Privacy & Cookies

1. About This Policy and Who We Are

Data Fiduciary Identity

Kabuni Sport Private Limited forms part of the Kabuni group of companies, which includes Kabuni Sports Limited, a company incorporated in England and Wales (Company No. 16604952), and operates as its India entity. Kabuni Sport Private Limited (CIN: U85410MR2026FTC473452) is incorporated under the Companies Act, 2013, with registered office at Office 208, 2nd Floor, Devavrata, Sector 17, Vashi, Navi Mumbai 400 703, Maharashtra, India.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Kabuni Sport Private Limited acts as the “Data Fiduciary” in respect of all personal data collected from users in India through the Kabuni Platform. As Data Fiduciary, we are responsible for determining the purposes and means of processing your personal data and for ensuring that all processing is lawful, fair, transparent, and compliant with the DPDP Act. You (or your parent or legal guardian, if you are a Minor) are the “Data Principal”.

How to Contact Us

For any queries, requests to exercise your data rights, or complaints relating to your personal data:

• Grievance Officer (India): Ms. Supriya Sancheti
• Email: grievanceofficer@kabuni.com
• Address: Office 208, 2nd Floor, Devavrata, Sector 17, Vashi, Navi Mumbai 400 703, Maharashtra, India

We will acknowledge all data-related requests and complaints within 72 hours and provide a substantive response within 30 days.

What This Policy Covers

This Privacy Policy explains:

• What personal data we collect about you and why we collect it;
• The legal basis on which we process your data;
• The six categories of consent we use and how they work;
• The special protections we apply to Minor users’ personal data;
• How our AI platform processes video and biometric data and what this means for you;
• Who we share your data with, including third-party processors and cross-border transfers;
• How long we retain your data and when we delete it;
• The security measures we have in place to protect your data;
• How we use cookies and tracking technologies;
• Your rights as a Data Principal under the DPDP Act; and
• How to raise a complaint, withdraw consent, or request deletion of your data.

2. Data We Collect and Why We Collect It

Website Visitors

When you visit www.kabuni.com, we automatically collect technical data including your IP address, browser type and version, operating system, pages visited, time spent on each page, links clicked, and the URL from which you arrived. This is collected through cookies and analytics tools (see Section 11) and is used to ensure the Website functions correctly and to understand aggregate usage patterns.

If you submit an enquiry form, join the waitlist, or contact us by email, we also collect the personal information you provide — typically your full name and email address, and the content of your communication. We use this to respond to your enquiry and, where you have explicitly opted in, to send you updates about Kabuni’s products and events.

Account Registration and Profile Data

When you create a Kabuni account, we collect the following:

• Full legal name;
• Date of birth — used to determine Minor status (under 18) and Event age-category eligibility;
• Gender identity — selected from: Male / Female / Other / Prefer not to say;
• Sex assigned at birth — Male / Female — collected only where operationally required for sports science categorisation or competition grouping, and collected through a separate field with a clear explanation of purpose;
• Email address and mobile number;
• School or institutional affiliation (where applicable); and
• Profile photograph (optional, if you choose to upload one).

Minor User and Guardian Data

Where a user is a Minor, the following Guardian information is collected as part of the OTP consent verification process:

• Full name of the parent or legal guardian;
• Relationship to the Minor (from a dropdown: Mother / Father / Legal Guardian / Grandparent / Sibling / Other, with a free-text field for ‘Other’);
• Guardian’s mobile number — used for OTP verification and emergency communication;
• Guardian’s email address — used for account notifications and correspondence; and
• Emergency contact number, if different from the Guardian’s mobile.

In addition, a timestamped consent log is automatically created, recording: the Guardian’s mobile number, the OTP verification status (success/failure), and the date and time of consent. This log is retained for a minimum of 3 years.

Event Registration and Participant Data

When you register for a Kabuni Event (including the KPL), we collect the following:

• Team name, school, and institutional affiliation (for team-based Events);
• Individual player details including name, date of birth, blood group, known allergies, current regular medication, and medical conditions — collected solely for emergency medical response at Events and not used for any other purpose;
• Contact details of the team Escort, school representative, or Guardian (for Minor participants);
• Aadhaar-linked date of birth proof, where requested for age verification — used solely for verification and not retained in Kabuni’s database post-verification, in compliance with the Aadhaar Act, 2016 and UIDAI guidelines; and
• Payment transaction reference — processed by Razorpay; Kabuni does not store full card details, bank account numbers, or UPI credentials.

Kabuni Device and AI Platform Data

When you use the Kabuni Device or the AI coaching platform, we collect and process the following categories of data:

Raw Data: Video footage of cricket sessions captured by the Device; sensor inputs where enabled; and session metadata including the date, time, duration, and location of each session.

Derived Data: Data generated by processing Raw Data through Kabuni’s AI pipeline, including: pose keypoints; skeletal representations; joint angles; timing markers; movement proxies; technique observations; consistency metrics; and performance indicators.

AI Outputs: Coaching feedback and recommendations; performance analytics and session summaries; benchmark comparisons and peer range analysis; talent indicators and consistency scores; highlight reels and visual overlays; and all other informational results generated by the Platform.

CRITICAL AI ANALYTICS NOTICE: Processing video footage through Kabuni’s AI platform is materially different from ordinary photography or video recording. Video is processed by machine learning algorithms to extract detailed biomechanical data. This requires a separate, specific consent (Consent D — AI Analytics and Biomechanics Processing) that is entirely distinct from any general event photography consent. You cannot give consent to AI analytics processing by accepting event photography consent. These are two completely separate consents. See the Consent Architecture table in Section 3 for details.

Kabuni Scout Programme Data

If you apply for or participate in the Scout Programme, we additionally collect: school name, year group, and student identifier (where provided); Scout application details and any supporting materials submitted; records of Scout activity, referrals, and events attended; and photographs or videos submitted voluntarily as part of Scout activities, subject to consent.

Institutional and B2B Data

Where a school, academy, or organisation accesses the Platform under a B2B agreement, we collect institutional contact details, organisational information, and the personal data of participants provided to us by the institution. In a B2B context, the institution acts as the first-level data controller and retains responsibility for having obtained all required parental and participant consents before providing data to Kabuni. Kabuni’s processing of this data is governed by the data protection provisions of the applicable B2B agreement.

3. Consent Architecture — Six Separate Consents

Kabuni does not bundle multiple consents together. The following six consents are obtained separately, distinctly, and independently. You may accept or decline each one without that decision affecting the validity of the others, except where expressly stated below. No consent box is pre-ticked or pre-selected.

Consents are obtained through a clear, affirmative action (a tick in an unticked box) and recorded with a timestamp. The basis for each consent is the user’s voluntary, specific, informed, unconditional, and unambiguous indication of agreement with the stated purpose, in accordance with Section 6 of the DPDP Act.

4. Legal Basis for Processing

Under the DPDP Act, Kabuni processes personal data on the following bases:

Consent — Where you (or your Guardian, for Minor users) have provided specific, informed, free, and affirmative consent for a defined purpose, as described in the Consent Architecture above.

Legitimate uses under Section 7 of the DPDP Act — Including compliance with a legal obligation or order, response to a medical emergency, employment-related processing, or processing for the purposes of the State in the public interest.

Contractual necessity — Where processing is necessary to perform our obligations under a B2B agreement with your institution, or to take steps at your request before entering into such an agreement.

5. Special Protections for Minor Users

Definition of Minor

A “Minor” is any person under 18 years of age. Under the DPDP Act, the Juvenile Justice (Care and Protection of Children) Act, 2015, and Indian constitutional law, a Minor cannot provide legally valid consent for the processing of their personal data. All consent for processing a Minor’s personal data must come from a verifiable parent or legal guardian (“Guardian”).

OTP Verification Process in Detail

Before any personal data of a Minor is collected or processed, Kabuni implements the following verification sequence:

• Step 1 — The system automatically detects Minor status from the date of birth entered at registration;
• Step 2 — Registration pauses and the user is prompted to enter the Guardian’s mobile number;
• Step 3 — A one-time password (OTP) is sent via SMS to the Guardian’s mobile;
• Step 4 — The Guardian must enter the OTP on the registration page to confirm consent — registration only proceeds upon successful OTP entry;
• Step 5 — A timestamped consent log is created (Guardian mobile, verification status, date/time); and
• Step 6 — If the OTP fails or times out, no Minor data is stored and the account creation will not be successful.

Absolute Restrictions on Minor Data

In addition to the general obligations of a Data Fiduciary, Kabuni applies the following absolute restrictions to all Minor users’ data:

• Kabuni will never use a Minor’s individually identifiable video footage or biometric data to train, validate, or improve Kabuni’s AI models without explicit, separate, parental consent obtained specifically for that purpose;
• Kabuni will never use a Minor’s data for targeted advertising, behavioural profiling, or interest-based marketing;
• Kabuni will never sell, license, or share a Minor’s personal data with any third party for marketing or commercial purposes;
• Kabuni will never collect data from Minors beyond what is strictly necessary for the service being provided to them (data minimisation);
• Kabuni will never use a Minor’s image in press, broadcast media, commercial sponsor materials, or investor presentations without a separate, specific, event-level parental consent; and
• Kabuni will never profile a Minor or subject a Minor to automated decision-making that produces significant effects on their rights or welfare without Guardian involvement.

Guardian Rights in Respect of a Minor’s Data

Parents and Guardians of Minor users may, at any time, request:

• Access to all personal data held by Kabuni about their child;
• Correction of any inaccurate or incomplete data;
• Erasure of their child’s account and all associated personal data;
• Withdrawal of Consent D (AI Analytics) without affecting participation rights;
• Withdrawal of Consent E (Marketing) at any time; and
• Withdrawal of all consents (Consent F), which will result in closure of the Minor’s account and deletion of their data.

All Guardian requests should be submitted to grievanceofficer@kabuni.com with the Minor’s name, date of birth, and the registered Guardian contact details. We will respond within 30 days.

POCSO Act — Mandatory Reporting

All adults accompanying Minor participants at Kabuni Events are mandatory reporters under the Protection of Children from Sexual Offences Act, 2012 (POCSO Act). Any incident or reasonable suspicion of abuse, inappropriate contact, or sexual misconduct must be immediately reported to Kabuni’s Event Manager and, where required, to the local police. Failure to report is a criminal offence under Section 21. Kabuni will cooperate fully with any law enforcement investigation or child welfare inquiry.

6. How We Use Your Data

We use personal data only for the specific purposes for which it was collected. We do not use personal data for any purpose that is incompatible with the original collection purpose without obtaining fresh consent.

7. How Our AI Platform Works — Plain Language Explanation

What the AI Does With Your Data

Kabuni’s AI coaching platform analyses video footage captured by the Kabuni Device to generate performance insights. The processing pipeline works as follows:

• Step 1 — The Device records video footage of a player during a cricket session using its camera;
• Step 2 — The footage is transmitted from the Device to Kabuni’s AI platform via an encrypted data connection;
• Step 3 — Computer vision algorithms analyse the footage frame by frame to detect and track the player’s body, including head, torso, arms, hands, legs, and feet;
• Step 4 — The AI generates Derived Data: pose keypoints (coordinates of each body joint in each frame), skeletal representations, joint angle measurements, timing markers, and movement proxies;
• Step 5 — Derived Data is processed through Kabuni’s proprietary coaching models to generate Outputs including technique assessments, benchmark comparisons, and coaching feedback; and
• Step 6 — Outputs are made available to the player and their coach through the Kabuni App or dashboard.

Why AI Processing Requires a Separate Consent

Standard event photography or video recording involves capturing an image or clip of you. AI analytics processing goes significantly further: it uses machine learning to extract detailed, quantified biometric data about the mechanics of your body movements. Because this is materially different in nature and sensitivity from ordinary photography, a separate, specific, informed consent (Consent D) is required for this processing. Accepting Consent C (event photography) does not cover and does not imply acceptance of Consent D (AI analytics).

How AI Data Is Used and Protected

Raw video footage and individually identifiable Derived Data are processed solely to generate Outputs for the specific player whose data it is, in the specific session in which it was captured. Kabuni uses aggregated and fully anonymised Derived Data (from which no individual can be identified) to improve benchmark accuracy and enhance Platform performance. We do not use individually identifiable video or biometric data of any user to train or improve our AI systems without a separate, specific, parental or user consent for that purpose.

Limitations of AI Outputs

AI Outputs are informational tools only. They are not clinical assessments, medical diagnoses, professional coaching directives, or safety guidance. All coaching, training, and welfare decisions must be made by qualified coaches and medical professionals in the exercise of their professional judgment. Kabuni’s AI is a support tool, not a decision-maker.

8. Who We Share Your Data With

No Sale of Personal Data

We do not sell, rent, or trade your personal data to any third party for any purpose. We do not share your data with advertisers or third parties for their independent commercial or marketing activities.

Data Processors

We share your personal data with the following third-party service providers (Data Processors) who process it on our behalf, under our instructions, and subject to appropriate data processing agreements. These providers may not use your data for any purpose other than providing services to Kabuni.

Data Residency Commitment

Kabuni’s primary cloud infrastructure is hosted on Microsoft Azure in the Central India region. We give preference to India-based data centre infrastructure for all personal data relating to Indian users, and particularly for Minor user data and AI/biometric session data. Where data is processed outside India, we ensure that appropriate contractual and technical safeguards are in place.

Cross-Border Data Transfers

Some of our Data Processors operate servers outside India, including in the European Union and the United States. Under the DPDP Act as currently in force, cross-border transfers of personal data of Indian Data Principals are permitted to countries not specifically restricted by the Central Government by notification under Section 16 of the DPDP Act. As at the Effective Date of this Policy, no such restriction has been notified. We ensure that all cross-border transfers are subject to appropriate contractual protections, including data processing agreements that impose obligations on the recipient no less protective than those imposed on Kabuni under the DPDP Act and applicable rules.

Disclosures Required by Law

We may be required to disclose your personal data to government authorities, regulators, law enforcement agencies, or courts where: required to do so by applicable Indian law; required by a valid court order or direction from a competent authority; or necessary to protect the rights, property, or safety of Kabuni, its users, or the public. Where we are permitted to do so, we will endeavour to notify you of any such disclosure.

Business Transfers

If Kabuni is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the relevant successor entity. We will take reasonable steps to ensure that any such recipient is bound by data protection obligations at least as stringent as those in this Policy, and will notify you of any such transfer as required by applicable law.

9. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purpose for which it was collected, subject to any legal or regulatory obligation to retain it for longer. The following table sets out our standard retention periods:

10. Data Security

Technical and Organisational Security Measures

We implement appropriate technical and organisational security measures designed to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. Our measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your device and our servers;
• AES-256 (or equivalent) encryption for data stored at rest on our servers;
• Unique login credentials and multi-factor authentication for all internal system access;
• Role-based access controls and the principle of least privilege — your data is accessible only to personnel who genuinely need access for their role;
• Detailed access logging and audit trails for all data access events;
• Written data processing agreements with all sub-processors imposing security obligations consistent with applicable law;
• Regular penetration testing, vulnerability assessments, and security patch management;
• Staff training on data protection principles, secure data handling, and incident response procedures; and
• Physical security controls at our offices and, where applicable, at data centre facilities.

Data Breach Response

In the event of a personal data breach, Kabuni will: contain and assess the breach as quickly as possible; report the breach to the Data Protection Board of India as required under the DPDP Act and applicable rules; notify affected Data Principals without undue delay where the breach is likely to result in significant harm to them; and maintain an internal data breach register and conduct a post-incident review to identify and implement measures to prevent recurrence.

If you suspect your Kabuni account has been compromised, please notify us immediately at privacy@kabuni.com.

11. Cookies and Tracking Technologies

What Are Cookies

Cookies are small text files stored on your device when you visit a website. We also use similar tracking technologies such as web beacons, tracking pixels, and session tokens. These technologies help us operate the Website, remember your preferences, analyse usage patterns, and — where you have consented — deliver marketing content relevant to your interests.

Cookie Categories

Managing Your Cookie Preferences

When you first visit the Kabuni Website, you will be presented with a cookie consent notice. By default, we apply the most privacy-preserving settings available: only essential cookies are active until and unless you actively consent to additional categories. You can update your cookie preferences at any time through your browser settings or by contacting privacy@kabuni.com.

12. Your Rights as a Data Principal

Rights Under the DPDP Act

As a Data Principal under the DPDP Act, you have the following rights in relation to your personal data held by Kabuni:

Right of Access — you may request a summary of the personal data we hold about you and information about how it is being processed.

Right of Correction and Completion — you may request that inaccurate personal data be corrected and that incomplete data be completed.

Right of Erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to any legal or contractual obligation on Kabuni to retain it.

Right to Grievance Redressal — you have the right to have your complaints about our processing addressed promptly and thoroughly.

Right to Nominate — you may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.

Please note: The DPDP Act does not currently provide a right to data portability for Data Principals in India. Kabuni therefore does not offer data portability as a right under this Policy.

How to Exercise Your Rights

To exercise any of the rights set out above, please write to our Grievance Officer at grievanceofficer@kabuni.com. Your request should include:

• Your full name;
• Your registered email address on the Platform;
• A clear and specific description of the right you wish to exercise and the personal data concerned; and
• (For Guardian requests on behalf of a Minor) confirmation of the Guardian’s relationship to the Minor, and the Minor’s name and date of birth.

We will acknowledge receipt within 72 hours and provide a full response within 30 days.

Withdrawing Consent

You may withdraw any consent given to Kabuni at any time by emailing privacy@kabuni.com. Withdrawal of consent does not affect the lawfulness of any processing carried out on the basis of that consent before it was withdrawn. The consequences of withdrawing each consent are set out in the Consent Architecture table in Section 3. Some withdrawals (particularly Consent A or Consent F) will result in your account or your child’s account being closed.

Complaint to the Data Protection Board

If you believe Kabuni has processed your personal data unlawfully, or if we have not adequately addressed your request or complaint, you may file a complaint with the Data Protection Board of India. We encourage you to contact us first at grievanceofficer@kabuni.com so that we have the opportunity to resolve your concern.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Kabuni Platform, or applicable Indian law. When we make material changes, we will update the Effective Date at the top of this document and notify registered users by email or in-app notification where reasonably practicable.

Your continued use of the Platform after the updated Policy is published constitutes your acceptance of the updated Policy. If you do not accept the updated Policy, you must stop using the Platform and may request deletion of your account.

Contact us

Kabuni Sport Private Limited
Office 208, 2nd Floor, Devavrata, Sector 17, Vashi, Navi Mumbai 400 703, Maharashtra, India
Email: grievanceofficer@kabuni.com