Grass2Glory is designed from the ground up to comply with India's Digital Personal Data Protection Act, 2023 — the most comprehensive data protection law in Indian history.
The Digital Personal Data Protection Act, 2023 is India's comprehensive data protection legislation. It establishes rights for Data Principals (individuals), obligations for Data Fiduciaries (organisations processing data), special protections for children's data, and a Data Protection Board for enforcement. All organisations collecting digital personal data of Indian residents must comply.
Our Compliance
Grass2Glory operates as a Data Fiduciary under DPDP Act. We have designated a Data Protection Officer and implemented all required safeguards.
Consent Management
Every athlete's data requires verifiable consent — parental/guardian consent for minors. Consent records maintained with timestamp and IP.
Data Security
TLS 1.3 in transit and encryption at rest on our servers. Results captured offline stay in the device's own browser storage until they sync, protected by the device passcode, and are erasable from the app at any time. Role-based access control throughout.
User Rights
All 6 DPDP rights implemented: access, correction, erasure, grievance, nomination, and consent withdrawal — all actionable within the platform.
Data Minimisation
We collect only the data necessary for the stated purpose. Athletes provide performance data; contact info is collected only for coaches and admins.
Cross-Border Restriction
All data stored on India-based cloud infrastructure. No cross-border data transfer without explicit consent and legal basis.
Grievance Officer
Designated Grievance Officer with 48-hour response commitment. Escalation path to the Data Protection Board of India available.
School Data Protection
Schools act as data intermediaries. They collect and maintain parental consent records before any athlete data is entered into the platform.
Athlete Privacy
Athlete full profiles are never visible to federation or authority users without explicit consent and specific trial-related legal basis.
Breach Protocol
Breach notification to Data Protection Board within 72 hours. Affected users notified within 7 days as required by DPDP rules.
Contact — Data Protection Officer
Email
info@grass2glory.com
Grievance
info@grass2glory.com
Response Time
48 hours
Escalation
Data Protection Board of India
READY TO GET STARTED?
Sign up and record your first session. Nobody has to approve it.
