Privacy Policy

1. Introduction

This Privacy Policy explains how Webxkey (Private) Limited, trading as Sportynix (“Sportynix”, “we”, “us”, or “our”), collects, uses, stores, shares, and protects personal data when you use:

• the Sportynix mobile applications for Android and iOS;
• the Sportynix website;
• Sportynix booking, payment, messaging, team, league, tournament, challenge, scoring, notification, and related services; and
• any other service that links to this Privacy Policy.

Webxkey (Private) Limited is responsible for the personal data processed through Sportynix, except where an independent venue operator, payment provider, or other third party processes information for its own purposes.

By accessing or using Sportynix, you acknowledge that you have read this Privacy Policy. Where consent is required by applicable law, we will request it separately.

2. Information We Collect

We collect information directly from you, automatically from your device and use of Sportynix, from venue operators, and from authorised third-party services.

2.1 Account and profile information

We may collect:

• full name;
• email address;
• telephone number;
• profile photograph;
• date of birth or age-related information where required;
• username and internal account identifiers;
• password hash and authentication information;
• one-time password verification information;
• account status and security records; and
• preferences, favourite venues, and profile settings.

2.2 Information received through third-party sign-in

When you choose to sign in using Google, Apple, or another supported identity provider, we may receive information authorised by you and the provider, such as:

• name;
• email address;
• profile photograph; and
• provider-specific account identifier.

The information received depends on your settings and the provider’s policies.

2.3 Booking and venue information

When you search for or book a venue, we may collect:

• venue, sport, court, and facility information;
• booking date, start time, end time, duration, and selected slots;
• normal, recurring, or permanent booking type;
• recurring booking configuration and generated occurrences;
• booking reference and QR-code information;
• booking price, advance requirement, outstanding balance, and additional charges;
• booking, attendance, cancellation, completion, no-show, and dispute status;
• notes, special requests, and communications concerning the booking;
• team, match, event, tournament, or league associated with a booking; and
• venue feedback, ratings, and reviews.

Consecutive time slots may be stored and presented as one continuous booking with a single booking reference and QR code.

2.4 Payment and transaction information

When you make or attempt to make a payment, request a refund, or pay at a supported venue, we may collect and retain:

• booking or order identifier;
• merchant reference and payment-provider transaction identifier;
• payment amount and currency;
• payment date and time;
• payment method type;
• payment status, including pending, successful, failed, cancelled, refunded, reversed, or disputed;
• card brand and masked card number where supplied by the payment provider;
• advance amount, total booking amount, and outstanding balance;
• refund, reversal, chargeback, and payment-dispute information;
• payment-provider verification and notification information;
• venue-side payment and reconciliation records; and
• receipts and payment history.

Online payments may be processed by PayHere or another approved payment provider. Full card numbers, card security codes, banking passwords, PINs, and payment one-time passwords are entered into and processed by the relevant payment provider. Sportynix does not require or intentionally store your full card number or card security code.

2.5 Saved payment methods

Where saved payment methods are offered and you choose to use them, the payment provider may tokenise your payment method.

Sportynix may receive and store limited information such as:

• a provider-issued payment token or reference;
• payment method type;
• card brand;
• masked card number;
• expiry month and year; and
• saved-method status.

Sportynix does not store the card security code. Removing a saved payment method does not remove transaction records that must be retained for accounting, security, fraud prevention, legal compliance, refunds, or dispute handling.

2.6 Location information

With your permission, we may collect precise or approximate location information to:

• show nearby venues;
• calculate distance;
• improve venue discovery;
• provide maps and navigation-related features; and
• provide location-based recommendations.

You can disable location access through your device settings. Some nearby venue and distance features may then be unavailable or less accurate.

2.7 Team, league, tournament, challenge, and sporting-profile information

We may collect:

• team names, logos, descriptions, and settings;
• team membership, invitations, requests, and administrative roles;
• player profiles, preferred roles, positions, batting or bowling styles, and sporting preferences;
• challenge details and participant information;
• league and tournament applications;
• match schedules, scores, results, statistics, and player-performance information; and
• organiser, co-administrator, and participant records.

Some of this information may be visible to other Sportynix users depending on the feature, privacy setting, competition structure, or public nature of the activity.

2.8 Messages, media, reviews, and other user content

We may process content you create or share through Sportynix, including:

• direct messages;
• team, challenge, booking, league, and tournament chats;
• voice messages;
• photographs, videos, files, and other media;
• reviews and ratings;
• support enquiries and complaints; and
• reports concerning inappropriate conduct, fraud, safety, or disputes.

Messages and content intended for other users will be shared with the intended recipients. Content posted publicly may be viewed by other users or website visitors.

2.9 Device, usage, and technical information

We may automatically collect:

• device type and model;
• operating system and version;
• Sportynix app version;
• device, installation, session, and application identifiers;
• IP address;
• access date and time;
• screens viewed, features used, and user interactions;
• network and connection information;
• crash reports, diagnostics, and performance data;
• authentication, security, and audit logs;
• push-notification tokens; and
• cookies or similar technologies used by the website.

2.10 Information received from venue operators and organisers

Venue operators, league organisers, tournament organisers, and authorised administrators may provide information concerning:

• booking attendance and QR-code verification;
• payments made at the venue;
• outstanding balances;
• booking changes and cancellations;
• venue closures or facility unavailability;
• no-shows;
• refunds and refund approvals;
• damage, misconduct, safety incidents, or disputes; and
• match, league, or tournament participation and results.

3. How We Use Your Information

We may use personal data to:

• create, verify, secure, and manage your account;
• authenticate you through email, one-time passwords, Google, Apple, or other supported methods;
• display venues, sports, courts, prices, and available time slots;
• place temporary slot holds and prevent conflicting bookings;
• create and manage normal, consecutive-slot, recurring, and permanent bookings;
• process advances, booking payments, venue payments, balances, refunds, and reversals;
• verify payment notifications and determine payment status;
• issue booking confirmations, QR codes, invoices, receipts, and payment-history records;
• provide venue operators with information needed to fulfil and manage bookings;
• operate teams, challenges, leagues, tournaments, live scoring, and sporting profiles;
• deliver messages, chat media, and real-time updates;
• send booking confirmations, reminders, payment notifications, team updates, challenge notices, security alerts, and service communications;
• operate points, rewards, referrals, promotions, and user-engagement features;
• personalise venue discovery and recommendations;
• respond to support, cancellation, refund, and dispute requests;
• investigate duplicate payments, failed payments, fraud, abuse, chargebacks, and unauthorised activity;
• maintain accounting, audit, tax, reconciliation, legal, and compliance records;
• enforce our Terms of Service, Refund and Cancellation Policy, venue rules, and competition rules;
• protect users, venue staff, Sportynix, and the public;
• improve app reliability, security, functionality, and user experience; and
• comply with applicable laws and lawful requests.

4. Grounds for Processing

Depending on the circumstances and applicable law, we process personal data because:

• it is necessary to provide the Sportynix service or perform a contract with you;
• you have given consent, such as for optional location, camera, microphone, photo-library, or notification access;
• processing is necessary to comply with legal, accounting, tax, regulatory, or security obligations;
• processing is necessary for legitimate interests such as preventing fraud, securing the platform, improving services, handling disputes, and operating the business, provided those interests are not overridden by your rights; or
• processing is necessary to protect the rights, safety, or vital interests of users or other persons.

Where processing is based on consent, you may withdraw consent through your device settings, app settings, or by contacting us. Withdrawal does not affect processing already lawfully carried out.

5. Payment Processing Through PayHere

Sportynix may use PayHere to process online and supported venue payments.

When you initiate a PayHere payment, we may provide PayHere with information needed to process and verify the transaction, including:

• your name;
• email address;
• telephone number;
• billing or contact address where required;
• booking or order identifier;
• description of the booking or service;
• payment amount and currency; and
• information required for transaction verification and fraud prevention.

PayHere processes your payment credentials under its own terms and privacy practices.

PayHere may return transaction information to Sportynix, including:

• payment identifier;
• payment status;
• amount and currency;
• payment method;
• masked card information;
• transaction time; and
• verification information.

Sportynix uses verified payment notifications and transaction information to determine whether a payment is successful, pending, failed, cancelled, refunded, reversed, or disputed. A payment-return screen by itself may not be treated as final confirmation.

6. How We Share Information

We do not sell your personal data.

We may share personal data as described below.

6.1 Venue operators

We may share information with the venue connected to your booking, including:

• your name and contact number;
• booking date, time, duration, sport, court, and booking reference;
• QR-code verification information;
• payment, advance, and outstanding-balance status;
• relevant notes or requests;
• cancellation, no-show, and refund status; and
• information required to investigate a booking or payment dispute.

Venue operators should not receive your full card details from Sportynix.

6.2 Payment providers and financial institutions

We may share information with PayHere, banks, card networks, mobile-wallet providers, and other payment participants to:

• process and verify payments;
• issue refunds;
• reconcile venue payments;
• investigate failed, pending, duplicate, or incorrect payments;
• prevent fraud and unauthorised transactions;
• respond to disputes and chargebacks; and
• comply with financial, legal, or regulatory requirements.

6.3 Teams, organisers, and other users

Where required by a Sportynix feature, we may share information with:

• team members and team administrators;
• challenge participants;
• league or tournament organisers;
• scorers, co-administrators, and authorised officials;
• message recipients; and
• users who view public profiles, teams, reviews, match results, standings, or competition information.

6.4 Service providers

We may use service providers for:

• cloud hosting, storage, and database services;
• authentication and identity services;
• push notifications;
• payment processing;
• maps and location services;
• email and communications;
• security, logging, monitoring, analytics, and crash reporting;
• media delivery;
• customer support; and
• app distribution.

These providers may include Microsoft Azure, Google, Apple, OneSignal, PayHere, mapping providers, app stores, and other vendors required to operate Sportynix.

Service providers are permitted to process information only for authorised purposes and subject to applicable contractual and legal obligations.

6.5 Legal, security, and safety reasons

We may disclose information where reasonably necessary to:

• comply with applicable law, a court order, or a lawful government request;
• protect the rights, property, security, or safety of Sportynix, users, venue staff, or the public;
• investigate fraud, abuse, security incidents, unlawful conduct, or payment disputes;
• establish, exercise, or defend legal claims; or
• enforce our agreements and policies.

6.6 Business transfers

If Webxkey or Sportynix is involved in a merger, acquisition, restructuring, financing, sale of assets, or transfer of business operations, relevant information may be transferred subject to appropriate confidentiality, security, and legal protections.

7. Data Security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data. These may include:

• encryption in transit using TLS/HTTPS;
• secure authentication and token-based session controls;
• password hashing;
• access controls and restricted administrative permissions;
• secure cloud and database configurations;
• payment-notification verification;
• logging, monitoring, and audit records;
• backups and recovery measures;
• security updates and vulnerability management; and
• limits on staff and service-provider access.

No internet transmission, application, or storage system can be guaranteed to be completely secure. You are responsible for keeping your password and device secure and must not share your password, PIN, payment one-time password, or card security code.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• providing Sportynix while your account is active;
• maintaining booking and payment histories;
• processing refunds and resolving complaints;
• reconciling venue payments;
• meeting accounting, tax, legal, regulatory, and audit obligations;
• detecting fraud and preventing repeated abuse;
• handling chargebacks, disputes, and legal claims; and
• enforcing our agreements.

Retention periods may differ depending on the category of information and the reason it is processed.

Messages already delivered to other users may remain available to those recipients. Temporary media, expired sessions, and unnecessary operational data may be removed according to our retention schedules.

Where possible, data retained after account deletion may be restricted, archived, anonymised, or de-identified.

9. Account Deletion

You may request account deletion through any available in-app account-deletion feature or by contacting Sportynix support.

After a valid deletion request:

• your account will be disabled or deleted;
• profile information will be deleted or de-identified where reasonably possible;
• public content may be removed or separated from your account;
• messages already delivered to other users may remain available to those recipients;
• booking, payment, refund, fraud-prevention, security, tax, accounting, and dispute records may be retained where reasonably necessary or legally required; and
• aggregated or non-identifiable information may be retained.

We may need to verify your identity before processing an access, correction, or deletion request.

10. Your Rights and Choices

Subject to applicable law, you may request to:

• access personal data we hold about you;
• correct inaccurate or incomplete information;
• update your profile and contact information;
• request deletion of your account and eligible personal data;
• withdraw consent for optional processing;
• object to or request restriction of certain processing;
• remove an available saved payment method;
• opt out of promotional communications;
• ask for information about how your data is used; and
• raise a privacy complaint.

Some information cannot be deleted immediately where it must be retained for payment records, fraud prevention, legal compliance, accounting, dispute resolution, or the rights of other users.

To exercise a privacy right, contact privacy@sportynix.com. We may request reasonable information to verify your identity and locate the relevant records.

11. App Permissions

Sportynix may request the following device permissions:

You can manage optional permissions through your device settings. Disabling a permission may prevent the related feature from working.

12. Push Notifications and Communications

Sportynix may use OneSignal or another service provider to deliver:

• booking confirmations and reminders;
• payment confirmations and payment-status updates;
• cancellation and refund notices;
• team, challenge, league, tournament, and message notifications;
• security and account notices; and
• promotional communications where permitted.

You may disable promotional or optional notifications through the app or device settings. Essential booking, payment, security, and account communications may still be sent through available channels where necessary to provide the service.

13. Cookies and Website Technologies

The Sportynix website may use cookies and similar technologies for:

• essential website functions;
• authentication and security;
• remembering preferences;
• performance and usage measurement; and
• fraud and abuse prevention.

You may manage cookies through your browser. Disabling essential cookies may affect website functionality.

14. Children’s Privacy

Sportynix is not intended for children under 13 years of age.

We do not knowingly collect personal data from children under 13. If we learn that a child under 13 has provided personal data, we will take reasonable steps to delete it.

A parent or guardian who believes a child has provided information should contact us at privacy@sportynix.com.

15. International Data Processing

Some service providers may process or store information outside Sri Lanka.

Where personal data is transferred internationally, we take reasonable steps to use reputable providers and appropriate contractual, organisational, and technical safeguards as required by applicable law.

16. Third-Party Links and Services

Sportynix may contain links to or integrations with third-party websites, payment services, maps, identity providers, app stores, or other services.

Those third parties process information according to their own terms and privacy policies. We encourage you to review their policies before providing information to them.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in Sportynix features, payment services, technology, legal requirements, or business practices.

Where changes are material, we may notify you through the app, website, email, push notification, or another appropriate method. The “Last Updated” date will be changed when the Policy is revised.

18. Contact Information

Sportynix is operated by:

Webxkey (Private) Limited Trading Name: Sportynix Company Registration Number: [insert registration number] Registered Address: [insert complete registered postal address] Business Telephone: [insert telephone number] Privacy Email: privacy@sportynix.com Support Email: support@sportynix.com

19. Related Policies

Please also review:

• Sportynix Terms of Service
• Sportynix Refund and Cancellation Policy