Privacy Policy
1. Who we are
The Talent ID service is operated by Talent ID LLC (name pending registration), established in Ukraine, the responsible party. Information Officer: privacy@talent-id.org. We process the personal information of data subjects in South Africa in line with the Protection of Personal Information Act 4 of 2013 (POPIA); before launch we will register our Information Officer with the Information Regulator (section 55) and publish a manual under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), which explains how to request access to records we hold.
2. What data we process
Adult users: name, email, mobile number, role, organisation, settings, sign-in logs; if you sign in with Google — the name and email from your Google account (we never receive your Google password); a log of account use (which sections were opened — without their content).
Children (players): name, date of birth, team, anthropometry (height, weight), test results, coach ratings, medical clearance and check-up dates, wellbeing (a daily check-in, including whether something hurts), recommendations from the coach or the academy doctor (without diagnoses), psychological test results (only with separate parental consent), attendance and training load, readings from the club's sports devices (distance, speed, heart rate during training), tags on training and match videos (only with separate parental consent). A child's data is entered by the club or the parents; parents of a child without a club may keep a short profile themselves (year and quarter of birth, city, height, weight, 30 m sprint, preferred foot).
We do not process: medical documents, diagnoses, photos of children in profiles, biometrics for identification.
Technical: IP address, device type, cookies (see the Cookie Policy).
Wellbeing and clearance data are health information — special personal information under POPIA (section 26) — and are processed only with the consent of a parent or guardian (section 27(1)(a)).
3. Purposes and legal bases
Providing the service under a contract with an academy, club or school; consent of a competent person (a parent or guardian) — for children's information and for each separate profile disclosure; legitimate interest — security and abuse prevention; legal obligations — accounting and lawful requests from authorities. Justification under section 11 of POPIA; for children's information — section 35; for special personal information — section 27. We collect only the information that is adequate, relevant and not excessive for these purposes (section 10). As the operator is established outside South Africa, the Law of Ukraine «On Personal Data Protection» (No. 2297-VI) also applies to our processing.
4. Children's data
Children do not have their own accounts. The personal information of a child (a person under 18, as under the Children's Act 38 of 2005) is processed only with the prior consent of a competent person — a parent or guardian (POPIA, sections 34 and 35(1)(a)) — and we take reasonable steps to verify that consent. In every decision the best interests of the child come first (Children's Act, sections 7 and 9). Parents can see the child's data in their account and correct it, download a full copy at any time («My data») or withdraw consent. We do not use children's information for advertising and do not build advertising profiles. Selection decisions are made by the coach — the service only shows calculations; no decision with legal consequences or that substantially affects a person is based solely on automated processing (POPIA, section 71).
5. Who we share data with
Coaches and management of your organisation — within their role. Other clubs and academies — only with separate parental consent for each specific request. The South African Football Association (SAFA) or its regional or local football association — if your academy has connected the data exchange and registered the child: only full name, date of birth, academy and team, position, city and registration number (in return, official match reports are added to the profile); tests, health, family and contacts are not shared. Your academy's own systems via the open API (Elite package) — only if the academy's management has created an access key: full name, date of birth, team, position, measurements and attendance of that academy's players, read-only (health, wellbeing, family and contacts are not shared); the key can be revoked at any time, every request is logged (30 days). Anyone you yourself send a link to the child's development passport (created by parents only, valid for 7 days, can be revoked): full name, year of birth and age, position, academy and team, medical clearance status, attendance over 90 days, games and latest measurements — without contacts and without other children's data. A scout or club the academy sends a link to a playlist of video clips (only with the separate parental consent «Clips for scouts and clubs», up to 30 days, parents are notified, can be revoked): full name, year of birth, position and clips featuring the child; a clip plays from the match recording in the academy's video service, so the recipient can technically watch the whole recording. Advertisers — nothing except the number of parents (fewer than 20 is not shown). Operators under written contracts that require them to keep the information confidential and secure (POPIA, sections 20–21): hosting and database in the EU (Ireland, Supabase); content delivery, the «human, not a bot» check and storage of match files in the EU (Cloudflare); an email service; an SMS service for the phone verification code; Google — only if you choose to sign in with Google; a server that detects moments in match videos (Modal, USA) — it receives a match recording only for the time of the analysis and does not keep it; payment services — card data never reaches us. Authorities — only on a lawful basis.
6. Retention
Account — while it is active, and 30 days after a deletion request. Player data — while the child is at the club and up to 3 years after leaving, for the development history, unless the parents ask to delete it earlier. Original match recordings — 30 days (tags and clips — while the child is at the club). Website error log — 30 days. Account usage log and visit statistics — 13 months. Security logs — 12 months. Payment documents — for the periods required by tax law. Records are not kept longer than necessary for the purposes for which they were collected (POPIA, section 14).
7. Your rights
Under POPIA you have the right to be notified that information is being collected (section 18), to access your personal information (section 23), to request its correction or deletion (section 24), to object to processing (section 11(3)), to object to direct marketing (section 69), not to be subject to a decision based solely on automated processing (section 71), and to withdraw consent at any time without affecting the lawfulness of earlier processing. You can also download your data in a commonly used, machine-readable format. We reply to requests within 30 days; access requests can also be made under PAIA as set out in our manual. If you are not satisfied with our answer, you can lodge a complaint with the Information Regulator (inforegulator.org.za, POPIA section 74). You can also complain to the Ukrainian Parliament Commissioner for Human Rights. Most actions are available in your profile: «Language, theme and data».
8. Security
Encryption in transit and at rest, access separation at database level, two-factor sign-in with an authenticator app (available to everyone, recommended for academy management), review of new sign-ups by an administrator, access logs, daily backups, a security review before launch (POPIA, section 19). If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise (POPIA, section 22).
9. International transfers
Talent ID's database is hosted in the European Union (Ireland) and the operator is established in Ukraine, so your information is transferred outside South Africa — to Ireland and other EU countries, to Ukraine and, for video analysis and Google sign-in, to the USA. Transfers are made only in line with section 72 of POPIA: to recipients subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection — including the EU Standard Contractual Clauses and the EU's General Data Protection Regulation (GDPR), which applies to the hosting — or, where required, with your consent or because the transfer is necessary for the performance of the contract with you. Where POPIA requires prior authorisation from the Information Regulator for transferring children's information (section 57), we will obtain it before the transfer. We keep a record of the basis for each transfer.
10. Changes
We will announce material changes by email and in the service at least 14 days in advance.