1. Overview
Playofy (operated by VEDAA LTD, company number 17009847, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) is committed to protecting your personal data. This policy explains what data we collect, why we collect it, and how we keep it safe.
This policy applies to all users of the Playofy website, mobile app, and related services globally, with specific provisions for users in the United Kingdom and India.
2. Data Controller / Fiduciary
VEDAA LTD
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@playofy.com
Phone: +44 7586 494104
3. Data We Collect
| Category | Examples |
|---|---|
| Identity | Full name, username, profile photo |
| Contact | Email address, phone number |
| Location | City, approximate GPS (with consent) |
| Transaction | Payment method type, booking history |
| Technical | IP address, browser type, device ID, cookies |
| Usage | Pages visited, search queries, interactions |
We do not collect special category data (e.g. health, religion, biometrics) without explicit consent.
4. How We Use Your Data
- check_circleTo create and manage your Playofy account.
- check_circleTo process bookings, payments, and cancellations.
- check_circleTo show you relevant games and venues near your location.
- check_circleTo send transactional communications (booking confirmations, reminders).
- check_circleTo send marketing communications — only with your explicit consent and easy opt-out.
- check_circleTo detect fraud, enforce our Terms of Service, and comply with legal obligations.
- check_circleTo improve our platform through aggregated analytics (no individual profiling for advertising).
5. Legal Basis for Processing
- Contract — processing necessary to fulfil your booking or account contract.
- Legal obligation — complying with UK law (e.g. HMRC record-keeping).
- Legitimate interests — fraud prevention, service security (balanced against your rights).
- Consent — marketing emails, optional location access, non-essential cookies.
- Consent — freely given, specific, informed, and unambiguous. You may withdraw at any time.
- Legitimate uses — processing required to perform a service you requested, or compliance with Indian law.
7. Data Retention
- scheduleAccount data — retained for as long as your account is active, plus 12 months after deletion request.
- scheduleTransaction/financial records — 7 years (UK HMRC) / 8 years (India Companies Act 2013).
- scheduleLog and technical data — up to 90 days unless required for an ongoing investigation.
- scheduleMarketing consent records — retained until consent is withdrawn, plus 3 years thereafter.
8. International Data Transfers
Where we transfer data outside the UK, we rely on UK adequacy regulations, Standard Contractual Clauses (SCCs), or binding corporate rules as appropriate.
Transfers of Indian residents' personal data to countries outside India comply with the Central Government's permitted list and applicable cross-border transfer obligations.
9. Your Rights — United Kingdom
Access
Request a copy of all personal data we hold about you.
Rectification
Correct inaccurate or incomplete data.
Erasure
Request deletion ("right to be forgotten") where no legal basis to retain exists.
Restriction
Ask us to pause processing while a dispute is resolved.
Portability
Receive your data in a machine-readable format.
Object
Object to processing based on legitimate interests or direct marketing.
To exercise any right, email support@playofy.com. We respond within 30 days. You may also complain to the ICO (Information Commissioner's Office).
10. Your Rights — India
Access & Summary
Request a summary of personal data processed and processing activities.
Correction & Completion
Correct inaccurate, incomplete, or misleading personal data.
Erasure
Withdraw consent and have your data erased, unless legal retention applies.
Grievance Redressal
Raise a grievance with our Data Protection Officer; we respond within 30 days.
Nomination
Nominate another individual to exercise your rights in the event of death or incapacity.
Complaint to DPBI
Lodge a complaint with the Data Protection Board of India if your grievance is unresolved.
12. Security
We implement TLS encryption in transit, AES-256 encryption at rest, access controls with least-privilege principles, regular penetration testing, and breach notification procedures. In the event of a data breach likely to affect your rights, we will notify you within 72 hours (UK) and as required under Indian law.
13. Children's Privacy
Playofy is not intended for users under the age of 18. We do not knowingly collect data from children. Under DPDPA 2023, processing personal data of a child requires verifiable parental consent. If you believe a child has provided us data, contact us immediately at support@playofy.com.
14. Changes to This Policy
We may update this policy periodically. For material changes, we will notify you by email or prominent in-app notice at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance.
15. Contact & DPO
For any privacy queries, data subject requests, or to reach our Data Protection Officer: