Privacy Policy

1. Who this policy covers, and who is responsible

This policy is issued by TurfWise of Benguluru ("TurfWise", "we", "us"). It covers the TurfWise website, apps and software, and the booking pages hosted by us for turfs.

Two roles matter, and they come from the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

• For the details of customers who book at a turf, the turf (the "Turf") decides what to collect and why. The Turf is the data fiduciary. TurfWise is its data processor and handles the data only on the Turf's instructions under the Data Processing Terms. If you are a customer, the Turf is your first point of contact for these details.
• For the details of turf owners, managers and staff who use the software, and for our own billing, security, support and website, TurfWise decides what is done with the data. For this data TurfWise is the data fiduciary.

This policy should be read with our Terms of Service and Terms for Customers.

2. What we collect

Turf owners, managers and staff (accounts):

• name, email address, phone number (if given), role and sign-in details (your password is stored in a protected, non-readable form);
• the turf's business details you enter, such as turf name, address, GSTIN and invoice details;
• staff records the owner keeps in the software, such as roles and cash hand-overs;
• actions taken in the app, kept in an audit log (who did what and when) for the safety of the owner's money and records.

Customers of a turf (collected by the Turf through the software):

• name, phone number and email address (required on the public booking page; staff may skip the email for walk-ins);
• optional billing name, address and GSTIN if the customer wants a GST invoice in a business name;
• booking history, payments, refunds, credit, invoices and credit notes, and any notes the Turf adds;
• a yes or no for "send me offers and updates" (not ticked by default).

Plan billing (turf owners):

• which plan and credit you bought and the payment reference. Card, UPI or bank details are entered on Razorpay's page and are handled by Razorpay, not by us.

Technical data:

• device and browser type, language, pages used, error records and security logs created by our hosting and the software;
• on the public booking page, a one-way coded form of your IP address is used to stop abuse and fake bookings, and a Cloudflare Turnstile bot check runs before a booking is accepted.

Contact messages: what you write to us and your email address.

We do not ask for sensitive data such as health, caste, religion, biometrics or precise location tracking, and ask turfs not to put it into the Service.

3. Why we use it, and our basis

We use personal data for these purposes, and only these:

• to run accounts, bookings, slots, payments records, invoices and credit notes (to carry out what you or the Turf asked us to do);
• to send booking confirmations, changes, cancellations and receipts by email; these are service messages, not marketing;
• to send marketing emails on the Turf's behalf, only to customers who agreed;
• to bill turf owners for plans and credit, and to keep tax records;
• to keep the Service secure, prevent fraud and abuse, fix faults and answer support and grievance requests;
• to meet legal duties, such as GST record keeping, and to respond to lawful orders;
• to improve the Service using usage data that does not identify you.

Under the DPDP Act the lawful basis is your consent, given when you provide your details for a stated purpose and tick or submit, or a purpose the Act permits without consent, such as complying with law, or because you voluntarily gave the data for that purpose. You may withdraw consent at any time. This does not affect what was done before, and some processing continues if the law requires it or if we need it to keep the tax record that you or the Turf created.

We do not use your data to make automated decisions that have legal effect on you, and we do not sell it.

4. Who we share it with

We share personal data only as needed to run the Service. The service providers we really use are:

• Supabase: database, sign-in and file storage;
• Vercel: hosting of the website and app;
• Resend: sending emails;
• Razorpay: card, UPI and netbanking payments for our plan fees. For booking payments, the Turf's own Razorpay account is used and Razorpay is then the Turf's service provider, not ours;
• Cloudflare Turnstile: bot check on the public booking page;
• Google Maps: shows a turf's location map on its public page, which sends your browser's request to Google when you view it.

Marketing tools are different: if a Turf switches on its marketing add-on and enters its own Google Analytics or Meta Pixel IDs, those tools load on that Turf's booking page and, for customers who agreed to marketing, a server-side purchase event with a one-way coded email and phone may be sent to Meta. The Turf chooses and controls these tools. A visitor consent banner for these tools is planned; until then the Turf is responsible for telling its visitors. [Lawyer: this is a gap against the DPDP consent duty that starts in 2027.]

We give each provider only the data it needs and require them to protect it. Providers may change; we will update this list when they do.

We may disclose data to a court, government body or regulator if the law requires, to protect rights or safety, or in a sale or restructure of our business (with the same protection continuing).

A Turf can see its own customers' details, and each Turf's data is kept separate from other turfs'. Staff see only what their role allows.

We do not sell personal data and do not let providers use it for their own advertising.

5. Where data is kept, and transfers outside India

Our website hosting runs from the Mumbai region of Vercel. [Hosting region of the Supabase database, email and other providers to be confirmed: check the hosting region before publishing.] Some providers may process data outside India, for example in the United States or Europe.

The DPDP Act allows transfers outside India except to countries the Government restricts. We will not transfer personal data to a restricted country. [Lawyer: confirm wording once the Supabase region is verified, and whether a transfer notice is needed.]

6. How long we keep it

Tax records are kept as GST law requires. Bills, credit notes, payments and refunds, including the customer details printed on them, are kept for 72 months from the due date of the annual GST return for the year they belong to, and for longer while any tax proceeding is pending (section 36 of the CGST Act, 2017). They are not deleted on request while this duty applies.

Other personal data is kept while the account is active and then deleted or anonymised [30 days] after the account is closed, unless the law requires us to keep it longer. [Lawyer and owner to set periods.]

Security and audit logs are kept for [one year]. Contact messages are kept for [two years]. Backups are kept for a short period and then expire in the normal cycle. We do not manually reach into backups. [Lawyer: confirm. The DPDP Rules ask fiduciaries to keep certain logs for one year.]

If a Turf's customer asks the Turf, or us, to delete their details, we remove what the law does not require us to keep. Where tax records must stay, we keep only what we must, and restrict use of them to that purpose.

7. Your rights

Under the DPDP Act you may:

• ask for a summary of your personal data we hold and how it is used, and who we shared it with;
• ask us to correct, complete or update it;
• ask us to erase it (we will, unless the law needs us to keep it, as in section 6);
• withdraw consent you gave, including for marketing emails (tell the Turf or write to us; we will switch it off);
• make a complaint, and use the grievance process in section 12;
• nominate another person to exercise your rights if you die or cannot act.

How to ask: write to support@turfwise.in or to our Grievance Officer. We may ask you to prove who you are. We respond within the time set by law, and aim to do so within one month. [Lawyer: confirm the timelines in the final DPDP Rules.]

If you are a customer of a Turf, we may forward your request to the Turf because the Turf decides about your data. We will tell you when we do. You can also write to the Turf directly.

If you are not satisfied, you can complain to the Data Protection Board of India after you have used our grievance process, as the DPDP Act provides.

8. How we protect data

We use reasonable security measures, including:

• each turf's data is separated from other turfs' by access rules inside the database;
• Razorpay payment keys that turf owners paste are encrypted, each part with a different key, and the keys are kept outside the database. We never show a secret key back. See our Security page;
• an audit entry and an email to the owner whenever payment keys change;
• role-based access for staff, so staff see only what their role allows;
• an encrypted (HTTPS) connection for the website and app;
• a bot check on public booking and limits on repeated requests from the same source.

No system is completely secure, and we cannot promise it. You must also keep your password and staff accounts safe.

If there is a personal data breach, we will take steps to contain it, tell the affected turf owners (and the Data Protection Board and affected people where the law requires) without undue delay. [Time limits to be confirmed against the final DPDP Rules; the Rules ask for a detailed report to the Board within 72 hours.] Turfs that are data fiduciaries are responsible for telling their own customers where the law requires.

9. Children

TurfWise accounts are for adults. We do not knowingly collect a child's data for ourselves. The DPDP Act treats anyone under 18 as a child and needs a parent or guardian's verifiable consent before a child's data is handled. We do not track children, monitor their behaviour or send them targeted ads.

A Turf may take a booking where the player is a child. In that case, the parent or guardian should make the booking and give their own details. If you find that a child has given us details without a parent's consent, tell us and we will delete them. [Lawyer: how a turf that books youth teams should handle consent.]

10. Cookies and similar technology

We use only a few cookies and browser storage. They keep you signed in, remember your language and your choice of light or dark display, and protect forms from abuse. These are needed for the Service to work.

Cloudflare Turnstile may set its own cookies or run checks in your browser on the public booking page.

A Turf that switches on marketing tools can load Google Analytics and Meta Pixel on its own booking page. These may use cookies. See section 4. You can block cookies in your browser, but parts of the Service may not work.

Hosting and security logs may keep your IP address for a short time.

11. Changes to this policy

We may update this policy. We will change the date at the top, and tell account holders by email or in the app if the change is important. Where the law requires fresh consent, we will ask for it.

12. Contact and Grievance Officer

Privacy questions and requests: support@turfwise.in.

Grievance Officer: [Grievance Officer name], TurfWise, Benguluru. Email: [Grievance Officer email].

We acknowledge grievances within 48 hours and aim to resolve them within one month. See the Grievance Redressal page for how it works.