Legal · Privacy

Privacy Policy

Altus Performance Platform · Last updated 30 September 2026

1. Information We Collect

We collect the following categories of personal information:

• Identity information: Full names, email addresses, and role designations of coaching and administrative staff.
• Athlete information: Names, age groups, team assignments, physical performance test results, attendance records, training session check-ins, and optional profile photographs of student athletes.
• Player and parent account information: Email addresses, names, and grade information provided when creating a player portal account, and the link between an account and its athlete record.
• Notification data: Browser push-notification subscription tokens for users who opt in to receive alerts (including safety alerts).
• Authentication data: Email addresses and encrypted password credentials for staff accounts.
• Usage data: Interaction logs, session timestamps, and platform activity for security and audit purposes.
• Device information: Browser type, device type, and IP address for security monitoring.

2. How We Use Your Information

We process personal information for the following lawful purposes:

• Providing and maintaining the Altus Performance platform and its features.
• Managing athlete performance records, attendance, and team administration.
• Facilitating secure coach and staff access to the platform.
• Communicating updates, notifications, and service-related communications.
• Complying with legal obligations under South African law.
• Improving platform functionality and user experience.

3. Legal Basis for Processing

We process personal information on the basis of contractual necessity (to provide the platform to our licensed clients), legitimate interests (to maintain platform security and improve our services), and compliance with legal obligations under POPIA and other applicable South African legislation. Where we process the personal information of minors (athletes under the age of 18) on behalf of a licensed school, we do so under the authority of that school institution and in accordance with the school's data governance policies; the school is responsible for obtaining any consent required from a competent person (parent or guardian) as contemplated in section 35 of POPIA. Where a minor registers a player account directly, that registration and continued use must occur with the knowledge and consent of a parent or guardian, and we process the associated information on the basis of that consent.

4. Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share data in the following limited circumstances:

• Licenced schools: Authorised staff at the client school institution access data within the scope of their role.
• Service providers: We use Supabase (database and authentication, EU-based servers) and Vercel (hosting infrastructure). These providers are bound by appropriate data processing agreements.
• Legal requirements: We may disclose information where required by law, court order, or regulatory authority.

Cross-border transfers: Platform data is hosted on Supabase infrastructure located in the European Union (Ireland). This constitutes a transfer of personal information outside the Republic of South Africa as contemplated in section 72 of POPIA. Such transfers occur only to jurisdictions whose laws provide an adequate level of protection substantially similar to POPIA (including the EU General Data Protection Regulation), and are governed by binding data processing agreements with our providers.

5. Data Retention

We retain personal information for the duration of the active licence agreement with the client institution, and for a period of up to 12 months thereafter to facilitate transitions or resolve disputes. Upon expiry of the retention period or written request from the client institution, personal information will be permanently deleted from our systems.

6. Security

We implement industry-standard security measures including encryption of data at rest (AES-256) and in transit (TLS 1.2+), hashed credential storage, database-level row security policies, role-based access control, signed access tokens, rate limiting, audit logging of sensitive records, and regular security reviews. While we take all reasonable precautions, no system is entirely immune to security risks. We will notify affected parties of any material data breach in accordance with POPIA requirements.

7. Your Rights Under POPIA

As a data subject, you have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or outdated information.
• Object to the processing of your personal information.
• Request deletion of your personal information, subject to legal retention obligations.
• Lodge a complaint with the Information Regulator of South Africa.

8. Children's Privacy

Most athletes on the platform are minors, and we treat their information with heightened care. School-entered athlete information is processed solely on behalf of and under the authority of the licensed school institution, which is responsible for obtaining competent person (parent or guardian) consent where required by section 35 of POPIA. Player accounts created directly by minors require the knowledge and consent of a parent or guardian. Profile photographs are optional, uploaded by the athlete or their family, and may be removed at any time. Parents or guardians wishing to exercise rights in respect of their child's personal information may contact their school's designated platform administrator, or contact us directly using the details below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to licenced client institutions in advance. Continued use of the platform following notification of changes constitutes acceptance of the updated policy.

10. Contact