Privacy Policy

1. Who we are

Sportivo SA (Pty) Ltd, registration number 2018/314307/07 (the "Company", "we", "us" or "our"), is a private company registered in South Africa, with its registered office at Sportivo SA, De Villiers Avenue, Kenridge, Durbanville, 7550, Western Cape, South Africa.

We make available the website at https://www.sportivo.app, the admin portal, and any related media, mobile website or mobile application (collectively, the "Site"), through which we provide our sports management platform covering competition management, video and performance analysis, school sport and culture administration, club management and league management (the "Services").

Privacy contact: privacy@sportivo.app

Information Officer: Bart Jongsma, registered with the Information Regulator (South Africa).

This policy explains what personal information we process, why, who we share it with, and the rights you have. We have written it in plain language, with a short summary at the start of each section.

2. The two roles we play

In short: For our website and your dealings with us directly, we are responsible for your information. For information a school, club or league loads into the platform about its members, that organisation is responsible and we act on its instructions.

Sportivo processes personal information in two distinct capacities:

Under the UK and EU GDPR, "responsible party" corresponds to "controller" and "operator" to "processor".

3. Information we collect when you deal with us directly

In short: What you give us in forms and registration, billing details if you buy, and technical data collected automatically.

Enquiries and forms. When you submit a form — to set up a competition, request a trial, get a coding licence, send us a match for analysis, book a demo or request a sample report — we collect the details you provide, such as name, email, mobile number, organisation, role, sport and the content of your request, and which page the form came from. We also record the page the form was on, the campaign tags in the link you followed (for example from an email or advert), the website that referred you, and whether you asked to receive marketing. We email you an acknowledgement with your reference. If you include details of players or learners, such as names in a squad list or a match description, section 6 applies.

Accounts. When you register we collect your name, contact details, profile information and login credentials, along with sport-related details such as the sports you play or coach, team history and age group.

Billing. If you buy from us we collect invoicing details — the name or entity to invoice, invoice email, VAT number and any purchase order reference. You can pay by EFT, Visa, Mastercard, PayPal or Wise. Card and online payments are processed directly by our payment providers — Peach Payments, Stripe, Wise and PayPal — and where we collect payments on an organisation’s behalf we use Stripe and Peach Payments. We do not store your card number or security code. Ordering on our website does not take a payment. A website order is a request for an invoice: our accounts department emails the invoice, quoting your order reference, and you pay it by one of the methods above. Prices shown on the website are estimates, and the invoice confirms the amount. Each provider’s privacy policy is available on its website (see section 9).

Collected automatically. When you visit our website we keep a count of pages viewed and cookie choices, without cookies (section 15). If you accept analytics cookies, Google Analytics also collects device and browser type, approximate location and how you use the site (section 15). Our servers receive your IP address when your browser connects. On our website forms we use it only to prevent spam and abuse: it is immediately converted into a scrambled code that cannot be turned back into the address, and that code is deleted within 7 days. We do not store your IP address. In our mobile app this includes device identifiers and, if you enable them, push notification tokens; you can turn push notifications off in your device settings.

Sales and account growth. When you register, sign up, or enter a tournament or competition through the platform, we may use the contact and organisation details you provide to follow up with you and to tell you about Sportivo products and features that may be relevant, including upgrades and add-ons (upselling). We keep these details in our sales and customer-relationship system (Freshsales). We rely on our legitimate interest in developing our business, you can object at any time, and any email or SMS marketing follows section 8. We do not market to anyone we know to be under 18.

We may also receive information from a login provider if you choose to sign in through one.

4. Information organisations load into the platform

In short: Schools, clubs and leagues control the member information they put into Sportivo. We host and process it to run the platform for them, and — where our agreement with them allows — may tell platform users about additional Sportivo services.

Organisations using Sportivo may load personal information about their players, pupils, members, parents, coaches, officials and staff — rosters, selections, fixtures, results, statistics, attendance and contact details. The organisation is the responsible party for that information and must have a lawful basis for it, including any consent required from parents or guardians.

We process this information to provide the Services to that organisation, under a written operator agreement.

Telling users about other Sportivo services. Where our agreement with an organisation permits it, we may show that organisation’s platform users information about additional Sportivo products and services within the app. We do this in-app and in the context of a service they already use. Any electronic direct marketing sent to an individual (for example a separate email or SMS campaign) is sent only with that individual’s own consent under section 8, and we do not direct marketing at users we know to be under 18.

When a person deals with us directly. Where someone interacts with Sportivo directly through the platform — for example a coach who signs up or enters a tournament themselves — we may also hold their contact details as our own sales contact and follow up with them, as described in section 3. Where a coach’s or member’s details reached us because an organisation loaded them, we use those details for Sportivo’s own sales only where our agreement with that organisation and the individual’s own consent allow it.

5. Match footage and analysis

In short: Footage is used to produce your analysis, and — only with your written permission — in Sportivo’s own sales demonstrations. It is stored for 12 months after your report is delivered, or for as long as a footage storage subscription is active if that is longer, and then archived. You can ask us to delete it sooner.

When you send us match footage (by link or upload), we process it to produce the coaching and performance analysis you have requested. Footage often shows identifiable people, including players under 18. Our commitments:

• We use footage to produce the analysis and reporting you request.
• With your specific written permission, we may also use your footage in Sportivo’s own sales demonstrations of the platform — for that purpose only. Without that permission we do not use your footage for demonstrations, and in no case do we publish it, post it publicly, or use it in public marketing or advertising.
• The person submitting footage confirms they are authorised by their team, club or school to share it, and that where players under 18 appear, the necessary consent from a parent or legal guardian is held by the school or club.
• Footage and the analysis derived from it are stored for 12 months from delivery of the related report, as part of the analysis service, and are then archived. Where the organisation holds an active footage storage subscription, they are kept for as long as that subscription remains active. Footage is deleted earlier on written request to privacy@sportivo.app.

Where footage is submitted by or on behalf of an organisation, the organisation is the responsible party for the personal information in it and Sportivo acts as operator (section 2).

6. Children’s information

In short: Under South African law anyone under 18 is a child, and processing a child’s information requires a parent or guardian’s consent. Children reach Sportivo through the coach, school, club or tournament organiser responsible for their participation, which obtains that consent through its own registration process and confirms it to us. We never market to children.

Much of what makes school and youth sport work involves information about children — team lists, results, statistics and footage. POPIA (sections 34–35) treats everyone under 18 as a child and prohibits processing a child’s personal information unless a competent person — a parent or legal guardian — has consented, or another legal ground applies. Under the EU GDPR, the age at which a child may consent to an online service for themselves is set by each member state at between 13 and 16; in the UK it is 13. Our approach:

• Invited users. Children’s information most often reaches Sportivo through the school, club, coach or tournament organiser who registers or invites them. That organisation is the responsible party for its members’ information. It obtains the required parent or guardian consent through its own registration process — including consent to the publication of team lists and results on public competition pages — and confirms this to us when inviting or approving each player under 18. A child activating their profile through an invitation acts within that consent; no separate parental step is needed in the app.
• Direct registration. Where a person signs up directly, without an invitation, we ask for a date of birth. We do not allow direct self-registration under 13. Below the applicable age — 18 in South Africa, 16 in the EU, 13 in the UK, 16 elsewhere — we ask for a parent or guardian’s email and activate the account only once the parent or guardian has confirmed consent. We keep a record of that confirmation.
• Public competition pages. Fixtures, results and standings can be viewed without an account. Where these pages name players under 18, that publication is covered by the consent the organising body holds, and organisations can choose to display reduced names for any player.
• Our website forms are for adults acting for a school, club, league, team or tournament. If you include a player’s or learner’s details in a form — for example names in a squad list or a match description — you confirm that you are authorised by that organisation to share them and that the organisation holds the consent of a parent or legal guardian for any player under 18. We use those details only to respond to your request or provide the service you ask for, never for marketing, and they follow the same retention as the enquiry (section 11).
• Marketing. We do not market to children, do not profile them, and do not sell their information.
• A parent or guardian with questions about a child’s information should contact the school or club first, or reach us at privacy@sportivo.app.

7. How we use information, and our legal grounds

In short: To respond to you, run the Services, bill, keep things secure and meet legal duties — and, only with your permission, to send marketing.

We do not sell personal information, and we do not use it for third-party advertising. Where we rely on legitimate interests, we have weighed those interests against your rights, and you may object at any time (section 12).

8. Direct marketing

In short: Electronic marketing is opt-in, separate from anything else you agree to, and every message has a working unsubscribe.

We only send electronic marketing where you have opted in through a separate, unticked checkbox, or where you have bought or ordered from us, the message concerns similar products or services, and you were given a clear chance to decline when we collected your details (on our website order form, by unticking the box). Every marketing message includes a working unsubscribe. This follows section 69 of POPIA and the equivalent UK and EU rules. We do not send marketing to users we know to be under 18. Opting out of marketing does not affect service messages about your account or an active request.

9. Who we share information with

In short: Service providers who help us run Sportivo under contract, professional advisers, and authorities where the law requires. Nobody receives your information for their own marketing.

We share personal information with:

• Service providers (operators / processors) who host and support the Services under written contracts restricting them to our instructions: cloud hosting (Microsoft Azure), video storage for match footage and website videos (Vimeo), authentication (Google Firebase), sales and customer-relationship management (Freshsales), accounting (Zoho), email delivery (Twilio SendGrid), payment processing (Peach Payments, Stripe, Wise and PayPal) and analytics (section 15).

Payment providers’ privacy policies: Stripe — stripe.com/privacy; PayPal — paypal.com (privacy hub); Wise — wise.com/privacy-policy; Peach Payments — peachpayments.com.

Professional advisers — lawyers, auditors and insurers — where necessary.

• Authorities and courts, where we are legally required to disclose.
• A buyer or successor, if Sportivo is involved in a merger, acquisition or sale of assets — in which case this policy continues to apply.

Anything you post in public areas of the Services can be seen by other users. Please think before posting personal information there.

10. Where your information is hosted, and international transfers

In short: The platform is hosted in the Netherlands, with authentication in Germany — both inside the EU. Match footage and website videos are stored by Vimeo in the United States, under the EU-U.S. Data Privacy Framework. Where information moves between South Africa and the EU, equivalent protection travels with it.

The Services are hosted on Microsoft Azure in the West Europe region (the Netherlands). Authentication is provided by Google Firebase in the EU (Germany). Sportivo is a South African company, so information moves between South Africa and the European Union in the normal course of running the Services. For visitors in the UK and EEA, this means their information is held within the EU, except match footage and website videos, which are stored in the United States (see below).

Two kinds of transfer arise. First, personal information of South African users is hosted in the EU; POPIA (section 72) permits this because our providers are bound by written contracts requiring protection substantially similar to POPIA, and because it is necessary to provide the Services. Second, because Sportivo operates from South Africa, personal information of UK and EEA users may be accessed from South Africa. South Africa does not have a UK or EU adequacy decision, so these transfers rely on Standard Contractual Clauses (for the EU) and the International Data Transfer Addendum (for the UK), which are included in our agreements with the relevant providers.

Match footage and website videos are stored by Vimeo in the United States. Vimeo is certified under the EU-U.S. Data Privacy Framework and its UK Extension, which the European Commission and the UK recognise as providing adequate protection for personal information transferred to certified US companies.

11. How long we keep information

In short: We keep information while your account or relationship with us is active. When you close your account or ask us to, we delete or anonymise it — except records we are legally required to keep.

Most information is kept for as long as our relationship with you is active, not on a fixed schedule. Some kinds have fixed periods:

• We keep information for as long as your account is open or our relationship with you is active, so that the Services keep working.
• When you close your account, or ask us to remove your information, we delete or anonymise it. Anonymised information no longer identifies you and may be kept for statistics.
• Match footage follows section 5 — stored for 12 months after the related report is delivered, or for as long as a storage subscription is active, then archived.
• We keep invoices and financial records for as long as South African tax and company law requires, even after an account is closed. This is a legal obligation we cannot waive on request.
• Enquiry and lead records are anonymised, and marketing contacts removed, after 36 months of inactivity.
• Website page-view records are deleted after 14 months (section 15).
• The scrambled codes we make from IP and email addresses to prevent form spam are deleted within 7 days.
• Records of cookie choices are kept for 36 months to show that consent was given or refused.
• Website orders are kept as financial records, like invoices.

Where immediate deletion is not possible — for example in backups — we isolate the information from any further use until it can be deleted.

12. Your rights

In short: Ask what we hold, get a copy, correct it, delete it, object, restrict, or take it elsewhere — by emailing privacy@sportivo.app.

Under POPIA — and, where they apply, the UK and EU GDPR — you can ask whether we hold information about you and request a copy; ask us to correct it; ask us to delete it, subject to any legal duty to retain it; object to processing based on legitimate interests and to direct marketing at any time; withdraw consent at any time (without affecting processing before withdrawal); and, where the GDPR applies, ask us to restrict processing or provide your information in a portable format.

To exercise any of these, email privacy@sportivo.app. We may need to verify your identity and will use that information only for that purpose. Where your request concerns information controlled by a school, club or league (sections 2, 4 and 5), we will coordinate with that organisation.

Our manual under the Promotion of Access to Information Act (PAIA) is available at sportivo.app/paia-manual.

13. Complaints

If you are unhappy with how we have handled your information, please contact us first — we would like the chance to put it right. You can also complain to the Information Regulator (South Africa) at inforegulator.org.za; the UK Information Commissioner’s Office at ico.org.uk if you are in the UK; or your local supervisory authority if you are in the EEA.

14. Security

In short: Appropriate technical and organisational measures, encryption in transit, restricted access — and honest limits.

We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, in line with section 19 of POPIA — including encryption in transit, access controls and due diligence on our providers. No system is perfectly secure, so please use a strong, unique password and tell us at privacy@sportivo.app if you suspect a problem. If a breach occurs that the law requires us to report, we will notify the Information Regulator and affected people as required.

15. Cookies and similar technologies

We use a small number of cookies on this website. Cookies are small text files stored on your device by your browser.

Strictly necessary cookies are required for the website to function and to remember your cookie choices. These are set by us, are first-party, and cannot be switched off.

Our own count of visits, without cookies. Separately from Google Analytics, our website sends a short record to our own server each time a page is viewed and each time you make a cookie choice. For a page view it records the page, the time, whether it was the first page of your visit and, for that first page only, the name of the website you came from (never the full address or any search terms). For a cookie choice it records what you chose, how you chose it (for example the Accept button), the time and the consent reference shown in your Cookie settings. A random number links the records made during one page load; it is created each time a page loads, is never stored on your device and cannot recognise you on a later visit. We do not record your IP address, your browser or device details, or anything you type. Because nothing is stored on or read from your device, this count runs whatever you choose in the cookie banner.

We do this under our legitimate interest in knowing how many people use the site and how many accept or decline analytics cookies (Article 6(1)(f) of the UK and EU GDPR, section 11(1)(f) of POPIA). Records of cookie choices also let us show that consent was given or refused, as Article 7(1) of the GDPR requires. Page-view records are deleted after 14 months. Because these records do not identify you, we usually cannot find yours if you ask; for your cookie-choice record, quote the consent reference shown in Cookie settings.

Analytics cookies are set by Google Analytics 4 and help us understand how visitors find and use the site so we can improve it. They record pages viewed, approximate location at city level, device and browser type, and referring source. Google Analytics does not store your IP address. We do not use Google’s advertising features, we do not share this data with Google for its own products and services, and we do not use it to build advertising profiles. Google Ireland Limited acts as our processor under Google’s Ads Data Processing Terms.

Analytics cookies are not set unless you accept them. When you first visit the site you are asked to choose. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer of every page. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it.

A full list of the cookies we use, what each one does and how long it lasts is in our Cookie Policy.

Our lawful basis for setting analytics cookies is your consent, under Article 6(1)(a) of the UK and EU GDPR and section 11(1)(a) of POPIA, and under Regulation 6 of PECR and Article 5(3) of the ePrivacy Directive.

16. Users outside South Africa

The Services are operated from South Africa and offered internationally. If you use them from the UK or EEA, the UK GDPR or EU GDPR applies to our processing as described here, and your information is hosted within the EU (section 10). We honour the rights in section 12 for everyone, wherever you are.

17. United States — state privacy rights

In short: US residents have the right to know, access, correct and delete their information, and to opt out of any sale or sharing — which we do not do.

If you are a resident of a US state with a consumer privacy law — including California (CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas and others — you have the right to know what personal information we collect and why, to access and receive a copy of it, to correct it, to delete it, and to opt out of the "sale" or "sharing" of personal information and of targeted advertising.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising, so there is nothing to opt out of on that front. We do not use or disclose sensitive personal information beyond the purposes permitted by these laws. You may exercise any of these rights, without discrimination, by emailing privacy@sportivo.app; you may use an authorised agent, and we will verify requests as the law allows.

18. Changes to this policy

We will update this policy when our practices or the law change. The "Last updated" date will change only when the policy has actually been reviewed. For material changes we will give notice on the website, or by email to account holders, before the changes take effect.

19. Contact

Sportivo SA (Pty) Ltd · Sportivo SA, De Villiers Avenue, Kenridge, Durbanville, 7550, Western Cape, South Africa · privacy@sportivo.app · Information Officer: Bart Jongsma