1. Introduction
VINA EDUTECH PRIVATE LIMITED ("Company", "we", "our", or "us") operates CrickOS, a cricket management platform accessible via web and mobile application (collectively, the "Platform"). We are committed to protecting the privacy and security of your personal data.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use CrickOS. It applies to all users of the Platform, including players, academy administrators, and managers.
By registering or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.
2. Applicable Law and Regulatory Framework
This Privacy Policy is governed by and compliant with:
- The Digital Personal Data Protection Act, 2023 (DPDP Act), India
- The Information Technology Act, 2000 and the IT (Amendment) Act, 2008
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
Under the DPDP Act, VINA EDUTECH PRIVATE LIMITED acts as the "Data Fiduciary" and users are "Data Principals". Where we process data on behalf of another entity, we act as a "Data Processor".
3. Data Fiduciary Details
- Company Name: VINA EDUTECH PRIVATE LIMITED
- Platform Name: CrickOS
- Website: www.vinaedutech.com
- Grievance Officer Contact: Nachiket Chitre (see Section 15 — Grievance Redressal for full contact details)
4. Who Uses CrickOS
CrickOS serves the following categories of users:
- Players (including minors under the age of 18)
- Academy Administrators
- Team Managers and Coaches
5. Personal Data We Collect
We collect the following categories of personal data from our users:
a) Identity and Contact Information
- Full name
- Email address
- Mobile / phone number
- Date of birth
- Age
b) Financial Information (Sensitive Personal Data)
Note: We do not store full card numbers, CVVs, or banking passwords on our servers.
- Payment details (processed via third-party payment gateways such as Razorpay / PayU)
- Transaction history related to academy fees or subscriptions
c) Health Information (Sensitive Personal Data)
- Physical health details relevant to cricket participation
- Fitness levels, injury history, or medical conditions (if voluntarily provided)
d) Location Data
- GPS and geolocation data (collected when location services are enabled)
- Academy or ground location for match and training management
e) Cricket Credentials and Affiliations
- BCCI registration ID or player ID
- Other cricket board / association IDs (state associations, district boards, etc.)
- Affiliation details with registered academies or clubs
f) Cricket Performance Data
- Batting arm (right / left)
- Bowling arm and style
- Preferred playing position
- Performance statistics (runs, wickets, averages, etc.)
- Game knowledge assessments
g) Technical and Usage Data
- IP address and device identifiers
- Browser type and operating system
- Pages visited and features used
- Logs and usage analytics
6. Purpose and Legal Basis for Processing
We process your personal data for the following purposes, each grounded in a lawful basis under the DPDP Act, 2023:
- Account creation and management — to onboard and authenticate users
- Player and academy management — to manage rosters, schedules, and training records
- Payment processing — to collect fees and subscription charges securely
- Identity verification — to verify player credentials and account authenticity
- Performance tracking — to record, display, and analyse cricket statistics and game knowledge
- Cricket affiliation management — to manage and verify registrations with cricket boards
- Platform improvement — to improve features and user experience using analytics
- Communication — to send important service updates, notifications, and alerts
- Legal compliance — to comply with applicable Indian laws and regulatory requirements
- Safety and security — to detect fraud, prevent abuse, and secure the Platform
7. Processing of Personal Data of Minors
CrickOS serves players who may be under the age of 18 years. In compliance with Section 9 of the DPDP Act, 2023, we adopt the following safeguards for minor users:
- Verifiable parental or guardian consent will be obtained before collecting or processing any personal data of a child (individual below 18 years of age).
- We will not process personal data of minors in a manner that is detrimental to their wellbeing.
- We will not engage in targeted advertising or behavioural tracking of minor users.
- Academy administrators registering minor players must confirm that appropriate parental consent has been obtained.
- Personal data of minors is afforded heightened protection and access controls within our systems.
8. Sharing of Personal Data
We do not sell your personal data. We may share data only in the following limited circumstances:
a) Payment Gateway Partners
Payment information is processed by third-party gateways (e.g., Razorpay, PayU) that are PCI-DSS compliant. These providers process payment data solely on our behalf and under strict contractual obligations.
b) Cloud and Hosting Providers
We host the Platform and store data on secure cloud infrastructure. Data processing agreements are in place with all cloud providers to ensure your data is protected.
c) Analytics Providers
We use analytics tools to understand Platform usage. These tools receive aggregated or pseudonymised data and are bound by data processing agreements.
d) Legal and Regulatory Authorities
We may disclose personal data to government authorities, courts, or law enforcement agencies when required by law or in response to valid legal process.
9. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable law. Specifically:
- Account data is retained for the duration of your active account and for 3 years after account deletion or termination.
- Payment records are retained for 7 years to comply with financial and tax regulations.
- Health and sensitive data is retained only as long as required for active service delivery.
- Minor's data is subject to the same retention schedule with additional deletion rights available to guardians.
10. Data Security
We implement industry-standard technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, or disclosure. These include:
- End-to-end encryption of sensitive data in transit (TLS/SSL)
- Encryption of data at rest, especially for financial information
- Role-based access controls to limit data access to authorised personnel only
- Regular security audits, vulnerability assessments, and penetration testing
- Incident response procedures for data breaches
In the event of a personal data breach that is likely to affect your rights and interests, we will notify you and the relevant Data Protection Board (when established) in accordance with the DPDP Act, 2023.
11. Your Rights as a Data Principal
Under the DPDP Act, 2023, you have the following rights regarding your personal data:
- Right to Access: Request a summary of the personal data we hold about you and the purposes for which it is processed.
- Right to Correction: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data, subject to legal and contractual obligations.
- Right to Grievance Redressal: File a complaint with our Grievance Officer if you believe your data has been mishandled.
- Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to Withdraw Consent: Withdraw consent previously given for data processing. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at the details provided in Section 3. We will respond to your request within a reasonable timeframe as prescribed under applicable law.
12. Consent
Where we rely on consent as the legal basis for processing, your consent will be obtained in a clear, free, specific, informed, and unambiguous manner before processing your data. For sensitive personal data (including health information and financial data), explicit written consent will be obtained.
For minor users, consent will be obtained from the parent or lawful guardian through a verifiable process.
13. Cookies and Tracking Technologies
The CrickOS web platform may use cookies and similar tracking technologies to enhance your user experience. These may include:
- Essential cookies (necessary for platform functionality)
- Analytics cookies (to understand how users interact with the Platform)
- Session cookies (to keep you logged in during a session)
You may control cookie settings through your browser. Disabling cookies may affect Platform functionality. We do not use cookies for targeted advertising.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, our practices, or Platform features. When we make material changes, we will notify you via email or a prominent notice within the Platform at least 15 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
15. Grievance Redressal
If you have any grievances, concerns, or complaints regarding the processing of your personal data, you may contact our Grievance Officer:
- Name: Nachiket Chitre
- Designation: Founder
- Email: contact@vinaedutech.com
- Address: VINA EDUTECH PRIVATE LIMITED, B1, Sai Mahal, Sai Baba Complex, Mohan Gokhale Road, Goregaon East, Mumbai 400063
- Response Time: We endeavour to resolve all complaints within 30 days of receipt.
If you are unsatisfied with our response, you may approach the Data Protection Board of India (once constituted under the DPDP Act, 2023).