Privacy Policy

Welcome to PlayXcrew, a skill-based online gaming tournament platform headquartered in Hyderabad, Telangana, India (company registration pending). PlayXcrew is operated by its founder, Akash Aitipamula, who acts as the Data Fiduciary within the meaning of the Digital Personal Data Protection Act, 2023 ("DPDP Act").

This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect your personal data when you access or use the PlayXcrew website, mobile application, or any related services (collectively, the "Services"). By registering for or using our Services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy is published in compliance with the Digital Personal Data Protection Act, 2023; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and all other applicable Indian laws and regulations.

We collect the following categories of personal data:

A — IDENTITY & CONTACT INFORMATION

• Full legal name
• Email address
• Mobile phone number
• Date of birth (to verify age eligibility — users must be 18+)
• Profile photograph (optional)
• State / city of residence

B — KYC & FINANCIAL INFORMATION (Sensitive Personal Data)

• PAN card number (mandatory for prize withdrawals ≥ ₹10,000, for TDS deduction under Section 194B / 194BA of the Income Tax Act)
• Government-issued photo ID (Aadhaar, Voter ID, Passport or Driving Licence) for identity verification
• Bank account details / UPI ID for prize disbursement
• Transaction and payment history
• Wallet balance and deposit / withdrawal records

C — GAMEPLAY & PLATFORM DATA

• Tournament participation history, match results and scores
• In-app activity logs and session data
• User-generated content (team names, chat messages)
• Win/loss records and prize-winning history

D — DEVICE & TECHNICAL INFORMATION

• IP address and approximate geolocation
• Device type, model, operating system, and browser
• Unique device identifiers (IMEI, UDID, advertising ID)
• App version and crash/error logs
• Network information (Wi-Fi / mobile data)

We collect your personal data through the following means:

• Registration & Account Creation: Information you provide when signing up, including name, email, phone number, and username.
• KYC Verification: Documents and identifiers you upload during the mandatory KYC process to enable financial transactions and comply with regulatory requirements.
• Payment Gateways: Transactional data processed through third-party payment partners (e.g., Razorpay, PayU, or similar RBI-regulated payment aggregators) when you deposit or withdraw funds.
• Platform Usage: Automatically collected data as you browse, play tournaments, and interact with the platform — including gameplay events, in-app actions, and session metadata.
• Cookies & Similar Technologies: Browser cookies, local storage, and tracking pixels as described in Section 8.
• Device & Network: Technical information automatically transmitted by your device and browser when you access our Services.
• Communications: Records of your interactions with our support team via email or chat.
• Third-Party Sources: Information from social login providers (Google, Facebook) if you choose to authenticate via those services, subject to your permissions on those platforms.

We process your personal data only for the following lawful purposes, as required under the DPDP Act, 2023:

We do not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data only in the following limited circumstances:

• Payment Processors & Banking Partners: We share financial and identity data with RBI-authorised payment aggregators (such as Razorpay, PayU, or similar) and banking partners solely for processing deposits, withdrawals, and prize disbursements.
• KYC / eKYC Service Providers: We may use third-party KYC verification services (regulated entities) to verify your identity documents. These providers act as Data Processors under our instructions and are contractually bound to confidentiality.
• Government & Regulatory Authorities: We will disclose your data to the Income Tax Department, GSTN, Enforcement Directorate, Police, or any other government or judicial authority as mandated by law, including for TDS compliance, AML reporting, or in response to valid legal process.
• Cloud & Infrastructure Providers: Your data may be stored on servers provided by reputable cloud service providers (e.g., AWS, Google Cloud, or equivalent) operating under data processing agreements.
• Analytics & Crash Reporting: Aggregated or anonymized technical data may be shared with analytics providers to improve platform performance.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections.
• With Your Consent: We may share your data for any other purpose with your explicit prior consent.

We retain your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations:

• Active Accounts: Personal data is retained throughout the period your account remains active.
• Account Closure: Following account deletion or closure, we retain basic identity and contact information for a period of 3 years to resolve disputes, enforce our Terms, and comply with applicable law.
• Financial & Transaction Records: All financial records — including transaction logs, prize disbursement records, TDS deduction details, and KYC documents — are retained for a minimum of 7 (seven) years from the date of the transaction, as required under the Income Tax Act, 1961, and the Prevention of Money Laundering Act (PMLA), 2002.
• Legal Hold: Where data is relevant to ongoing legal proceedings, investigations, or regulatory inquiries, we retain the data until the matter is fully resolved.
• Marketing Data: Retained until you withdraw consent or opt out, whichever is earlier.

Upon expiry of the applicable retention period, your personal data is securely deleted or anonymized in accordance with our data destruction protocols.

As a Data Principal (user) under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

To exercise any of the above rights, please contact us at legal@playxcrew.com or via our Grievance Officer (Section 12). We will respond within 30 days of receiving your request.

We use cookies and similar tracking technologies to operate and improve our Services:

• Strictly Necessary Cookies: Required for the platform to function — session management, authentication tokens, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences (language, display settings) to personalise your experience.
• Analytics Cookies: Collect anonymized data about how users interact with the platform (pages visited, features used) to help us improve performance. We may use services such as Google Analytics.
• Marketing Cookies: Used only with your consent to deliver relevant promotional communications. You may opt out at any time.

You can manage cookie preferences through your browser settings. Blocking certain cookies may affect platform functionality. By continuing to use our Services, you consent to our use of cookies as described above.

PlayXcrew is a platform exclusively for adults. You must be at least 18 (eighteen) years of age to register and use our Services. We do not knowingly collect, process, or retain personal data from individuals under the age of 18.

During registration and KYC verification, we verify your date of birth. Users found to be under 18 will have their accounts suspended and all funds refunded, pending verification of their identity.

In accordance with Section 9 of the DPDP Act, 2023, we do not process data of children (persons under 18) and do not engage in behavioural tracking or targeted advertising directed at children.

We implement reasonable technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, in compliance with the IT (Reasonable Security Practices) Rules, 2011:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS/SSL. Sensitive data (PAN, bank details) is encrypted at rest using AES-256 or equivalent.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls.
• Secure Authentication: We support two-factor authentication (2FA) and encourage all users to enable it for their accounts.
• Regular Security Audits: We conduct periodic security assessments and vulnerability testing of our infrastructure.
• Payment Security: All payment transactions are processed by RBI-regulated payment partners compliant with PCI-DSS standards. We do not store full card details on our servers.
• Data Breach Response: In the event of a data breach that is likely to cause harm to users, we will notify the Data Protection Board of India and affected users as required by law, without undue delay.

While we take all reasonable steps to protect your data, no internet transmission or electronic storage system is completely secure. We encourage you to use strong, unique passwords and to notify us immediately at support@playxcrew.com if you suspect any unauthorized activity on your account.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Update the "Effective Date" at the top of this page;
• Post a prominent notice on our website and/or application; and
• Send you an email notification to the address associated with your account (for significant changes).

Your continued use of our Services after the updated Policy has been posted constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must discontinue use of the Services and may request account deletion.

We recommend reviewing this Policy periodically. All previous versions are available upon request by contacting legal@playxcrew.com.

For any queries, concerns, or requests relating to this Privacy Policy or your personal data, please contact us through the following channels:

If you are not satisfied with the resolution provided by our Grievance Officer, you may approach:

• The Data Protection Board of India (once operationalised under the DPDP Act, 2023)
• The Consumer Forum having jurisdiction over Hyderabad, Telangana
• Courts of competent jurisdiction in Hyderabad, Telangana