of birth, gender
• User ID (system-generated, not email-based for minors)
• Sports enrolment, batch details, and attendance records
• Skill assessment scores and progress data
• Achievement badges, XP points, and leaderboard rankings
• Profile photo (optional, with parental consent for minors)

2.4 Parents / Guardians

• Full name, email address, phone number
• Linked child profile(s)
• Payment and fee transaction history
• Messages exchanged with coaches

2.5 Automatically Collected Data

• Device information (device type, operating system, browser type)
• IP address and approximate location (city-level)
• Usage data (pages visited, features used, session duration)
• Analytics data via Google Analytics (anonymised where possible)

3. How We Use Your Data

We process your personal data only for the following lawful purposes:

• Service Delivery: To create and manage accounts, process enrolments, schedule sessions, record attendance, generate skill assessments, and facilitate payments.
• Communication: To send session reminders, payment receipts, achievement notifications, and important service updates via in-app messaging, email, or push notifications.
• Progress Tracking: To generate player cards, leaderboard rankings, progress charts, and achievement badges for students.
• Platform Improvement: To analyse usage patterns, fix bugs, improve performance, and develop new features.
• Payment Processing: To process subscription fees, student fee payments, and tournament entry fees via our payment gateway partner (Cashfree Payments).
• Legal Compliance: To comply with applicable Indian laws, respond to lawful requests from authorities, and enforce our Terms of Service.
• Customer Support: To respond to your queries, complaints, and feedback.

4. Children's Data & Parental Consent

• Verifiable Parental Consent: Before any child's personal data is processed, we require verifiable consent from a parent or lawful guardian via OTP verification sent to the parent's registered phone number. The student's account is not activated until this consent is confirmed.
• No Behavioural Monitoring: We do not engage in behavioural monitoring or tracking of children for advertising or profiling purposes.
• No Targeted Advertising: We do not serve targeted advertisements to any users, including children.
• Minimal Data Collection: We collect only the data strictly necessary for delivering sports training and progress tracking services.
• Consent Records: All parental consent records are stored securely with timestamps, IP addresses, and verification method details, as required by the DPDP Act.
• Right to Withdraw Consent: Parents may withdraw consent at any time by contacting us at info@durosport.in. Upon withdrawal, the child's account will be deactivated and data will be deleted in accordance with our data retention policy.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Academy Partners: Your data is shared with the academy/school you are enrolled in, as they are joint controllers for the purpose of delivering coaching services. Coaches can view only the data of students assigned to their batches.
• Payment Gateway: Payment information is processed by Cashfree Payments, a PCI-DSS compliant payment gateway. We do not store your card or bank details on our servers.
• Cloud Infrastructure: Our Platform is hosted on Supabase (PostgreSQL database), Vercel (web hosting), and Firebase (push notifications). These providers process data on our behalf under strict data processing agreements.
• Analytics: We use Google Analytics to understand Platform usage. Data is anonymised where possible, and no personally identifiable information is shared with Google for advertising purposes.
• Legal Requirements: We may disclose data if required by law, court order, or lawful request from a government authority in India.

6. Data Storage & Security

• Storage Location: All data is stored on servers managed by Supabase with data centres that comply with international security standards.
• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access Controls: We implement Row-Level Security (RLS) policies in our database, ensuring users can only access data they are authorised to view based on their role (admin, coach, student, parent).
• Authentication: User accounts are protected by secure authentication mechanisms. Student accounts use simplified user IDs designed for ease of use by children.
• Regular Backups: Automated daily database backups with point-in-time recovery capabilities.
• Security Audits: We conduct periodic security reviews of our Platform, including XSS, CSRF, and SQL injection vulnerability assessments.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy or as required by law:

• Active Accounts: Data is retained for the duration of your account's active status on the Platform.
• Inactive Accounts: If an account is inactive for more than 24 months, we will notify the user (or parent, for child accounts) and may delete the account and associated data after a 30-day notice period.
• Payment Records: Transaction records are retained for 8 years in compliance with Indian tax and accounting regulations (Income Tax Act, GST Act).
• Parental Consent Records: Retained for 3 years after the child turns 18 or the account is deleted, whichever is later, for regulatory compliance.
• Post-Deletion: Upon account deletion, personal data is removed from active databases within 30 days. Residual copies in encrypted backups are purged within 90 days.

8. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Right to Access: You may request a summary of the personal data we hold about you and how it is being processed.
• Right to Correction: You may request correction of inaccurate or incomplete personal data. You can also update most information directly from your Platform settings.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: You may withdraw consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Grievance Redressal: You may raise a complaint with our Grievance Officer (details below) or escalate to the Data Protection Board of India.
• Right to Nominate: You may nominate another individual to exercise your rights in case of your death or incapacity.

To exercise any of these rights, contact us at info@durosport.in. We will respond within 30 days of receiving your request.

9. Cookies & Tracking Technologies

Our Platform uses the following tracking technologies:

• Essential Cookies: Required for authentication, session management, and core Platform functionality. These cannot be disabled.
• Analytics Cookies (Google Analytics): Used to understand how users interact with the Platform. These cookies collect anonymised usage data. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

We do not use any advertising cookies or third-party tracking pixels.

10. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware of the breach, as required by the DPDP Act.
• Notify affected users (or parents, for child accounts) without unreasonable delay via email and in-app notification.
• Take immediate steps to contain the breach and mitigate any potential harm.
• Maintain a record of all data breaches and remedial actions taken.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or an in-app notification at least 15 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the details of our Grievance Officer are as follows:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India as established under the DPDP Act, 2023.

13. Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this policy shall be subject to the exclusive jurisdiction of the courts in Hyderabad, Telangana, India.