1 Scope and status of this policy

1.1 This Policy applies to personal data processed through https://www.cricradio.com, the CricRadio Android and iOS applications, and related pages, APIs, alerts, account services, support channels and digital interfaces together, the Services.

1.2 It applies whether a person browses without an account, creates an account, configures alarms or notifications, participates in a quiz or referral, contacts support, submits content or otherwise interacts with the Services.

1.3 This Policy should be read with the CricRadio Terms and Conditions, Disclaimer, point-of-collection notices, permission prompts, promotion rules and app-store privacy disclosures. A specific notice governs the relevant feature to the extent it provides more detailed information.

1.4 This Policy is designed for the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 as their provisions are brought into force, the Information Technology Act 2000 and applicable rules, and other privacy, consumer and cybersecurity requirements that apply to the processing. Additional rights may apply based on a person's location.

2 Who controls personal data

2.1 Lifease Solutions LLP, operator of CricRadio, is the Data Fiduciary or controller for personal data processed for its own purposes through the Services.

2.2 Questions, requests and grievances may be sent to the Privacy and Grievance Officer at cricradioinfo@gmail.com. A service provider that independently determines its own purposes may be a separate controller under its own notice.

3 Personal data we may collect

3.1 The categories actually collected depend on the feature, device, permissions, account status and current configuration. CricRadio seeks to collect only data reasonably necessary for a disclosed purpose.

Account and identifiers

Examples: Mobile number, email address, display name, account or user ID, country, age confirmation and authentication status.

When relevant: Registration, login, OTP delivery, account recovery and eligibility.

Preferences and activity

Examples: Favourite teams, match pins, alarms, notification settings, searches, content interactions, quiz responses, reward points, referral code and participation history.

When relevant: Personalised features, continuity, rewards, analytics and fraud control.

Device and technical data

Examples: IP address, app version, device type, operating system, browser, language, time zone, push token, network, identifiers, logs, crash and performance diagnostics.

When relevant: Delivery, security, compatibility, troubleshooting and measurement.

Communications

Examples: Support requests, grievance or rights notices, feedback, attachments, call or message metadata and delivery status.

When relevant: Support, evidence, dispute resolution, safety and compliance.

User content

Examples: Comments, reports, profile material, images, audio, links, suggestions or other material a user chooses to submit.

When relevant: Only where the relevant submission or community feature is available.

Location

Examples: Country, region or approximate location inferred from IP or settings; precise location only if a disclosed feature requires it and permission is granted.

When relevant: Regional availability, law, security, language and feature delivery.

Transaction and entitlement

Examples: App-store receipt, subscription status, entitlement, promotion or reward record; ordinarily not full payment-card details.

When relevant: Only if a paid, promotional or redemption feature is introduced or used.

Inferences

Examples: Likely interests or preferences derived from use of CricRadio features.

When relevant: Personalisation and service improvement, subject to applicable choice and law.

3.2 CricRadio does not ask users to provide passwords for third-party accounts, payment-card security codes, government identifiers, health information, biometric data, precise location or other sensitive information unless a specific feature lawfully requires it and provides an appropriate notice. Users should not send unnecessary sensitive information through support or public features.

3.3 CricRadio may process content that is not personal data, including aggregated cricket statistics and de-identified product metrics. If such information can reasonably identify a person, it will be treated as personal data.

4 How personal data is collected

4.1 Directly from the individual when registering, verifying an OTP, changing settings, configuring alarms, participating in quizzes or rewards, using a referral, submitting content, exercising a right or contacting support.

4.2 Automatically from the app, website, device or browser through server logs, local storage, cookies, SDKs, tokens, pixels, crash tools and comparable technologies when the Services are used.

4.3 From app stores, authentication and communications providers, analytics and security providers, hosting providers, referral partners, cricket-data suppliers, public sources or another person where that source is authorised to provide the data.

4.4 If another person provides data about an individual, that person represents that they are authorised to do so and must provide any notice or obtain any consent required by law.

5 Purposes and lawful grounds

5.1 CricRadio may process personal data for the following purposes:

• provide, maintain, personalise and improve requested website and app features;

• create and secure accounts, authenticate users and remember settings;

• deliver scores, alarms, notifications, content and service communications requested by a user;

• operate quizzes, referrals, reward points, promotions and eligibility checks;

• measure performance, diagnose faults, conduct quality testing and understand aggregate use;

• prevent fraud, scraping, bots, spam, account abuse, infringement, cyber incidents and unlawful activity;

• respond to support, privacy, grievance, safety and intellectual-property requests;

• comply with law, binding legal process, recordkeeping duties and regulatory directions;

• establish, exercise, defend, enforce or resolve legal claims and the Terms and Conditions; and

• communicate material service, security and policy changes.

5.2 Depending on the law and context, processing may rely on freely given, specific, informed and unambiguous consent; a user's voluntary provision of data for a specified purpose; performance of a requested service or contract; compliance with law; protection of persons, rights or systems; certain legitimate uses recognised by the DPDP Act; legitimate interests recognised in another jurisdiction; or another lawful ground.

5.3 Where consent is the ground, it may be withdrawn as easily as it was given through available settings or by contacting CricRadio. Withdrawal does not invalidate earlier lawful processing. A feature may stop where the withdrawn data is necessary to provide it.

5.4 CricRadio will not use personal data for a materially incompatible new purpose without providing any additional notice and obtaining any fresh consent required by law.

6 Cookies SDKs and similar technologies

6.1 The website may use cookies, pixels, local storage and similar browser technologies. The apps may use SDK identifiers, local app storage, push tokens and comparable technologies rather than conventional browser cookies.

Strictly necessary

Purpose: Login continuity, security, load balancing, fraud prevention and requested functions.

Choice: Usually cannot be disabled within CricRadio without affecting the Service.

Functional

Purpose: Remember optional preferences and improve convenience.

Choice: May be controlled through settings where available.

Analytics and performance

Purpose: Measure aggregate use, reliability, crashes, errors and feature performance.

Choice: Consent or opt-out is provided where required.

Advertising or tracking

Purpose: Cross-service behavioural advertising or targeted measurement.

Choice: Not presently used by CricRadio; would require updated disclosures and any necessary consent.

6.2 Users can adjust available CricRadio controls, browser settings, device permissions and operating-system privacy settings. Blocking technologies may affect login, alarms, preferences or other functions.

6.3 Where legally required and technically applicable, CricRadio will respect recognised consent choices or privacy signals. A browser do-not-track signal does not create a contractual obligation where no applicable standard or law requires a response.

7 Analytics advertising and tracking

7.1 CricRadio may use analytics, crash-reporting, performance and security providers to process limited technical and usage information on its instructions. CricRadio seeks to configure providers to minimise collection and restrict unrelated use where controls are available.

7.2 CricRadio is presently ad-free and does not presently sell personal data or permit third-party behavioural advertising through the Services. If advertising, subscriptions or cross-service tracking are introduced, CricRadio will first update this Policy, app-store disclosures and consent choices as required.

7.3 Apple App Store privacy details and Google Play Data safety disclosures are maintained based on the app and integrated third-party code. CricRadio will seek to correct any identified inconsistency; app-store summaries do not replace this fuller Policy.

8 How personal data is disclosed

8.1 CricRadio does not disclose personal data for unrelated purposes. It may disclose data in the following limited circumstances:

Processors and service providers

Purpose and safeguards: Hosting, cloud, database, content delivery, communications, OTP, push notification, analytics, crash reporting, security, customer support and professional services under appropriate confidentiality, purpose and security restrictions.

Authorised personnel and affiliates

Purpose and safeguards: Need-to-know access for the purposes in this Policy, subject to access controls and confidentiality obligations.

At the user's direction

Purpose and safeguards: Sharing links, public submissions, requested integrations, referrals or another action initiated by the user.

Authorities and rights protection

Purpose and safeguards: Compliance with law or binding process; cyber-incident response; investigation of fraud, abuse or infringement; protection of safety and rights; and legal claims. CricRadio may challenge an overbroad request where appropriate.

Business transaction

Purpose and safeguards: A proposed or completed financing, restructuring, merger, acquisition, insolvency or transfer of business or assets, subject to lawful safeguards and notice where required.

Aggregated or de-identified information

Purpose and safeguards: Research, reporting, product improvement or commercial planning where individuals are not reasonably identifiable.

8.2 Service providers are authorised to process personal data only for contracted purposes or as law independently requires. Their compliance is supported by diligence and contractual controls, but no policy can guarantee another party's conduct.

9 International processing

9.1 CricRadio and its providers may process data in India and other countries where infrastructure, personnel or suppliers operate. Privacy laws and government-access rules may differ between countries.

9.2 Where cross-border processing occurs, CricRadio will apply safeguards and comply with government restrictions required by applicable law. CricRadio will not knowingly transfer personal data to a country, territory or person prohibited under binding Indian law.

10 Retention deletion and anonymisation

10.1 Personal data is retained only for as long as reasonably necessary for the stated purpose, requested service, valid consent, security, fraud prevention, backup cycle, dispute resolution, rights enforcement, legal obligation or applicable limitation period. Retention therefore varies by category and context.

Account and preferences

Retention approach: While the account is active and for a limited period afterward to complete deletion, prevent abuse, resolve disputes and meet legal duties.

Alarms pins quizzes rewards and referrals

Retention approach: For the feature lifecycle and a limited period required for continuity, verification, fraud control, corrections and disputes.

Security logs and OTP records

Retention approach: For security, incident response and the period required by applicable cybersecurity, telecom or legal obligations.

Analytics and diagnostics

Retention approach: According to configured provider or internal retention periods, with aggregation or deletion when no longer needed.

Support grievances and legal records

Retention approach: For resolution, evidence, compliance and the relevant legal limitation or recordkeeping period.

Backups

Retention approach: Until overwritten or securely isolated under normal backup cycles; not restored for ordinary use after deletion.

10.2 When data is no longer required, CricRadio will delete, anonymise or securely isolate it. Limited records may be retained after account deletion to demonstrate consent or compliance, detect repeat fraud or infringement, complete a transaction, resolve a complaint, or establish, exercise or defend legal claims.

10.3 Where the DPDP Act or Rules prescribe an inactivity notice or erasure period for an applicable class of service, CricRadio will apply that requirement when it becomes applicable.

11 Security and incident response

11.1 CricRadio maintains reasonable administrative, technical, physical and contractual safeguards appropriate to the nature and risk of the data. Measures may include access controls, encryption in transit, credential protection, least-privilege access, logging, backups, secure development, vulnerability management, supplier review, personnel confidentiality and incident procedures.

11.2 No system, transmission or storage method is completely secure. CricRadio cannot promise absolute security or that a determined attacker, compromised user device, malicious third party or event beyond reasonable control will never defeat safeguards.

11.3 If a personal-data breach or reportable cyber incident occurs, CricRadio may investigate, contain, remediate, preserve evidence and notify affected individuals, the Data Protection Board, CERT-In or another authority in the time and manner required by applicable law. Notices may be supplemented as facts become available.

11.4 Users must protect OTPs and devices, use current software and promptly report suspected account compromise. CricRadio will never ask a user to disclose an OTP for support purposes.

12 User rights and choices

12.1 Subject to applicable law and as the relevant legal provisions come into force, an individual may request:

• a summary of personal data being processed and processing activities;

• the identities or categories of recipients where required;

• correction, completion or updating of inaccurate or incomplete personal data;

• erasure of personal data that is no longer lawfully required;

• withdrawal of consent and management of communication preferences;

• grievance redressal;

• nomination of another individual to exercise rights in the event of death or incapacity where provided by law; and

• other rights available in the individual's jurisdiction.

12.2 A request should identify the relevant account and right. CricRadio may request proportionate information to verify identity, authority and scope, and will not ask for unnecessary identity documents.

12.3 A request may be declined, narrowed or delayed where permitted by law, including where identity cannot be verified, another person's rights would be harmed, retention is required, the request is fraudulent or abusive, or a legal exception applies. CricRadio will explain the basis where required.

12.4 An individual dissatisfied with CricRadio's response may use the grievance process and, after following any required internal process, approach the competent Data Protection Board, consumer authority, court or regulator as permitted by law.

13 Account deletion

13.1 Where account creation is available, a user may request deletion through the applicable in-app account setting, at https://www.cricradio.com/account-deletion, or by emailing cricradioinfo@gmail.com from the registered email address or with sufficient account verification and using the subject Account Deletion Request.

13.2 CricRadio may authenticate the request, explain consequences and offer a short opportunity to cancel an accidental request, but will not impose unnecessary obstacles. Account data will be deleted or de-identified subject to Clause 10 and lawful exceptions.

13.3 Deleting the app, clearing browser data or ceasing use does not submit an account-deletion request. Deleting a CricRadio account does not automatically cancel an app-store subscription or purchase administered by a third party; the user must use that provider's controls.

14 Children and age restricted features

14.1 CricRadio does not knowingly process a child's personal data without verifiable consent from a parent or lawful guardian or another legal authorisation. Under Indian data-protection law, a child is a person under 18.

14.2 Match Probability, Runs Projection and other age-restricted features are intended only for persons aged 18 or older. CricRadio may use proportionate age-assurance measures, restrict features or request guardian verification where appropriate. Users must not misstate age or help a child bypass controls.

14.3 A parent or guardian who believes a child provided personal data without valid authorisation should contact cricradioinfo@gmail.com. After appropriate verification, CricRadio will delete or restrict the data as required.

14.4 CricRadio does not knowingly undertake tracking or behavioural monitoring of children or targeted advertising directed at children where prohibited by law.

15 Public content referrals and sharing

15.1 Content submitted to a public feature can be viewed, copied, indexed, recorded or redistributed by others beyond CricRadio's control. Users should not publish personal or confidential information they do not want made public.

15.2 Referral links or QR codes may contain a user-specific referral identifier. A recipient and CricRadio may be able to associate use of the link with the referring account for attribution, fraud prevention and rewards. The link should not contain a phone number or other direct identifier unless clearly disclosed and necessary.

15.3 When a user shares through a device's share sheet or third-party app, the third party's independent data practices apply. CricRadio receives only information returned through the referral or link flow.

16 Automated processing and artificial intelligence

16.1 CricRadio may use automated systems for ranking, recommendation, translation, moderation, fraud detection, data matching, support and product analytics. Human review may be used where appropriate to the risk and law.

16.2 CricRadio does not presently make a decision based solely on automated processing that produces a legal or similarly significant effect on a user. If such processing is introduced, CricRadio will provide the notice, safeguards and rights required by applicable law.

16.3 Personal data will not be used to train a general-purpose external AI model for an unrelated purpose without an appropriate lawful basis, updated disclosure and any consent required by law.

17 Third party services

17.1 The Services may contain links, embedded content or integrations operated by third parties. If a user leaves CricRadio or directly interacts with a third party, that third party's privacy notice applies to its independent processing.

17.2 CricRadio is not responsible for independent third-party privacy practices, but will take reasonable contractual and operational steps for providers processing data on CricRadio's instructions.

18 Communications

18.1 CricRadio may send transactional or service communications for OTPs, accounts, requested match alerts, alarms, security, support, policy updates and legal notices. These communications are not marketing merely because they refer to CricRadio.

18.2 Promotional email, SMS, RCS, WhatsApp, voice, push or similar communications will be sent only with any consent required for that channel. A user may opt out through the message, available settings or by contacting CricRadio. Opting out of marketing does not stop essential security, transactional or legal communications.

19 Changes to this policy

19.1 CricRadio may update this Policy for changes in law, regulatory guidance, app-store requirements, suppliers, technology, security, features or business operations. The revised version will be made available through the Services.

19.2 Where a change materially affects rights or introduces a new purpose requiring consent, CricRadio will provide prominent notice and obtain consent before the new processing begins where required. Continued use does not replace legally required consent.

20 Privacy and grievance contact

20.1 Privacy requests and grievances may be sent to the Privacy and Grievance Officer, Lifease Solutions LLP, at cricradioinfo@gmail.com. Include the registered account detail, the right or concern, relevant dates and the requested response.

20.2 CricRadio will acknowledge and address requests within periods required by applicable law. Urgent suspected data exposure or account compromise should be marked URGENT and should not include passwords, OTPs or unnecessary sensitive data.