PRIVACY POLICY

WarzOne Cups ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform, participate in tournaments, or interact with our community channels. It is aligned with India's Digital Personal Data Protection Act 2023 (DPDP Act) and associated Rules 2025.

By registering an account or using our services, you provide free, specific, informed, and unambiguous consent to the practices described in this policy. If you do not agree, please do not use our platform.

1. Who We Are

WarzOne Cups is operated by Robbin Singh, based in New Delhi, India. We are the Data Fiduciary for personal data collected through this platform and all associated channels (web app, Discord, WhatsApp, Instagram, YouTube).

Contact: [email protected]

2. Data We Collect

We collect the following categories of personal data:

• Account Information: Full name, email address, mobile number, state of residence, age confirmation
• Gaming Information: COD Mobile username and player ID
• Payment Information: UPI ID (for prize payouts and VIP Gold subscription), UTR/reference numbers submitted for VIP purchase verification, PAN (for TDS compliance on prize payouts). We do not store full bank account details or card numbers.
• Profile Photo (optional): A photo you voluntarily upload as your player avatar. See Section 3 for full details.
• Usage Data: Tournament registrations, slot bookings, match participation history, login timestamps
• Communication Data: Messages sent to our support team via email, Discord, or our contact form
• Technical Data: IP address, browser type, device information, and cookies (see Section 7)

3. Profile Photo Upload

You may optionally upload a personal photo to use as your player avatar on WarzOne Cups. This feature is entirely voluntary. Your account works fully without a photo — you can use a Discord profile picture or a generated robot avatar instead.

What we collect: The image file you choose to upload. Before uploading, you are asked to give explicit, one-time consent. You will not be asked to consent again on subsequent visits unless you remove your photo and upload a new one for the first time.

• Purpose: Your photo is displayed as your avatar to other players and in tournament lobbies on warzonecups.com only.
• Processing: Your image is re-encoded to JPEG (max 512×512 px) by our server before storage. All original EXIF/metadata (including GPS location, device info) is stripped during this process. The processed image contains no personal metadata beyond the visible pixels.
• Storage location: Processed images are stored in secure cloud object storage provided by a third-party provider, in a region proximate to India in compliance with the DPDP Act 2023. Your photo is served via a public URL on our platform and is visible to any player who views your profile.
• Retention: Your photo is retained as long as you keep it active. You can permanently delete it at any time via your dashboard Profile tab — deletion removes the file from our storage and stops display immediately. Upon account deletion, any stored photo is also deleted.
• No sharing: Your photo is not shared with third parties, used for training AI models, sold, or transferred outside of the display purpose described above.

To remove your photo at any time: go to Dashboard → Profile → Upload Photo → Remove. Removal is immediate and permanent.

4. How We Use Your Data

We process your personal data for the following purposes:

• Creating and managing your account
• Processing tournament registrations (free entry) and VIP Gold subscription payments
• Distributing prize payouts to your UPI ID
• Sending tournament alerts, Room IDs, and result notifications
• Enforcing our fair play policies and community rules
• Responding to support queries and dispute resolution
• Improving our platform based on usage analytics
• Preventing fraud, cheating, and abuse
• Compliance with applicable Indian laws and regulations, including tax (TDS) and the DPDP Act

We will never sell your personal data or use it for unsolicited marketing to third parties.

5. Legal Basis & Consent

By creating an account and using our services, you provide free, specific, informed, and unambiguous consent for us to process your personal data for the purposes listed above, as required under the DPDP Act 2023.

You may withdraw your consent at any time by contacting us at [email protected]. Please note that withdrawing consent may limit our ability to provide services — for example, we cannot process prize payouts without valid payment details on file.

Certain processing activities — including tax record retention (Section 194BA, Income Tax Act), regulatory compliance, and responding to valid legal orders — are carried out under legal obligation and are not subject to consent withdrawal.

6. Data Storage & Security

Your data is stored on secured cloud servers located in Singapore (database) and the United States (hosting infrastructure). These cross-border transfers are made under standard contractual protections with our service providers.

We implement industry-standard security measures including encrypted connections (HTTPS), Fernet encryption for sensitive fields (phone number, UPI ID), JWT-based authentication, access controls, and regular security reviews.

In the event of a personal data breach that is likely to cause harm, we will notify affected users and the Data Protection Board of India within 72 hours of becoming aware of the breach, as required under DPDP Rules 2025.

7. Third-Party Sharing

We do not sell your personal data. We may share limited data with:

• Payment processors: Only the UPI transaction references necessary to verify payments and process prize payouts
• Cloud and hosting providers: Who run our servers and databases under reasonable security agreements
• Community platforms: Discord, WhatsApp, Instagram, and YouTube — governed by their own privacy policies when you interact with us there
• Legal authorities: If required by a valid court order, government directive, or applicable Indian law

Tournament results (COD username and placement only) are published publicly on our website as part of our transparent results commitment. This is a necessary and expected part of participating in a public esports tournament.

8. Data Retention

We retain your personal data only for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data: Retained for the lifetime of your active account. If you request deletion, we will deactivate your account and suppress your personal data from all active systems within 30 days. Data required for legal, tax, or dispute purposes (tournament history, payment records) will be retained per the schedule below and cannot be erased earlier.
• Payment records (UPI IDs, UTR numbers, PAN for prize payouts): Retained for a minimum of 5 years to comply with financial and tax record-keeping requirements (TDS, Income Tax Act).
• Tournament records: Retained for a minimum of 5 years for regulatory compliance and dispute resolution.
• Profile photos: Deleted immediately when you remove your photo via the dashboard, or upon account deletion. No backup copies are kept after deletion.

9. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act 2023, you have the following rights:

• Access: Request information on what personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Deletion (Erasure): Request deletion of your personal data where legally permitted
• Withdraw Consent: Withdraw your consent to processing at any time
• Grievance Redressal: Raise a complaint about our handling of your personal data

To exercise any of these rights, email [email protected] with your request and sufficient identification. We will acknowledge your request within 48 hours and respond within 90 days, as required under DPDP Rules 2025.

10. Cookies

WarzOne Cups does not use cookies. Your login session is stored in your browser's localStorage (not a cookie) and is never transmitted to third parties. We do not use any third-party analytics, advertising trackers, fingerprinting, or session recording tools. No cookie consent banner is required because no cookies are set.

11. Children's Privacy

Our platform is strictly for users aged 18 and above. We do not knowingly collect data from anyone under 18. If we become aware that a minor has registered, we will suspend the account and remove their data promptly. If you believe a minor has registered, contact us immediately at [email protected].

12. Grievance Officer & Policy Updates

As required under the DPDP Act 2023 and applicable online gaming guidelines, we have designated a Grievance Officer for data-related complaints:

• Name: Robbin Singh
• Role: Data Fiduciary / Grievance Officer
• Email: [email protected]
• Location: New Delhi, India
• Response Time: Acknowledgement within 48 hours · Resolution within 90 days

If your grievance is not resolved to your satisfaction within 90 days, you may escalate to the Data Protection Board of India once it becomes operational under the DPDP Act 2023.

We may update this policy periodically to reflect changes in law or our practices. Material changes will be notified via email to registered accounts, announced on our Discord server and Instagram. Continued use of the platform after changes constitutes acceptance of the updated policy.