Privacy policy

1. Data we collect

• Account data: name, email, and sign-in identifiers from Microsoft Entra External ID.
• Placement data: display name, role or organisation description, and the public link on the Crown.
• Transaction data: amount, currency charged, purpose, status, time, and the payment reference from Razorpay. We do not store card numbers, CVV, expiry, or UPI PINs.
• Technical data: IP address, browser type, and basic device data used to run the site and stop abuse.
• Support data: what you send by email or phone.

2. Why we use it

• To deliver the placement you buy.
• To run your account and the live arena.
• To confirm payments, issue refunds, and produce invoices.
• To detect fraud and meet law that applies to us, including Indian tax and payment-aggregator rules.
• To answer support and grievance requests.

3. Legal basis

We use data to perform the placement contract, to comply with law, and to keep the platform secure. Where India's Digital Personal Data Protection Act, 2023 or another privacy law (including GDPR, if it applies to you) requires consent, we will ask before using data for that extra purpose. You can withdraw optional consent without undoing a placement already delivered.

4. Who we share data with

• Razorpay: to collect payments in your currency and process refunds. Card and UPI details stay on Razorpay’s PCI DSS systems.
• Microsoft Entra External ID: to sign you in.
• Hosting and operations providers (including Azure and Vercel) under contract.
• Advisers, tax authorities, or law enforcement when the law requires it.

We do not sell personal data.

5. Storage and retention

Account and placement records stay while your account is open, then as long as tax, accounting, and dispute rules require (often up to eight years for financial records in India). We do not store raw card data or CVVs.

6. Cookies

We use essential cookies for sign-in, security, and load balancing. We do not use third-party ad cookies to sell a profile of you. Blocking cookies in your browser may break some features.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or get a copy of your data (DPDP in India, GDPR in the EEA/UK, and similar laws elsewhere). Write to privacy@onewinner.lol. We may need to verify it is you.

8. Children

The service is for people aged 18 or over. We do not knowingly collect data from children. If a minor has submitted data, contact privacy@onewinner.lol.

9. Grievance officer

Complaints can go to the officer on our Grievance Redressal page. We acknowledge them within 48 hours and aim to close them within 30 days.

10. Contact

ONEWINNER
Registered office address — set NEXT_PUBLIC_LEGAL_ADDRESS to the full address on your PAN / GST certificate
privacy@onewinner.lol · +91 (set NEXT_PUBLIC_SUPPORT_PHONE)