Privacy Notice

INAS SIVUS India ("SIVUS India", "we", "us", "our") is committed to protecting the personal data of all individuals who interact with our platform. This Privacy Notice explains how we collect, use, store, share, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. SIVUS India is the Virtus Member Organisation in India, managing athlete eligibility for persons with intellectual impairments competing in para-sport.

Data Fiduciary: INAS SIVUS India Registered Address: New Delhi, India Data Protection Officer: [email protected] General Contact: [email protected]

We collect the following categories of personal data: Identity Data: Full name, date of birth, gender, passport-sized photograph, Aadhaar number (where applicable), and disability certificate details. Contact Data: Email address, mobile number, residential address including city, district, state/union territory, and PIN code. Health and Assessment Data: Medical reports, psychological assessment reports (IQ tests, adaptive behaviour assessments), disability certificates issued by competent authorities, and impairment classification details. This data is considered sensitive personal data. Guardian Data (for minors under 18): Name, relationship to the athlete, contact details, and identity verification documents of the parent, legal guardian, or authorized person providing consent. Financial Data: Payment transaction records, invoice details, and fee payment confirmations. Technical Data: IP address, browser user agent, login timestamps, and session information collected automatically when you use our platform. Application Data: Eligibility application details, review notes, status history, and correspondence related to the eligibility process.

We process your personal data for the following specified purposes: (a) Eligibility Determination: To assess and determine your eligibility for national and international para-sport competitions as per Virtus guidelines. (b) Identity Verification: To verify your identity and the authenticity of submitted documents. (c) ID Generation: To generate and manage your official SIVUS athlete identification number and card. (d) Communication: To send you updates about your application status, document requests, event notifications, and important announcements. (e) Event Management: To facilitate your registration and participation in national and international sporting events. (f) Compliance: To comply with requirements set by Virtus (the international governing body), the Paralympic Committee of India (PCI), and applicable Indian laws. (g) Record Keeping: To maintain records as required by law and for audit purposes. (h) Platform Security: To protect the integrity of our platform, prevent fraud, and ensure secure access.

We process your personal data based on your explicit consent, obtained at the time of registration and at each stage where additional processing is required. For minors (persons under 18 years of age), consent is obtained from the parent, legal guardian, or authorized person as required under Section 9 of the DPDP Act, 2023.

Your personal data may be shared with the following categories of recipients: (a) State Administrators: Authorized state-level administrators who manage athlete registrations in your state/union territory. (b) Eligibility Staff: SIVUS India staff members responsible for document review (Level 1), psychological assessment review (Level 2), and payment/ID processing (Level 3). (c) Psychologists: Licensed psychologists assigned to review your psychological assessment reports. (d) Virtus (International Body): With your separate and explicit consent, your eligibility data may be shared with Virtus for international eligibility processing. This constitutes cross-border transfer of personal data. (e) Legal Authorities: Where required by law, court order, or government directive. We do not sell your personal data to any third party. We do not share your data for marketing purposes without your explicit consent.

If you consent to international eligibility processing, your personal data will be transferred to Virtus, which operates internationally. Such transfer is carried out in compliance with Section 16 of the DPDP Act, 2023, and only to jurisdictions not restricted by the Central Government. You may withdraw your consent for international data sharing at any time.

We retain your personal data for the following periods: Active Eligibility Data: For the duration of your active eligibility status plus 5 years after expiry or withdrawal. Application Data (rejected/withdrawn): 3 years from the date of final decision or withdrawal. Financial Records: As required by applicable tax and financial regulations (minimum 8 years). Consent Records: For the lifetime of the account plus 7 years, as required for compliance demonstration. Audit Logs: 7 years from the date of the logged action. Upon expiry of the retention period, your data will be securely erased in accordance with Section 8(7) of the DPDP Act.

As a Data Principal, you have the following rights: Right to Access: You may request information about the personal data we hold about you and how it is processed. Right to Correction: You may request correction of inaccurate or incomplete personal data. Right to Erasure: You may request erasure of your personal data, subject to legal retention requirements. Right to Withdraw Consent: You may withdraw your consent at any time. This can be done through your account settings or by contacting our Data Protection Officer. Please note that withdrawal of consent will result in your account being locked and your eligibility status being set to "not eligible." Right to Grievance Redressal: You may raise a complaint with our Data Protection Officer. If not resolved satisfactorily within 30 days, you may approach the Data Protection Board of India. Right to Nominate: You may nominate another person to exercise your rights in the event of your death or incapacity.

We implement appropriate technical and organizational measures to protect your personal data, including: - Encryption of data in transit (TLS/SSL) and at rest - Role-based access control with principle of least privilege - Secure password hashing with bcrypt - Brute-force protection (account lockout after 5 failed attempts) - Comprehensive audit logging of all data access and modifications - Regular security assessments and updates - Secure file storage with authenticated access only

For athletes under the age of 18, consent must be provided by a parent, legal guardian, or authorized person as defined under Section 9 of the DPDP Act, 2023. The guardian's identity will be verified before the eligibility application is processed. The guardian may withdraw consent on behalf of the minor at any time.

In the event of a personal data breach that is likely to cause significant harm to Data Principals, we will notify the Data Protection Board of India and affected individuals without unreasonable delay, in accordance with Section 8(6) of the DPDP Act, 2023.

We may update this Privacy Notice from time to time. The current version number and effective date are displayed at the top of this page. Material changes will be communicated to you via email or through the platform. Continued use of the platform after such notification constitutes acceptance of the updated notice.

For any questions, concerns, or requests regarding your personal data or this Privacy Notice, please contact: Data Protection Officer INAS SIVUS India Email: [email protected] General Inquiries: [email protected] If your concern is not resolved to your satisfaction, you may approach the Data Protection Board of India as established under the DPDP Act, 2023. Effective Date: March 2026 Version: 1.0