Privacy Policy

1.1 Information You Provide Directly

We collect the following personal data that you voluntarily provide when registering, booking, or using the Platform:

1.2 Information Collected Automatically

When you access or use the Platform, we automatically collect:

1.3 Information from Third Parties

We process your personal data for the following lawful purposes, as permitted under the DPDP Act, 2023:

Under the DPDP Act, 2023, we process your personal data based on the following legal grounds: • Consent: Your explicit, informed, and voluntary consent provided at the time of registration and when using specific features. You may withdraw consent at any time, subject to the consequences outlined in Section 8. • Contractual Necessity: Processing necessary for the performance of the contract between you and PlayPal (e.g., processing bookings, facilitating payments). • Legitimate Uses: As specified under Section 7 of the DPDP Act, including processing for employment purposes, voluntary provision of data, and state-permitted purposes. • Legal Obligation: Processing required to comply with applicable Indian laws and regulations.

4.1 Venue Partners

When you make a booking, we share the following information with the relevant Venue Partner to fulfill your booking: Parent/Guardian name, contact number, booking date and time, number and ages of children attending, and any special needs or requirements disclosed. Venue Partners are contractually obligated under our Data Processing Agreement to use this data solely for booking fulfillment and are prohibited from using it for independent marketing or sharing it with third parties.

4.2 Payment Processors

We use Razorpay as our payment gateway. When you make a payment, your payment information is transmitted directly to Razorpay's PCI-DSS compliant servers. Razorpay processes payments in accordance with their own privacy policy and RBI guidelines. PlayPal receives only transaction identifiers and payment status confirmations.

4.3 Service Providers and Legal Disclosure

We engage trusted third-party service providers who assist in operating the Platform, including: cloud hosting (for database and application hosting), email services (Resend for transactional emails), analytics providers (for usage analysis), and customer support tools. These providers are bound by data processing agreements and are permitted to process data only on our behalf and in accordance with our instructions. We may also disclose your personal data if required by law, regulation, legal process, or governmental request, including compliance with orders from Indian courts or tribunals, requests from law enforcement agencies, and requirements under the IT Act, 2000, DPDP Act, 2023, or other applicable legislation.

PlayPal takes the protection of children's personal data with the utmost seriousness. As a platform dedicated to children's play experiences, we implement the following enhanced safeguards in compliance with Section 9 of the DPDP Act, 2023:

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, subject to the following retention periods:

We implement comprehensive technical and organizational measures to protect your personal data, in compliance with the IT (Reasonable Security Practices) Rules, 2011:

Under the DPDP Act, 2023, you have the following rights as a Data Principal: To exercise any of these rights, contact our Data Protection Officer at dpo@playpal.in or use the privacy settings in your account dashboard.

Your personal data is primarily stored and processed in India using cloud infrastructure. However, some of our service providers may process data in jurisdictions outside India. Cross-border transfers are made in compliance with the DPDP Act, 2023, and are restricted to countries not on the Central Government's restricted list (as notified under Section 16(1) of the DPDP Act). We ensure that adequate data protection safeguards are in place through contractual obligations with our service providers. We do not transfer children's data outside India unless absolutely necessary for service delivery, and only to jurisdictions with adequate data protection standards.

We use cookies and similar tracking technologies as described in our separate Cookie Policy. In summary, we use: essential cookies for authentication and security (NextAuth session cookies), functional cookies for user preferences (theme, language), and analytics cookies for understanding usage patterns. You can manage your cookie preferences through your browser settings or our cookie consent banner.

In the event of a personal data breach, PlayPal will notify the Data Protection Board of India as required under the DPDP Act, 2023, without unreasonable delay. Affected Data Principals will be notified as soon as reasonably practicable, including information about: the nature of the breach, the types of data affected, potential consequences, measures taken to address the breach, and steps you can take to protect yourself. We maintain an incident response plan that is tested and updated regularly to ensure prompt and effective response to data breaches.

The Platform may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access through our Platform. Key third-party services include: Razorpay (payment processing), Google (OAuth authentication), and Resend (email delivery).

In compliance with the DPDP Act, 2023, and the IT (Intermediary Guidelines) Rules, 2021, PlayPal has appointed a Data Protection Officer (DPO) who also serves as the Grievance Officer: Data Protection Officer: [DPO Name] Email: dpo@playpal.in Phone: [DPO Contact Number] Address: PlayPal Technologies Pvt. Ltd., [Registered Address], Bangalore, Karnataka, India Grievance Response: Within 24 hours of receipt Grievance Resolution: Within 30 days (as per DPDP Act) If you are unsatisfied with our response, you may file a complaint with the Data Protection Board of India established under the DPDP Act, 2023.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by: posting the updated policy on the Platform with a new effective date, sending an email notification to registered users, and displaying a prominent notice on the Platform for 30 days. Your continued use of the Platform after the updated policy takes effect constitutes your acceptance of the changes.

PlayPal Technologies Private Limited Privacy Inquiries: privacy@playpal.in Data Protection Officer: dpo@playpal.in General Support: support@playpal.in Address: [Registered Office Address], Bangalore, Karnataka, India Website: www.playpal.in This Privacy Policy was last updated in February 2026 and is effective as of [Effective Date].