Privacy Policy
Version 2.0 · Effective [18.10.2026] · Replaces version 1.1 (21 September 2026)
This policy covers every part of the Nines at Nine Android app: signing in, applying, the face check, the jury, the feed, Friday nights, payments, chats and your account. Version 2.0 replaces version 1.1, which described a list and an application only.
In one paragraph. We collect what we need to check that you are a real adult who looks like your photos, to let members choose who they would rather meet, to run Friday nights, and to keep people safe. We ask before we use your face. Didit runs that check; we do not keep a face template, and we do not record a date. We never sell your data and never show anyone a score. Other members see your first name, age, photos and your 9, never your surname or email. We delete things on a fixed schedule, set out below. You can see, correct, download or delete your data from Settings or by writing to one address.
1. Who is responsible
TechVortex Ventures Private Limited (CIN U62013WB2024PTC269470), 3A, 38N, New Santoshpur Main Road, Kolkata 700075, West Bengal, India, decides why and how your personal data is processed in the club. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), we are the Data Fiduciary and you are the Data Principal.
The person who answers questions about your data, and our Grievance Officer, is Nilabja Datta, at admin@ninesatnine.com.
2. What this policy covers, and what it does not
This policy covers personal data we process through the Nines at Nine Android app and public pages, the face check, the jury, the feed, Friday nights, chats, payments, support and the messages we send. It applies to:
- visitors to our pages;
- applicants and members;
- friends who back an applicant;
- anyone who raises a grievance or writes to us.
Words such as "member", "the jury" and "Friday's list" mean what our Terms of Use say they mean. This policy is part of those terms.
It does not cover:
- what other members do with information you choose to share with them, for example in a chat or after you meet (section 9);
- how Google handles data under your own Google or Google Play account, which Google's policies govern;
- information that has been made anonymous so that it no longer identifies anyone, which the DPDP Act does not cover.
The DPDP Rules phase in between November 2025 and May 2027. We follow this policy from the day the club opens, whether or not a particular rule has commenced.
3. What we collect
We collect personal data only at the stage where it is needed.
| When | What we collect |
|---|---|
| You visit our pages | If you allow analytics, Google Analytics records usage events on the app, including the campaign or link that brought you. Your IP address and device type |
| You sign in | Your Google account ID, with the email and first name Google shares, verified through Firebase Authentication |
| You apply | First name, date of birth, gender, who you want to meet (non-binary applicants only), city, your age band (worked out from your date of birth), 1 to 3 photos, your 9 (category, prompt and answer), your consents with the notice version and time, and, if you choose, how you heard about us. An email address if you signed in with your number only |
| You are under 18 | Nothing about you. We keep only a keyed hash of the device ID for 24 hours, to stop the same device applying again straight away |
| A friend backs you | The friend's Google account, first name and the time. They sign in with Google on the vouch page |
| You take the face check | The result, the number of attempts (three at most), and the session id. Didit receives your profile photo, your member id and the live session (section 4) |
| We need a further check | Only in the cases in section 4: that the check was done, the document type, and the last four characters of the document number. Never an image of the document |
| You use the jury | The pairs shown to you and the choice you made in each, how long you took, and any "I know this person" marks. From everyone's choices, an internal standing for each member within their 9s category (section 7) |
| You use the feed | Your posts, the theme they answer, and reports you make or receive |
| You book a Friday | Whether you were invited, held a seat or were on standby; the Google Play product, purchase token and status; refunds; your ticket. We never see or store your card number, CVV, UPI PIN, bank login or Google Play password |
| You attend a night | Check-in and device test results (camera, microphone, connection quality), when you joined and left, dropped connections, which dates you had, your answers after each date (Conversation, Chemistry, Respect, Meet again), mutual yeses, game picks and reports. No video, audio or transcript |
| You chat | Messages between you and each mutual yes, held by Agora for us; closing and blocking; messages you choose to send us with a report |
| You run your account | Notification and quiet-hour settings, your push subscription, delivery records for the messages we send you, blocks, strikes and appeals, data download and deletion requests, and the optional reason you give for leaving |
| You write to us or complain | Your name, email, what you tell us, and our replies; the grievance reference and outcome |
| Others tell us about you | Choices other members make about you on the jury, answers your date partners give about you, reports made about you, and friends who back you. You never see these, except your backers' first names |
| Our team reviews your account | Notes our team records about decisions, reviews, reports and actions taken, with the reason |
| Automatically, throughout | Server and security logs (IP address, device, time, action). If you allow analytics, Google Analytics receives usage events tied to your member id. Those events can include that a step happened and your Meet again choice. They do not include your name, email, photos or chats |
What we do not collect. We do not ask for your caste, religion, political views, health, sexual history, income, bank details or Aadhaar number, and we do not keep a faceprint. Please do not put any of these in your 9, a feed post, a chat or a message to us. If you do, you choose to share them, and we may delete them.
4. Your face, your photos and identity documents
Images of your face are the most sensitive thing we handle, so they have their own rules.
- Photos. Your photos are stored privately and shown only through links that expire after 15 minutes. Each copy shown to another member carries a faint watermark with that member's own code. We remove location and all other hidden data from every photo when you upload it. Photos are never indexed by search engines and never used in marketing without your separate written consent. The one exception to "never public": if you share your backing link, your first photo, watermarked "Shared with you", is shown to whoever opens it, without signing in. A person on our team reviews the photo you upload. We do not send it to a separate company for automatic screening.
- The face check. Didit checks that you are live and compares you with your profile photo. We send Didit that photo and your member id, and you complete the session in Didit's flow. We keep the outcome and the number of attempts. We do not keep the live session or a face template.
- No faceprint. We do not create, keep or share a faceprint, face template or any other biometric identifier that could recognise you elsewhere.
- Identity and age documents. We ask to see a document only when we have reason to suspect impersonation, a person under 18, fraud or a safety risk, or when a law or lawful authority requires it. A person on our team looks at it. We record only that the check was done, the document type and the last four characters of its number, and we do not keep an image of it. We never ask for your Aadhaar number; if you show an Aadhaar card, it must be masked so that only the last four digits show. We do not send the document to Didit.
- Live video. Video and audio on a date travel through Agora in real time, encrypted, and are never recorded or stored by us. Cloud recording is switched off for our account. Chat messages are stored by Agora until they are deleted.
- Withdrawing. You can withdraw your consent to the face check at any time. Your membership then ends, because we cannot show you to other members or seat you on a Friday without it, and we delete the face-check results.
5. Why we use it
The DPDP Act allows processing on your consent (section 6) or for a legitimate use listed in section 7, which includes personal data you gave voluntarily for a purpose and complying with a law or a lawful order. Section 17 also allows processing needed to enforce legal rights and claims and to prevent, detect or investigate offences. Indian law has no general "legitimate interest" ground, so nearly everything we do runs on consent, and we say which.
| Purpose | Main data used | Ground |
|---|---|---|
| Create your account, sign you in, keep one person to one account | Google sign-in details and device ID | Consent at sign-in |
| Review your application | Basics, photos, your 9, backings | Consent ("Agree and continue" when you apply) |
| Show you to members on the jury, to date partners and in the feed | First name, age, photos, your 9, feed posts | Consent ("Agree and continue") |
| Check you are a live adult who resembles your photos; further checks | Face-check results, photos, document type and last four characters | Separate consent at the face check; legal obligations where a law requires a check |
| Run the jury and choose Friday's list | Jury choices, internal standings, answers you receive after dates | Consent ("Agree and continue", and before your first payment) |
| Book seats, take payment, give refunds and credits, issue invoices | Booking and payment records | Consent; legal obligations under tax and company law |
| Run Friday nights: the timetable, video, games, answers, mutual yeses and chats | Night data, chats | Consent before your first payment |
| Keep members safe: reports, investigations, moderation, strikes, removals, keeping removed people out | Reports, Respect answers, logs, account history, team notes | Consent ("Agree and continue"); legal obligations; section 17 for offences and legal claims |
| Record a friend's backing | The friend's Google account and first name | The friend's consent on the backing page |
| Answer grievances and requests | What you send us | Data you gave for that purpose (section 7(a)); legal obligations |
| Send service messages: decisions, booking, reminders, safety notices, rule reminders | Email and the push token on your phone | Data you gave for that purpose (section 7(a)); legal obligations |
| Send offers and news | Email, first name, city | Separate consent, off unless you turn it on. Sent through Amazon SES, not a separate marketing company |
| Understand how the club is used and improve it | Usage events and your member id, sent to Google Analytics | Consent (analytics choice) |
| Keep the club secure, keep the records the law requires, report incidents | Logs, device ID, IP address, sign-in details | Legal obligations (IT Rules 2021, CERT-In directions under the IT Act, DPDP Rules) |
| Answer police, courts and regulators; report harm to children; establish, use or defend legal claims | What the matter needs | Legal obligations; section 17 |
| Produce totals and anonymous statistics | Data made anonymous first | Anonymous data is outside the DPDP Act |
We do not use your personal data for a purpose not listed here without telling you and, where the law requires, asking you first.
6. Consent
When we ask
| Moment | What you agree to |
|---|---|
| First visit | Analytics (section 15). You can say no and still use the club |
| Signing in | Creating your account through Google |
| Applying ("Agree and continue") | Processing your profile to review it; showing you on the jury and in the feed; our terms. All three are listed on the screen above the button |
| Applying (separate switch, off) | Offers and news |
| The face check | The live selfie and comparison with your photos |
| Before your first payment | Video dates, your answers after each date, and their use in choosing future rooms |
| Backing a friend | Recording your backing, and showing your first name to the applicant |
Each time, we show a notice that stands on its own: the personal data, item by item; the purpose and what it enables; how to withdraw; how to use your rights; and how to complain to the Data Protection Board of India. You can ask for it in English or any language in the Eighth Schedule to the Constitution.
Withdrawing
Withdrawing is as easy as giving. Go to Settings, Privacy centre, where each consent has a Withdraw button that tells you first what will stop working. Every marketing email has a one-tap unsubscribe. You can also write to admin@ninesatnine.com.
- We stop the processing that depended on that consent within 24 hours, and tell our providers to do the same.
- We then erase that data, except what a law requires us to keep, what we need to establish, use or defend a legal claim, and what we need to keep a removed person out. We keep only that, only for as long as needed (section 11).
- Withdrawal does not undo processing already done lawfully, and does not entitle you to a refund of a seat already used.
- Where a consent is essential to a part of the club (for example the face check, showing you to members, or video dates), withdrawing it ends that part, or your membership, and we say so before you confirm.
Consent managers
From November 2026 the DPDP Rules let you give, manage and withdraw consent through a consent manager registered with the Data Protection Board. When we can support one, we will say so here.
7. How software helps decide
This is the part of the club where software helps decide something about you, so we explain it in full.
- Admission is decided by a person on our team. Software only orders applications for review. We do not send photos to a company that screens them automatically.
- The jury. Each choice a member makes between two people of the same 9s category counts as one person being preferred to the other. From many such choices, software keeps an internal standing for each member within their own category. Choices made too fast, choices on check pairs, and choices from members who do not vote honestly do not count. "Neither" changes nothing.
- Date answers. The Chemistry and Conversation answers your date partners give you are averaged over the last 45 days, once you have at least five dates with answers. Respect answers are never part of selection; they are used only to spot conduct problems.
- Friday's list. Each Sunday evening, software combines your standing within your category with your date answers, applies the eligibility rules in our terms, and proposes Friday's list. A person on our team reviews the proposed list and can change it. If the list has not been approved by the release time on Monday, the proposed list is released as it stands.
- Safety signals. Software flags patterns for our team to review, such as low Respect answers from two different partners, repeated dropped connections, unusual backings or unusual voting. A person decides any action against an account.
What we never show. Standings, date answers and anything derived from them are never shown to you, to any other member, or to anyone outside our team and the providers who host our data. There is no public score, rank, rating, percentile or leaderboard in the club, and there never will be. We do not tell anyone who chose them, who did not, or who answered what about them.
Accuracy and review. Section 8(3) of the DPDP Act requires the data we use to make a decision about you to be complete, accurate and consistent. You can correct your own details at any time. If you want to know whether a decision about you was made properly, write to admin@ninesatnine.com and a person will review it. We will tell you whether the rules were applied correctly, but we will not reveal other members' choices, answers or reports, or the details of how standings are calculated.
8. Who receives your data
We do not sell, rent or trade your personal data, and we do not share it for anyone's advertising.
Other members
| Who | What they see about you |
|---|---|
| Members of the other side on the jury | Your photos (watermarked with their code), first name, age and your 9 |
| Members reading the feed (both sides, your city) | Your post, first name and one photo |
| Your date partners on a Friday | Your photos, first name, age and your 9 at the start of the date; you, live on video; your game answers during games |
| A mutual yes | The same, and your chat with them |
| Anyone opening your backing link | Your first photo, first name, city and your 9 |
| An applicant you back | Your first name |
| Nobody | Your phone number, email, date of birth, standing, votes, the answers others gave about you, reports and strikes |
Our team and our providers
Our team sees only what their role needs, under confidentiality duties, and every action they take on a member is logged. Amazon, MongoDB, Agora and Didit process data for us under contract and may use it only for our purposes. Google also handles your sign-in, push, analytics and Play payment. Your own Google and Play accounts are governed by Google's policies.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Amazon Web Services | Photo storage and email, including offers if you agreed | Your photos, and the emails we send | India (Mumbai) |
| MongoDB | The member database | Account, profile, jury, booking, night and verification records | MongoDB Atlas, in the region of our cluster. Ask admin@ninesatnine.com for the current region |
| Google (Firebase Authentication) | Sign in with Google | Your sign-in token. We receive your Google ID, email and first name | Global |
| Google (Firebase Cloud Messaging) | Push notifications on the Android app | The device token and the short notification, for example that names are ready, check-in is open, or a chat opened | Global |
| Google (Firebase Analytics and Google Analytics) | Usage statistics, if you allow analytics | Usage events tied to your member id. An event can include your Meet again choice. Events do not include your name, email, photos or chats | Global |
| Google Play | Payments and refunds | The product, purchase token and your Play account. We receive the token and whether Play accepted it. We never see your card, UPI PIN or Play password | Global |
| Agora | Video dates and chats | Live audio and video in transit, which we do not store. Chat messages until they are deleted | Agora's network, which may be outside India, including to route a call |
| Didit | The face check | Your profile photo, your member id, and the live verification session | Didit's service (verification.didit.me), which may be outside India |
Others, only when needed
- Authorities. The police, courts, the Data Protection Board, CERT-In and other regulators or lawful authorities, when a law, order or valid request requires it, or to report suspected harm to a child or a serious offence. We check each request and, unless the law forbids it or it would put someone at risk, tell you.
- To protect people and the club. Where needed to prevent harm to a person, to investigate fraud or abuse, or to establish, use or defend a legal claim.
- Advisers and insurers. Lawyers, accountants, auditors and insurers, under confidentiality, where needed for their work.
- A buyer. If our business, or part of it, is sold, merged or restructured, under the same protections as this policy, with notice to you.
- At your request. Anyone you ask us to share with.
9. What you share with other members
When you show something to another member, on a date, in a chat, in the feed or after you meet, they see it, and we cannot control what they do with it.
- Our rules forbid members from recording, saving or sharing anything about another member, and the watermark helps us trace leaks. Browsers cannot block screenshots, so we cannot guarantee that nobody breaks the rule.
- Once you give someone your number, address or social media, or meet them, what they do with it is outside the club and outside this policy.
- Share only what you are comfortable sharing. If another member misuses your information, report it to us; we will act against their account and help you go to the police if you choose.
10. Where your data is stored, and transfers outside India
Photos and the emails we send are stored with Amazon Web Services in Mumbai. The member database is held by MongoDB Atlas. Chat messages are held by Agora, and usage statistics by Google Analytics. Google, Agora and Didit may process data outside India, for example to verify a sign-in, route a video call, deliver a push notification, or run the face check.
We transfer personal data outside India only to countries the Central Government has not restricted under section 16 of the DPDP Act, under contractual safeguards, and subject to any other Indian law that requires certain data or logs to stay in India. You can ask admin@ninesatnine.com for the current list of countries.
11. How long we keep it
We keep personal data only as long as its purpose needs, then delete it or make it anonymous. Automated jobs enforce these periods every night, and each run is logged.
| Data | How long |
|---|---|
| Video and audio of dates | Never stored |
| Face-check session | Held by Didit for the check. We keep the outcome and the attempt count, and we do not keep a face template or the live session |
| Device marker after an under-18 date of birth | 24 hours |
| Photos and your 9, if you are not admitted | 30 days from the decision |
| A friend's vouch | While your application is open, unless they ask us to delete it |
| Photos, your 9, face-check results and further-check records, while you are a member | Until you delete them or your account |
| Jury choices | 45 days |
| Answers after dates (Conversation, Chemistry, Respect, Meet again) | 45 days |
| Game answers | 30 days |
| Feed posts | Until you delete them (erased that night) or your account |
| Chats | 30 days after the chat is closed |
| Internal standings and selection records | While you are a member; deleted with your account |
| Records of mutual yeses | While both accounts exist |
| Account, booking and credit history | While your account exists |
| Your sign-in details (name, email) after you delete your account | 180 days, as the IT Rules require |
| Reports, investigations, team notes, strikes, suspensions and removals | 3 years from closing |
| What we need to keep a removed person out (a keyed hash of their Google ID and device ID, first name, date of birth and the reason) | 3 years from removal, or longer if a court or authority requires |
| Grievances and rights requests | 3 years from closing |
| Payment, invoice and tax records | 8 years, as tax and company law require |
| Server and security logs | 1 year (DPDP Rules), kept in India for at least the 180 days the CERT-In directions require |
| Messages from providers about delivery (webhooks) | 90 days |
| Delivery records of messages we sent you | 12 months |
| Usage events in Google Analytics (tied to your member id) | 12 months, or sooner if you turn analytics off and ask us to delete them |
| Backups | Overwritten within 30 days |
- When you delete your account, you have 7 days to change your mind. After that, everything tied to your account is deleted within 30 days, except what this table or the law requires us to keep, and only for that period.
- Inactive accounts. If you do not sign in for 24 months, we may close your account after telling you 30 days before, and then delete it as above.
- Legal holds. If data is needed for an investigation, a legal claim, or an order of a court or authority, we keep it until that need ends, even beyond these periods.
- Totals. We keep totals for our own reports (for example, how many people attended a night). Totals contain no personal data.
12. How we protect it, and your part
What we do
- Encryption in transit (TLS) everywhere, and at rest for the database and photo storage.
- Photos in private storage, served only through links that expire after 15 minutes and carry the viewer's watermark.
- Video dates encrypted, with a separate encryption key and access token for every date that stop working when the date ends.
- Sign-in sessions that expire, refresh tokens that change on every use, and "Sign out everywhere" in Settings.
- Limits on how often sign-in, applications, payments and the face check can be tried.
- Our team signs in to the admin panel with named accounts and two-step verification, and sees only what their work needs. Every action they take on a member is logged with a reason in a record they cannot change.
- Logs and error reports have emails, names and free text removed before they are written.
- Automated deletion on the schedule in section 11.
- Backups, and a tested way to restore them so the club can keep working if data is lost.
- Written contracts and security terms with every provider, monitoring of our systems, and an outside security test before launch and periodically after.
Your part
Keep your phone locked and its software up to date, keep your Google account to yourself, sign out on shared devices, and tell us at once if you think someone has used your account. We will never ask for your card details, UPI PIN or Google Play password by message or call.
No system is perfectly secure. We promise reasonable safeguards and honest, prompt notice if something goes wrong. We are not responsible for loss caused by someone using your account because you shared your codes or did not secure your device.
13. Your rights
Under the DPDP Act you have the right to:
- Access: a summary of the personal data we hold about you, what we do with it, and the Data Fiduciaries and processors we have shared it with.
- Correction, completion and updating of anything inaccurate, incomplete or out of date.
- Erasure of your personal data, unless a law requires us to keep it or we need it for a purpose this policy allows (section 11).
- Withdraw consent at any time (section 6).
- Nominate one or more people to use these rights for you if you die or cannot act.
- Grievance redressal: to complain to us and have it dealt with, and then, if you are not satisfied, to complain to the Data Protection Board of India.
We also give you a copy of your data: choose Download my data in Settings and we email you a link to a file within 7 days. The link works for 7 days.
How to use them
Use Settings, Privacy centre in the app, or write to admin@ninesatnine.com from the email address on your account. That email address is the identifier we use to find your data. If we cannot confirm it is you, we ask for one further detail and nothing more than we need. A nominee must show the nomination and proof of death or incapacity.
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 72 hours |
| Answer | Within 30 days |
| Complex requests | Once, by up to 30 more days; we tell you why before the first 30 days end. Never longer than the 90 days the DPDP Rules allow |
| Charge | None |
| Limits | We may refuse or limit a request where the law allows, and tell you why. In particular, we will not reveal another person's personal data, including other members' jury choices, their answers about you, or who reported you; we will not undo processing done lawfully before a request; and we may keep data under a legal hold (section 11). |
Complaints about content, conduct or how the club is run follow the faster route in section 31 of the Terms of Use: acknowledged within 24 hours and resolved within 7 days.
Your duties
Section 15 of the DPDP Act requires you not to impersonate anyone when giving us personal data, not to hide material information, not to register a false or frivolous complaint with us or the Board, and to give only verifiably true information when asking for a correction. Breaking these duties can lead to a penalty of up to ₹10,000 under the DPDP Act, as well as action under our terms.
14. Breaches and security incidents
If a personal data breach happens, we follow Rule 7 of the DPDP Rules:
- We tell you without delay, in plain words: what happened, what data was involved, what it could mean for you, what we are doing about it, what you can do to protect yourself, and whom to contact.
- We tell the Data Protection Board of India without delay, and send it a full report within 72 hours of becoming aware, or any longer period the Board allows: what happened, the likely effects, what we did, and whom we told.
- We report cyber security incidents to CERT-In within the 6 hours its directions under the Information Technology Act, 2000 require.
We will not wait until we understand everything before telling you. An early, partial account is more use to you than a complete one a week later. We keep a record of every breach and incident, and what we did about it.
15. Storage on your phone
The Android app keeps a small number of things on your phone. We do not use advertising cookies.
| What | What for | How long | Can you refuse? |
|---|---|---|---|
| Firebase Authentication | Keeps you signed in with Google | Until you sign out | No, if you want to stay signed in |
| Firebase Cloud Messaging token | Lets us send push notifications | Until you sign out or the token is replaced | You can turn notifications off in the phone settings |
| Google Analytics | Counts how the app is used, tied to your member id | While analytics is on | Yes. Collection stays off until you accept, and you can turn it off in Settings |
| Google Play | The purchase you make in the app | As Google Play keeps it on your account | No, if you want to pay for a seat |
| An unfinished application | Your name, photo and note, so you can resume | Until you finish or clear the app's storage | Yes. It stays on this phone only |
Google's sign-in and Google Play also store data under your Google account, under Google's policies.
16. Messages and marketing
- Service messages (decisions, bookings, reminders, safety notices, rule reminders) are sent by email, by push notification, or in the app, on the grounds in section 5.
- Offers and news are email only, and only if you turned them on. They stop as soon as you turn them off or unsubscribe. We never buy or rent contact lists, and we never send marketing to friends who backed you. Those emails go through Amazon SES.
- Our messages never include photos, surnames, chat content, or anything about votes. A Meet again choice is not put in an email or a push. It can appear in a Google Analytics event if analytics is on (section 8).
17. AI, research and statistics
- We do not use your photos, your 9, your chats, your feed posts, your date answers or anything said on a date to train any AI model, ours or anyone else's, and our contracts do not allow our providers to do so. If this ever changes, we will ask for your consent first.
- The face check uses Didit to compare your live session with your profile photo (section 4). It does not produce a faceprint that we keep. We do not send photos to a separate company for automatic screening.
- We may use data made anonymous, so that it no longer identifies anyone, to produce statistics, improve the club and report on how it works. Anonymous data is not personal data.
18. No one under 18
The club is for adults only. We do not knowingly collect personal data from anyone under 18, and we do not seek a parent's consent because we do not allow minors at all. If the date of birth you enter is under 18, we stop at once and store nothing about you except the 24-hour device marker in section 3. The face check and our further checks also help us spot minors. If we learn that someone under 18 has given us data, we suspend the account, delete the data except what we must keep to report or prevent harm, and report to the authorities where the law requires. If you think a minor is using the club, tell us at admin@ninesatnine.com.
19. Changes to this policy
We may update this policy, for example when the club, the law or our providers change. The current version is always in the app with its effective date, and earlier versions are available on request. Before a material change takes effect we tell you in the app or by email, and where the law requires it we ask for your consent again rather than assume it.
20. Complaints
Write first to our Grievance Officer:
- Name
- Nilabja Datta
- Address
- 3A, 38N, New Santoshpur Main Road, Kolkata 700075, West Bengal, India
Under section 13 of the DPDP Act, you must use our grievance process before going to the Board. If you are not satisfied with our answer, you can complain to the Data Protection Board of India through the means it publishes.
21. If you are outside India
Nines at Nine is offered in India. We do not market it in the European Economic Area, the United Kingdom or Switzerland, price in their currencies, or track anyone's behaviour there, so the GDPR and UK GDPR do not ordinarily apply to us. If you join from there anyway, we hold ourselves to the same standard: you also have the rights to restrict and object to processing and to receive your data in a portable form; we answer within one month (extendable once by two months, with reasons); our ground is your explicit consent, including for photos and the face check; you may complain to your local data protection authority; and you can ask us which countries your data is processed in. India has no EU adequacy decision. If we start offering the club in those places, we will appoint a representative and name them here first.
This policy is written to be understood. If any part is unclear, write to admin@ninesatnine.com and we will explain it.