Privacy Policy
Effective & Last Updated: August 28, 2026 | Compliant with DPDP Act 2023, IT Act 2000, CERT-In & NADA Codes
Executive Privacy Statement & Constitutional Foundation
Indian Athletes Unified Hub ("IAUH", "Platform", "We", "Us", "Our") is established to provide a unified, authentic, and tamper-proof digital infrastructure for Indian athletes, coaches, sports academies, state associations, and National Sports Federations (NSFs). We recognize that personal privacy, informational self-determination, and the security of athletic records are foundational to building trust across the Indian sports ecosystem.
In alignment with the landmark Supreme Court ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) establishing informational privacy as a fundamental right under Article 21 of the Constitution of India, this Privacy Policy sets forth our exhaustive legal, technical, and operational safeguards governing the collection, verification, processing, storage, and erasure of digital personal data.
1. Statutory & Regulatory Legal Framework
IAUH operates under the territorial sovereignty of the Republic of India and adheres strictly to all applicable statutory codes, rules, notifications, and athletic governance mandates, including:
Governing digital personal data processing, affirmative consent standards (§6), obligations of Data Fiduciaries (§8), enhanced protections for children (§9), statutory rights of Data Principals (§§11-14), and oversight by the Data Protection Board of India (DPBI).
Enforcing Section 43A (Reasonable Security Practices), Section 66 (Computer-Related Offences), Section 66D (Cheating by Impersonation), Section 72A (Disclosure of Information in Breach of Lawful Contract), and Section 79 (Intermediary Due Diligence Safe Harbor).
Mandating 180-day secure system logging within Indian jurisdiction and mandatory reporting of cybersecurity incidents within six (6) hours of discovery.
Harmonizing athlete credentials, age-group eligibility verification, and certificate validation across Ministry of Youth Affairs and Sports (MYAS) guidelines.
Regulating the processing of statutory anti-doping clearance indicators, Therapeutic Use Exemptions (TUE), and disciplinary sanction records strictly under sports integrity exemptions.
Ensuring non-discriminatory, dignified, and specialized credential management for Para-Athletes competing in national and international para-sporting categories.
2. Data Fiduciary Classification & Governance Scope
Under Section 2(i) of the DPDP Act 2023, IAUH operates as a Data Fiduciary that determines the purpose and means of processing personal data provided by platform users (Data Principals).
Our governance model enforces distinct data handling roles across the ecosystem:
Athletes & Competitors
Data Principals maintaining primary ownership and verification rights over their athletic passports, certificates, and metrics.
Parents & Natural Guardians
Lawful representatives exercising statutory Section 9 consent and access rights for minor competitors under 18 years.
Coaches & Academies
Authorized contributors validating training benchmarks, squad rosters, and academy affiliations.
Federations & State Associations
Recognized governing bodies validating draw sheets, championship rankings, state trials, and license numbers.
3. Comprehensive Taxonomy of Data Processed
In adherence to data minimization standards under Section 8(7) of the DPDP Act 2023, IAUH processes only data strictly necessary for athletic verification, governance, and platform security:
A. Personal Identification & Statutory KYC Data
Full legal name, official date of birth (DOB), biological sex, blood group, state and district of domicile, emergency contacts, parent/guardian details (for minors), and one-way SHA-256 cryptographic verification hashes of Government photo IDs (e.g., Aadhaar / Passport / Voter ID). Raw, plaintext biometric Aadhaar data is never stored on IAUH servers.
B. Athletic Performance & Competition Credentials
Primary sporting discipline, sub-event specializations, weight divisions, certified tournament draw sheets, electronic timing logs, distance/height marks, placement certificates, championship medals, federation license numbers (e.g., SAI ID, AFI, BAI, TTFI, WFI, AIFF, BFI), and verified performance video recordings.
C. Biometric & Physiological Performance Telemetry
Physical attributes (standing height, reach/wingspan, body mass index), physiological test benchmarks (VO2 max indicators, force-plate measurements, 10m/30m split times, jump test metrics), recovery telemetry, and verified performance footage uploaded for talent discovery.
D. Anti-Doping & Medical Integrity Records
National Anti-Doping Agency (NADA) / WADA testing clearance logs, Therapeutic Use Exemption (TUE) validation certificates, registered whereabouts filing metadata, active sanction status markers, and certified medical fitness certificates required for high-risk contact sports.
E. Grant, Scheme & Scholarship Verification Data
Direct Benefit Transfer (DBT) verification hashes, Khelo India / TOPS scholarship verification tokens, state sports council grant validation markers, and encrypted PAN/GST registration credentials for verified coaches and private sports academies.
F. Technical Telemetry, Security & Audit Logs
HMAC-SHA256 hashed IP addresses, browser user-agent tokens, device architecture, operating system versions, page latency telemetry, anti-CSRF security tokens, and immutable audit event logs maintained for statutory compliance.
4. Special Protection for Children & Minor Athletes (DPDP Act Section 9)
Mandatory Statutory Minor Protection Framework
Indian sports rely heavily on youth athletes competing in Sub-Junior, Cadet, and Junior categories. In strict adherence to Section 9 of the DPDP Act 2023, IAUH enforces heightened safeguards for any individual who has not completed 18 years of age.
- Verifiable Parental / Guardian Consent (§9(1)): Prior to processing any data of a minor athlete, verifiable affirmative consent must be executed by a natural parent, appointed legal guardian, or certified sports academy official holding legal custody. Automated DOB validation triggers parental consent workflows.
- Absolute Ban on Behavioral Tracking & Targeted Advertising (§9(2)): IAUH strictly prohibits behavioral tracking, pupil monitoring, psychometric profiling, or targeted commercial advertising directed at minor athletes.
- Prohibition of Harmful Data Processing (§9(3)): No data processing activity that is likely to cause detrimental physical, emotional, or psychological effects on a child shall be undertaken under any circumstances.
- Public Directory Shielding: Personal contact numbers, physical residential addresses, and raw identification numbers of minor athletes are permanently shielded from public search directories and made accessible only to verified sports federation administrators.
5. Lawful Grounds & Specified Purposes of Processing
IAUH processes personal data strictly based on explicit statutory grounds under Sections 4, 6, and 7 of the DPDP Act 2023:
Where you or your legal guardian have provided explicit affirmative consent for athletic profile hosting, certificate verification, and scout visibility. Consents are itemized and withdrawable at any time.
Processing necessary for compliance with Indian sports governance laws, court orders, anti-doping integrity enforcement under the National Anti-Doping Act 2022, responding to medical emergencies during sanctioned sports events, and preventing identity forgery.
Processing necessary to generate official competition draw sheets, validate age categories under NSDCI norms, issue tamper-proof digital passes, and facilitate scholarship eligibility checks.
6. Enforceable Statutory Rights of Data Principals
Under Chapter III of the DPDP Act 2023, every registered athlete, guardian, and platform user is endowed with enforceable statutory rights:
Right to Access Information (Section 11)
Request a structured summary of all personal data, verified certificates, processing activities, and list of authorized federation processors via our automated data export bundle (`DPDP-JSON-1.0`).
Right to Correction & Rectification (Section 12(1))
Request prompt correction of inaccurate athletic records, updating of obsolete profile details, and completion of incomplete competition history.
Right to Erasure / Forgotten (Section 12(2))
Request permanent erasure and anonymization of personal data upon consent withdrawal or account deletion, subject to statutory sports audit retention laws.
Right to Nominate (Section 14)
Designate an authorized legal nominee to exercise Data Principal rights on your behalf in the event of death or medical/physical incapacity.
Right of Grievance Redressal (Section 13)
Access a dedicated, transparent grievance mechanism with statutory acknowledgment within 24 hours and resolution within thirty (30) calendar days. If unsatisfied with our resolution, you maintain the statutory right to appeal directly to the Data Protection Board of India (DPBI).
7. Enterprise Data Security & CERT-In Compliance
In compliance with Section 8(5) of the DPDP Act 2023 and Section 43A of the IT Act 2000, IAUH deploys state-of-the-art technical and organizational safeguards:
- Cryptographic Defense: AES-256 encryption at rest for all database volumes; TLS 1.3 encryption in transit for all web and API telemetry.
- Access Control: Strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) for administrative accounts, and Hardware Security Module (HSM) key management.
- CERT-In 180-Day Log Mandate: Immutable, append-only security logs are retained for 180 days within Indian sovereign territory to assist in forensic cybersecurity reviews.
- Mandatory Breach Notification (§8(6)): In the improbable event of a confirmed personal data breach, IAUH will notify the Data Protection Board of India and affected Data Principals in the prescribed statutory format and timeframes.
8. Sovereign Data Localization & Sub-Processors
All primary database clusters, disaster recovery instances, and cryptographic credential vaults holding athlete data are geographically localized inside certified tier-IV data centers located within the sovereign territory of the Republic of India.
Any cross-border data transfer complies strictly with Section 16 of the DPDP Act 2023 and Central Government notifications. Third-party cloud infrastructure sub-processors are bound by strict statutory Data Processing Agreements (DPAs) and non-disclosure obligations. We never sell, rent, or monetize athlete personal data to third-party commercial brokers.
9. Data Retention, Archival & Eradication Schedules
We adhere to strict purpose limitation and storage restriction schedules:
- Active Athlete Profiles: Data is retained for the duration of the athlete's active registration and competition career on the hub.
- Verified Account Erasure: Upon verified erasure request under Section 12, personal identifiers are permanently scrubbed and anonymized from production databases within thirty (30) calendar days.
- Statutory Integrity Exceptions: Anti-doping sanction records, national record marks, and official tournament medal rosters are retained in immutable archives strictly as required by the National Anti-Doping Act 2022 and NSDCI guidelines.
10. Cookie Consent & Web Storage Interoperability
IAUH enforces a transparent, non-invasive 30-day persistent cookie consent framework. For full technical details regarding browser storage categories, session security markers, and granular opt-in controls, please review our dedicated Cookie Policy.
11. Statutory Grievance Redressal & Compliance Desk
In compliance with Section 13 of the DPDP Act 2023 and Rule 5(9) of the IT SPDI Rules 2011, IAUH maintains a dedicated statutory privacy compliance desk to address inquiries, exercise data rights, and resolve grievances:
Statutory Grievance Redressal & Data Protection Officer
Entity: Indian Athletes Unified Hub (IAUH)
Jurisdiction: Republic of India (Seat: Mumbai, Maharashtra)
Contact Channel: Reach our compliance desk via our designated contact email or submit a formal ticket via our official Contact & Support Page.
Statutory SLA: Formal acknowledgment within 24 hours; complete resolution within 30 calendar days.
If your grievance is not resolved within thirty (30) days or if you are dissatisfied with our response, you possess the statutory right under Section 13(3) of the DPDP Act 2023 to file a complaint before the Data Protection Board of India (DPBI).
Indian Athletes Unified Hub (IAUH)
Standardizing Data Protection & Governance in Indian Sports