1. The Responsible Party
The responsible party determining the purpose and means of processing personal information on this platform is:
2. The Information Officer
In terms of Section 55(1) of POPIA and Section 17 of PAIA, the appointed Information Officer registered with the Information Regulator is:
IR-SA-REG-PENDING (Official Regulator Registration Pending)3. Personal Information We Collect
In accordance with POPIA's condition of minimality, we collect only the personal information strictly necessary for club operations and agreed services:
- Supporter Account & Auth: Full name, email address, contact telephone, password hash (bcrypt), login timestamps, IP addresses.
- Merchandise Purchases: Billing contact details, physical delivery street address for courier dispatch, order items, and payment references.
- Stadium & Venue Hire: Hirer full name, organization name, phone, email, estimated attendance, event date/time, and special logistics requirements.
- Drop Goal Bar & Dining: Customer name, mobile phone, order basket, table / collection number.
- Matchday Tickets: Purchaser name, email, allocated seat/tier, and cryptographically signed digital entry barcodes.
- Direct Bank Transfers (EFT): Uploaded proof of payment slips (which may contain bank account number and branch details).
4. Purpose Specification & Legal Basis
We process your personal information strictly under the lawful grounds outlined in Section 11(1) of POPIA:
Contract Performance (s11(1)(b))
To reserve facilities, fulfill merchandise orders, issue match passes, and confirm banking transactions.
Explicit Consent (s11(1)(a) & s69)
For account registration, matchday electronic marketing, and community youth rugby updates (opt-in only).
Legal Obligation (s11(1)(c))
Complying with the Tax Administration Act, VAT Act, and Companies Act for 5-year financial audit trails.
Legitimate Interests (s11(1)(d))
Stadium access security, incident prevention, fraud detection, and matchday crowd safety.
5. Special Personal Information & Children's Information
Under POPIA Part B and Part C (Sections 26 to 35):
- Children (Minors under 18): We do not knowingly process personal information of minors without the verifiable consent of a competent person (parent or legal guardian). For youth rugby festivals, junior clinics, or squad registration, written/digital guardian consent is mandatory. Minors' information is strictly excluded from all direct marketing.
- Health & Emergency Contacts: Player registrations and junior squad profiles collect emergency contact details and physical fitness disclosures solely for pitchside first-aid preparedness and union team sheet compliance. These fields are encrypted at rest.
6. Operators, Third Parties & Cross-Border Transfers
We share personal information strictly with verified service providers (Operators in terms of Section 20 & 21 of POPIA) under written data processing contracts:
- PayFast (Pty) Ltd / Network International: Hosted card and instant payment clearance.
- Courier Fulfillment Partners: Deliveries of club store merchandise.
- Transactional Email Dispatcher (SMTP/Mailtrap): Dispatching order receipts, ticket barcodes, and booking invoices.
- Banking Partner (First National Bank): EFT deposit settlement and verification.
7. Retention & Destruction Schedule
Under Section 14 of POPIA, personal information is not retained longer than necessary to achieve the purpose for which it was collected:
| Data Category | Retention Period | Statutory Justification / Action |
|---|---|---|
| Financial, Tax & Orders | 5 Years | SA Tax Administration Act / Companies Act |
| Inactive Supporter Accounts | 3 Years | Flagged for review or anonymization |
| Matchday Tickets & Passes | 3 Years | Event liability & gate reporting |
| Youth & Minor Player Records | 5 Years | Child safeguarding & union player history |
| Access & Audit Logs | 24 Months | Security monitoring & incident forensics |
8. Security Safeguards (POPIA s19)
We secure the integrity and confidentiality of personal information in our possession by taking appropriate, reasonable technical and organizational measures:
- Access Control: Strict Principle of Least Privilege and Role-Based Access Control (RBAC).
- Transport Security: Strict HTTPS with TLS 1.3 encryption and HSTS headers.
- Password Security: Passwords hashed using bcrypt with adaptive cost factors; rate-limiting against brute force.
- Database Hardening: Prepared statements for all queries, zero SQL injection surface, AES-256 field encryption for sensitive fields.
- Append-Only Audit Logs: Security audit logs recording all access, export, update, and deletion activities.
9. Your Data Subject Rights (30-Day SLA)
Under Chapter 3 of POPIA, you have the following rights regarding personal data held by Rugby Raiders:
10. Complaints to the Information Regulator
If you are not satisfied with our resolution of your request, or believe your personal information has been processed unlawfully, you have the right to lodge a complaint with the statutory Information Regulator of South Africa: