Privacy Policy | Sentinel Football Hub

1. Who We Are

Sentinel SportsTech (Pty) Ltd ("Sentinel", "we", "us") operates the Sentinel Football Hub platform, accessible at sentinel-football-hub.vercel.app and any future custom domain. We are the Responsible Party for personal information processed in connection with the platform.

We operate in two capacities depending on the data involved:

Data stream	Our role	What that means
Club-subscriber data (admin accounts, coach accounts, billing)	Responsible Party	We decide why and how this data is processed
Player and squad data uploaded by clubs	Operator (Processor)	We process this on the club's instruction; the club is the Responsible Party
Player analysis service customers (players who buy dossiers directly)	Responsible Party	We decide why and how this data is processed

Our designated Information Officer can be contacted at the details in Section 12. We are registering our Information Officer with the South African Information Regulator as required by POPIA Section 55.

2. Information We Collect

2.1 Club administrators and coaches

Full name, email address, contact number
Club name, club type (academy, private coaching)
Role within the club (admin, coach, viewer)
Subscription tier and billing contact information
Usage logs and feature interaction data

2.2 Player data entered by clubs

Player name, date of birth, position, squad number
Physical metrics (height, weight, fitness scores)
Match and training performance data
Attendance and session participation records
Notes, ratings, and coaching observations
Profile images uploaded by the club

2.3 Player analysis service customers

Player name, email address, age, position
Match footage submitted for analysis
Parent or guardian contact information (for players under 18)
Payment confirmation reference (no card details stored by us)

2.4 Automatically collected data

Browser type, device type, operating system
IP address (hashed for analytics, not stored in identifiable form)
Session tokens for authentication
Feature usage analytics (page visits, button interactions)

We do not collect payment card numbers, national identity numbers, passport numbers, or biometric data. Payments are processed by Paystack and governed by their privacy policy.

3. Why We Collect It (Lawful Basis)

POPIA requires us to have a lawful justification for every processing purpose. Our justifications are:

Purpose	Lawful basis (POPIA)
Providing the platform to club subscribers	Contractual necessity (s11(1)(b))
Processing club-uploaded player data	Operator instruction from the club (s21); club obtains consent from data subjects
Delivering player analysis reports	Contractual necessity (s11(1)(b)); parental consent for minors
Billing and subscription management	Contractual necessity; legal obligation (tax records)
Security and fraud prevention	Legitimate interest (s11(1)(f)); legal obligation
Platform improvement analytics	Legitimate interest (s11(1)(f)) — anonymised data only
Sending platform communications	Contractual necessity; opt-in consent for marketing

4. Minor Players (Under 18)

Special protection applies. POPIA Sections 34 and 35 impose strict requirements on the processing of personal information of children (persons under 18). This section applies to all player data where the player is a minor.

4.1 Club responsibility for minor player data

When a club enters minor players into the platform, the club (as the Responsible Party) is legally required to obtain consent from a "competent person" — meaning a parent, legal guardian, or person who has parental responsibility for the minor — before entering that player's personal information. By accepting our Terms of Service, clubs confirm they have obtained this consent for every minor player they add to the platform.

4.2 Player analysis service — minors

When a parent or guardian purchases a player analysis dossier for a player under 18, we require explicit consent from the parent or guardian at the time of purchase. This consent is recorded with the order. We do not accept direct orders from persons who are themselves under 18.

4.3 What we do with minor player data

We process it only on the club's instruction or the parent/guardian's instruction
We do not use minor player data for platform analytics or marketing
We do not share minor player data with third parties except as required to deliver the service (see Section 6)
We apply the same or stronger security standards to minor player data as to adult data

4.4 Retention of minor player data

Club-held minor player data is deleted when the club subscriber cancels their account and all data is purged, subject to any legal retention obligations. Analysis reports for minor players are retained for 12 months following delivery, then deleted.

5. How We Use Your Information

Platform operation: authenticating users, displaying squad data, generating reports, managing subscriptions
Communication: account activation emails, password resets, subscription confirmations, important platform notices
Analysis delivery: preparing and delivering player analysis dossiers for the player analysis service
Security: detecting and preventing unauthorised access, fraud, and abuse
Legal compliance: fulfilling obligations under POPIA, the Tax Administration Act, SARS requirements, and court orders if applicable
Platform improvement: using anonymised, aggregated analytics to improve features — we do not build individual behavioural profiles

We do not sell personal information to third parties. We do not use personal information for automated decision-making that produces legal effects on data subjects.

6. Who We Share Your Information With

Recipient	What is shared	Why
Supabase Inc (database & auth)	All platform data	Core infrastructure — encrypted in transit and at rest
Paystack	Billing contact details, transaction amount	Payment processing — we do not store card data
Vercel Inc	Static assets, page requests	Hosting and CDN delivery
PFSA-certified analysts (contracted)	Match footage and player info for analysis orders	Delivery of analysis service — under confidentiality agreement
South African Revenue Service	Billing and transaction records	Legal obligation under Tax Administration Act
Law enforcement / courts	As required by lawful order	Legal obligation — we will notify you unless prohibited

We require all service providers who process personal information on our behalf to agree to binding data processing agreements and to maintain security standards equivalent to our own.

7. Cross-Border Transfers

Our database infrastructure is hosted by Supabase on servers located in the European Union (eu-west-1). POPIA Section 72 restricts the transfer of personal information to recipients outside South Africa unless adequate protections are in place.

We rely on the following transfer mechanisms for EU-hosted infrastructure:

Contractual necessity and consent: By registering for and using the platform, you acknowledge that your data is hosted in the EU and provide informed consent for this transfer under POPIA s72(1)(b)(ii)
Equivalent protection: The European Union's GDPR (General Data Protection Regulation) imposes data protection obligations on Supabase that are equivalent to or stricter than POPIA requirements
Supabase DPA: We maintain a Data Processing Agreement with Supabase that governs how your data is processed and protected

Note: South Africa has not made a formal adequacy determination for the European Union under POPIA. We are monitoring developments with the Information Regulator and will update our transfer mechanisms as the regulatory framework evolves. We recommend that club subscribers with heightened data localisation requirements consult a qualified SA privacy attorney.

8. How Long We Keep Your Information

Data category	Retention period	Legal basis
Active club subscriber accounts	Duration of subscription	Contractual necessity
Player data in active club accounts	Duration of club subscription	Operator instruction
Data after account cancellation	30 days (then permanently deleted)	Reasonable period for recovery requests
Billing and transaction records	5 years from transaction date	Tax Administration Act; Companies Act
Analysis dossiers (player analysis service)	12 months from delivery	Reasonable service delivery period
Security logs (access, auth events)	12 months	Legitimate interest — fraud/security
Marketing consent records	3 years from last consent or withdrawal	Demonstrating compliance

When the retention period expires, personal information is securely deleted or anonymised so it can no longer be attributed to an individual.

9. Your Rights Under POPIA

POPIA grants the following rights to data subjects. These rights apply to personal information for which Sentinel is the Responsible Party. For club-uploaded player data, requests should be directed to the club in the first instance.

Right of access (s23): You may request confirmation of whether we hold your personal information and a copy of that information. We respond within 30 days, free of charge.
Right to correction or deletion (s24): You may request that we correct inaccurate, incomplete, or out-of-date personal information, or delete personal information we are no longer entitled to retain.
Right to object (s11(3)): You may object to the processing of your personal information on grounds relating to your particular situation where we rely on legitimate interest as our lawful basis.
Right to object to direct marketing (s69): You may object at any time to the processing of your personal information for direct marketing purposes, free of charge.
Right to complain: You may lodge a complaint with the South African Information Regulator (see Section 12).

To exercise any of these rights, send a written request to stokeswallerq@gmail.com (subject: "Data Rights Request") with sufficient information to identify yourself. We will respond within 30 days. We may request proof of identity before processing your request.

10. Cookies

We use a minimal set of cookies and browser storage. See our Cookie Policy for full details. In summary:

Essential: Supabase authentication tokens stored in browser local storage — required for the platform to function. Cannot be disabled.
Functional: Theme preference (dark/light mode) stored in local storage — no personal information.
Analytics: Anonymised usage data — no individually identifiable information. You can opt out via browser settings.

We do not use advertising cookies or third-party tracking cookies.

11. Security

We implement the following technical and organisational measures to protect personal information:

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
Authentication uses Supabase Auth with secure token management
Row-level security policies ensure each club can only access their own data
Access to production systems is restricted to authorised personnel only
We conduct regular security reviews of our codebase and infrastructure
File uploads are stored in access-controlled object storage with signed URLs

Data breach notification

In the event of a data breach that is likely to affect your rights, we will notify the South African Information Regulator via the eServices Portal (Form SCN1) within 72 hours of becoming aware of the breach, as required by POPIA and the April 2025 Information Regulator Guidance. We will notify affected data subjects as soon as reasonably practicable after notifying the Regulator.

12. Contact & Complaints

Information Officer

Quintin Stokes-Waller
Information Officer, Sentinel SportsTech (Pty) Ltd
Email: stokeswallerq@gmail.com (subject: "Privacy Request")
WhatsApp: Available via WhatsApp

General enquiries

Email: stokeswallerq@gmail.com
Registered in South Africa

Complaints — Information Regulator of South Africa

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator:

Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Changes to this policy

We may update this Privacy Policy from time to time. We will notify club subscribers by email and post a notice on the platform before material changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy. The "last updated" date at the top of this document will always reflect the most recent revision.