Privacy Policy

FC Real Bengaluru (“we”, “us”) operates the RealVerse platform and related websites. This policy explains what personal data we collect, why we collect it, how long we keep it, and your rights.

1. Data we collect

We may collect the following categories of information:

• Contact and identity: player and parent/guardian names, phone numbers, email addresses, date of birth, programme interest, and preferred centre.
• Account data: login credentials (stored as password hashes), role, and optional two-factor authentication for staff accounts.
• Academy operations: attendance, training sessions, coach notes, player metrics, wellness check-ins, trials, fixtures, and parent development reports.
• Payments: fee plans, payment history, and PayU transaction references. We do not store full payment card numbers.
• CRM and leads: enquiry and admission form submissions, including consent records and marketing source fields.
• Media and LMS: uploaded training content URLs, learning progress, badges, and assessment results.
• Walk/run activity location data: if a student uses the RealVerse activity recorder, we collect GPS route points, timestamps, GPS accuracy, optional device-provided speed/altitude/heading, activity type, distance, duration, pace, route bounds, and activity consent records. Browser location is requested only when recording an activity.
• Technical data: IP address, browser type, and request identifiers in server logs for security and troubleshooting.
• Analytics (optional): if you accept analytics cookies, we use Google Analytics to understand how our public website is used.

2. Why we collect data

• Provide academy services, coaching, scheduling, and parent communication.
• Process fees and maintain financial records.
• Operate CRM and admissions workflows.
• Record student-selected walks or runs, calculate route distance/time, show private activity history, and generate FCRB-branded activity cards.
• Secure the platform and prevent abuse.
• Improve our website and product (with consent where required).
• Comply with applicable law.

3. How long we keep data

Retention depends on the data type:

• Active student and staff records: for the duration of the relationship.
• Inactive leads: typically up to 24 months unless converted or deleted earlier.
• Walk/run activity records: until the student deletes the activity, withdraws future recording consent, requests deletion, or the account is deleted, subject to safety, legal, and backup-retention limits.
• Activity consent records: retained as proof of notice and consent, including withdrawal history, for as long as needed to demonstrate compliance and handle privacy requests.
• Payment records: up to 7 years where required for accounting and tax purposes.
• Server logs: typically 30–90 days.
• Analytics: per Google Analytics configuration when enabled.

4. Legal bases (GDPR / UK GDPR)

Where EU/UK law applies, we rely on contract performance, legitimate interests (operating a football academy platform), legal obligation, and consent (for non-essential cookies and certain marketing).

5. India (DPDP Act)

Where the Digital Personal Data Protection Act applies, we process personal data for lawful purposes connected to academy operations and use consent where required. For student walk/run GPS recording, we provide a just-in-time notice before recording, store the consent version accepted, and require parent or legal guardian confirmation for minors before enabling the recorder. You may contact us to exercise rights available under applicable Indian law.

6. California (CCPA/CPRA)

We do not sell personal information. California residents may request access or deletion subject to verification and legal exceptions.

7. Sharing and subprocessors

We use service providers that process data on our behalf, including:

• Render (application hosting and database)
• PayU (online payments)
• Google Analytics (website analytics, if consented)
• Cloud storage compatible with S3/R2 for media (when configured)
• Map tile providers for displaying maps in the student activity recorder (when configured)

Activity card downloads use a simplified route drawing and do not rely on third-party map tiles in the exported image.

8. Security

We use HTTPS, access controls, password hashing, rate limiting, and operational practices described in our internal security documentation. No method of transmission over the Internet is 100% secure.

9. Your rights

Depending on your location, you may have the right to:

• Access or export your data (student portal export where available).
• Request correction or deletion (subject to legal and contractual limits).
• Withdraw consent for analytics cookies at any time via browser settings and our cookie banner.
• Withdraw future walk/run GPS activity recording consent from the student activity recorder.
• Delete saved walk/run activities from the student dashboard or request broader deletion through the student privacy tools.
• Lodge a complaint with a supervisory authority.

Contact us at privacy@realbengaluru.com to exercise these rights.

10. Children

Our services are directed at academy participants including minors. Parents or guardians provide contact details and consent where required on enquiry, admission, and student activity recording forms. Walk/run route maps are student-only by default in this version. We do not use children’s activity-location data for ads, behavioural profiling, unrelated marketing, or public leaderboards.

11. Changes

We may update this policy. The “Last updated” date at the top will change when we do.