Privacy Policy

1. Who Operates This Website

This website is operated by Railway Stadium Cricket Academy ("the Academy", "we", "us", or "our"), founded by Satish Sharma in 2021.

2. What Information We Collect Through the Website

When a prospective student, parent, or legal guardian submits an online admission enquiry, our system collects only the minimal information strictly required to evaluate coaching suitability and initiate contact:

• Student Full Name (Required): To identify the applicant.
• Age & Date of Birth (Required, minimum 7 years): To determine training age group eligibility.
• Gender (Required): For batch planning and coaching roster allocation.
• Parent / Legal Guardian Name (Required): Primary authorized adult responsible for the applicant.
• Mobile Number (Required): To reach the guardian by phone call or SMS regarding trial schedules and admission.
• Email Address (Optional): To send written admission confirmations or updates.
• Residential Area / Locality (Required): In Moradabad to assist in local training commute logistics.
• Cricket Experience & Playing Role (Optional): Batter, Bowler, All-rounder, Wicketkeeper, or beginner preference.
• School Name & Preferred Joining Date (Optional): To accommodate academic timetables.
• Applicant Message / Coaching Notes (Optional): Any notes, questions, or goals shared with the coaches.

4. Information Relating to Children (Minors Under 18)

Because our cricket coaching programs welcome youth starting from 7 years of age, we treat information concerning minors with heightened protection:

• The online admission enquiry form is intended to be completed by a parent, legal guardian, or an authorized adult on behalf of a minor.
• We do not solicit more information from minor applicants than is reasonably necessary for sports training intake.
• We never publish the names, ages, photographs, or contact numbers of minor applicants on public pages of the website.
• A parent or legal guardian has the right at any time to inspect, correct, or request the permanent deletion of their child's enquiry record.

5. How Admission Enquiries Are Used

Submitted enquiry information is used solely for legitimate academy operations:

• Evaluating coaching eligibility and batch placement.
• Contacting parents or guardians via telephone call or SMS to answer questions, discuss fees, or schedule stadium trials.
• Internal administration rosters and tracking physical registration status.
• Anti-abuse, rate-limiting, and security verification.

We do NOT sell, rent, lease, or monetize personal information. We do NOT use enquiry information for third-party advertising, commercial profiling, or marketing campaigns.

6. Who Can Access Enquiry Information

Access to admission enquiry records is strictly restricted to authorized coaching personnel and academy administrators who have authenticated credentials to our Admissions CRM. Every administrative action (logins, status changes, notes, exports) is recorded in an immutable audit log.

7. Infrastructure & Technical Sub-processors

To provide high availability and data protection, our systems use reputable infrastructure providers:

• Cloudflare Pages & Cloudflare Workers: Hosts static website assets and processes backend API requests securely using HTTPS encryption.
• Cloudflare D1: Provides server-side relational database storage within Cloudflare's secure network.
• Cloudflare Turnstile: Delivers privacy-preserving bot detection and abuse prevention without tracking cookies or cross-site fingerprinting.
• Gmail SMTP (Google): Transmits confidential notification emails directly to academy coaching staff upon enquiry submission.

8. Data Retention Policy

We do not keep personal data indefinitely merely because storage exists:

• Active Enquiries (New, Contacted, Admitted): Retained for active coaching batch management and administrative record keeping during the training season.
• Closed & Inactive Enquiries: Retained for up to 365 days after case closure, after which they are subject to routine administrative archiving or deletion.
• Spam & Blocked Submissions: Retained for a maximum of 30 days for abuse analysis before automated removal.
• Audit Logs: Retained for security oversight and incident review.

9. Security Measures

We implement layered administrative and technical safeguards to protect student and guardian information:

• Transport Encryption: All traffic is encrypted in transit using Transport Layer Security (TLS/HTTPS).
• Strict Authentication: Administrator access requires PBKDF2-HMAC-SHA256 password hashing with 600,000 iterations, unique salts, and cryptographic pepper.
• Session & CSRF Controls: Protected with secure HttpOnly SameSite=Strict session cookies, 30-minute inactivity timeouts, and session-bound CSRF tokens.
• Anti-Abuse Safeguards: Pseudonymous rate limiting, duplicate submission suppression, and Cloudflare Turnstile bot deterrence.
• Audit Logging: Administrative data access and modifications are recorded for security oversight.

10. Correction and Deletion Requests

In accordance with applicable data protection principles (including India's Digital Personal Data Protection Act, 2023), applicants and their legal guardians have the right to:

• Request a copy of the enquiry details submitted under their name or phone number.
• Request the correction of erroneous or outdated contact details.
• Request the immediate and permanent deletion of their enquiry record from our database.

To submit a correction or deletion request, please email our privacy team at rscamoradabad@gmail.com with your registered student name and mobile number. Requests are processed within 7 business days.

11. Updates to This Privacy Policy

When substantive updates are made to our data practices or regulatory obligations, this document will be updated with a new revision date and version identifier. Historical consent timestamps are preserved server-side to verify the specific policy version active at the time of submission.