POPIA privacy notice

This notice describes how PitchKit (operated by DigitalBits Pty Ltd, a South African private company) collects, uses, stores and shares the personal information of players, parents, guardians, coaches, referees and administrators who use the platform. It is written in plain English so that you can give meaningful, informed consent.

1. Who we are

The Responsible Party (in POPIA terms) is DigitalBits Pty Ltd, Midrand, Gauteng, South Africa. Each federation and club that operates a workspace on PitchKit is a Joint Responsible Party for the personal information of its own players, captured under their specific federation governance.

Our Information Officer is Jason Lovett (admin@digitalbits.co.za). We are registered with the Information Regulator under the Protection of Personal Information Act.

2. What personal information we collect

• Player: full name, South African ID number, date of birth, gender, position, jersey number, preferred foot, hometown, optional photograph.
• Guardian (for under-18 players): full name, relationship to player, contact phone, contact email, optionally the last four digits of their South African ID for audit only.
• Club admin / coach / referee: name, email, password (hashed using bcrypt, never stored in plain text), role assignment.
• Verification metadata: the provider used (e.g. XDS), the response code, the timestamp of the lookup. We do not retain the full HANIS response.
• Match data: appearances, goals, assists, cards, suspensions, referee reports. This is football activity data, generated as the season runs.

3. Why we collect it (purpose & lawful basis)

• Registration and eligibility — to verify the player is who they say they are, is the age they say they are, and is registered under the correct age category. Lawful basis: contract performance with the federation, and POPIA s.11(1)(a) consent.
• Disciplinary administration — to issue and track cards, suspensions and appeals. Lawful basis: legitimate interest of the federation.
• Match-day verification — for refs, opponents and scouts to verify identity by tapping the NFC card or scanning the QR. Only the public profile is shown.
• Pathway-to-pro — to publish the player’s consented public profile (name, photo, position, club, statistics) at /p/<handle>. Lawful basis: explicit, separately-ticked consent. Default off for adults; default on with guardian co-consent for minors.

4. Special data: South African ID numbers

SA ID numbers are special information under POPIA. We treat them accordingly:

• Stored encrypted at rest using AES-256-GCM (per-row data key, master key in the operator environment).
• Only the last four digits are ever displayed in any user interface.
• The full number is decrypted only when a federation admin explicitly runs a DHA verification or an eligibility check.
• Federation admins see ID numbers only inside their own federation. Cross-federation access is technically prevented.

5. Retention

Personal information is retained for as long as the player participates in a federation that runs on PitchKit, plus seven (7) years thereafter for disciplinary and audit reasons. After that, identifiers are erased; aggregate statistics may be kept (e.g. “1998-1999 season, 1,234 players”).

You may request earlier erasure at any time under section 24 of POPIA. See Privacy policy for the process.

6. Sharing

We share personal information with:

• The federation and clubs the player is registered with. (They are joint responsible parties.)
• The verification provider chosen by the federation (XDS, TransUnion or Experian) — only the ID, name and DOB necessary for the live lookup.
• The card production partner that prints and mails physical NFC cards — only name, jersey number, club crest and the activation code.

We do not sell personal information, share it for advertising, or hand it to third parties for marketing purposes. Ever.

7. Your rights

Under POPIA you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Object to processing in specific circumstances.
• Request erasure (section 24).
• Lodge a complaint with the Information Regulator (inforegulator.org.za).

To exercise any of these rights, contact our Information Officer at admin@digitalbits.co.za or submit a request via Privacy policy → Access & deletion.

8. Changes to this notice

If we materially change this notice we will publish a new version and notify all federation admins. The version and effective date are shown at the top of this page.