Privacy Policy

1. Introduction

This Privacy Policy explains how Saurabh Sarin, Shitij Gupta, and Shashwat Nandan, operating as My FPL Mini-League ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use the My FPL Mini League platform ("Platform"), accessible at myfplminileague.com.

My FPL Mini League is a web-based platform that enables Fantasy Premier League (FPL) managers to participate in private paid mini-leagues featuring enhanced scoring, analytics, and prize distribution.

This Policy applies to all users of the Platform, regardless of location. Where specific rights or obligations differ by jurisdiction, we have identified the applicable provisions for users located in India, the European Union/European Economic Area (EU/EEA), and California (United States).

By using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as the legal basis for processing your personal data, we will obtain your explicit consent before collecting or processing such data.

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Identity and Authentication Data

2.2 Contact and Communication Data

2.3 User Preferences

2.4 Gameplay and Performance Data

2.5 Financial Data

Note: We do not directly collect or store your payment card details, bank account information, or UPI credentials. Payment transactions are arranged by the league administrator outside the Platform. We record only the outcome (whether a prize was awarded and the amount).

2.6 Analytics and Usage Data

2.7 Cookies and Browser Storage

Essential Cookies (First-Party):

Analytics Cookies (Third-Party — Google Analytics 4):

Local Storage (Browser):

Session Storage (Browser):

For more information about cookies and how to manage them, please see Section 10: Cookies and Similar Technologies.

3. Purposes of Processing

We process your personal data for the following purposes:

4. Legal Basis for Processing

4.1 For Users in India (DPDPA, 2023)

We process your personal data on the following legal bases under the DPDPA:

• Consent (Section 6): We obtain your free, specific, informed, and unambiguous consent before collecting your personal data. You provide this consent when you create an account and at specific points during your use of the Platform (e.g., opting in to WhatsApp notifications, consenting to public leaderboard disclosure).
• Certain Legitimate Uses (Section 7): In limited circumstances, we process data without consent where permitted — for example, to comply with legal obligations or to respond to a medical emergency.

You have the right to withdraw your consent at any time. See Section 14: Consent Withdrawal.

4.2 For Users in the EU/EEA (GDPR)

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests.

4.3 For Users in California, United States (CCPA/CPRA)

• We do NOT sell your personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.
• We do NOT share your personal information for cross-context behavioral advertising.
• You have the right to opt out of any future sale of personal information should our practices change.

5. Data Sharing and Third Parties

We share your personal data with the following third-party service providers, solely for the purposes described below. We do not sell your personal data to any third party.

5.1 Service Providers

5.2 Public Data Disclosure — GitHub Pages

5.3 Other Disclosures

We may also disclose your personal data:

• To comply with applicable law, regulation, legal process, or governmental request.
• To enforce our terms of service or other agreements.
• To protect the rights, property, or safety of Saurabh Sarin, Shitij Gupta, and Shashwat Nandan, operating as My FPL Mini-League, our users, or others.
• In connection with a merger, acquisition, or sale of assets, in which case you will be notified.

6. International Data Transfers

Your personal data may be transferred to and processed in countries other than the country in which you reside.

6.1 For Users in India

Under Section 16 of the DPDPA, 2023, the transfer of personal data outside India is permitted except to countries specifically restricted by the Central Government through notification. As of the effective date of this Policy, no such restrictions have been notified. We will update this Policy if any restrictions are imposed that affect the transfers listed above.

6.2 For Users in the EU/EEA

Where we transfer your personal data outside the EU/EEA to countries that have not received an adequacy decision from the European Commission, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), EU-US Data Privacy Framework (DPF) certification, and Transfer Impact Assessments (TIAs).

You may request a copy of the applicable safeguards by contacting us at [email protected].

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

Upon expiration of the applicable retention period, we will securely delete or anonymize your personal data, unless further retention is required by law.

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:

8.1 Rights Under Indian Law (DPDPA, 2023)

8.2 Rights Under EU/EEA Law (GDPR)

8.3 Rights Under California Law (CCPA/CPRA)

8.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at [email protected]. When submitting a request, please provide sufficient information to verify your identity. We may request additional verification before processing your request.

All requests will be processed free of charge, unless requests are manifestly unfounded or excessive, in which case a reasonable fee may be charged.

8.5 Right to Lodge a Complaint

If you are not satisfied with our response, you may lodge a complaint with the applicable supervisory authority:

• India: Data Protection Board of India (once constituted and operational under the DPDPA, 2023)
• EU/EEA: Your local Data Protection Authority
• California: Office of the California Attorney General

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in accordance with applicable law.

10. Cookies and Similar Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. We also use browser local storage and session storage, which serve similar purposes.

10.2 Cookies We Use

Essential Cookies — These cookies are strictly necessary for the Platform to function and cannot be disabled.

Analytics Cookies — These cookies help us understand how users interact with the Platform. They are set by Google Analytics 4.

10.3 Browser Storage

We use browser local storage and session storage for the purposes described in Section 2.7. Notably, the userEmail key in local storage contains your email address for display convenience.

10.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. Please note that blocking essential cookies will prevent you from using the Platform, as they are required for authentication.

To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-out Browser Add-on.

11. Children's Privacy

The Platform is not intended for individuals under the age of 18.

The Platform involves paid league participation with real-money entry fees and prize distribution. We do not knowingly collect personal data from individuals under the age of 18. We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children. By creating an account, you represent and warrant that you are at least 18 years of age.

If we become aware that we have inadvertently collected personal data from an individual under 18, we will take immediate steps to delete such data. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material Changes: We will notify you by email and/or by displaying a prominent notice within the Platform at least 15 days before the changes take effect.
• Minor Changes:We will update the "Last Updated" date at the top of this Policy.

Where we rely on consent as the legal basis for processing, and a change materially affects the scope or purpose of processing, we will seek your renewed consent before applying the change to your data.

13. Grievance Officer

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer:

Response Commitment: We will acknowledge your complaint within 72 hours of receipt and endeavor to resolve it within 30 days.

Escalation: If you are not satisfied with the resolution provided by our Grievance Officer, you may approach the Data Protection Board of India (India), your local Data Protection Authority (EU/EEA), or the Office of the California Attorney General (California, USA).

14. Consent Withdrawal

You have the right to withdraw your consent at any time. Under Section 6(6) of the DPDPA, 2023, the process for withdrawing consent is designed to be as easy as the process for giving consent.

14.1 Channel-Specific Opt-Outs

14.2 Full Consent Withdrawal (Account Deletion)

To withdraw all consents and request deletion of your account and personal data:

1. Send an email to [email protected] with the subject line "Account Deletion Request."
2. Include the email address associated with your account.
3. We will verify your identity and process the request within 30 days.

Consequences of full withdrawal: Your account will be permanently deleted. All personal data will be deleted in accordance with the retention schedule in Section 7. Financial records may be retained for up to 8 years as required by law. Any active league participation will be terminated. Entry fees are non-refundable upon voluntary withdrawal. Data already published on the public leaderboard will be removed upon request.

Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Governing Law and Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, India, without prejudice to your right to lodge a complaint with the Data Protection Board of India or any other applicable supervisory authority.

For users in the EU/EEA, nothing in this section limits your right to bring proceedings before the courts of the EU Member State in which you reside.