Privacy Policy & POPIA Notice

1. Who we are

Pavillion (“the Platform”) is a school sport management service operated in South Africa. We process personal information in terms of the Protection of Personal Information Act, 4 of 2013 (“POPIA”).

2. Roles: your school is the responsible party

For learner, parent and staff information, the school is the “responsible party” under POPIA and the Platform acts as its “operator” (section 20–21). We process personal information only on the school's instructions, under a written operator agreement with mandated security safeguards. For account information of the person who signs the school up, we are the responsible party.

3. What we process

• Learners: name, date of birth, gender, grade, school admission number, sport registrations, team memberships, match and practice records, achievements, coach comments, and optionally a school email address for login.
• Parents/guardians: name, contact details, relationship to the learner.
• Staff: name, contact details, role.
• Technical: authentication records and error logs needed to run the service securely.

We do not sell personal information, use it for advertising, or process it for any purpose other than providing the service.

4. Children's information (section 34–35)

Most learners are children under POPIA. The school, as responsible party, obtains consent from a competent person (parent or guardian) or relies on another lawful ground before capturing a learner on the Platform. Our agreements require this, and we provide schools with template consent wording.

5. Security safeguards (section 19)

• Row-level security: each school's data is isolated at the database layer.
• Encryption in transit (TLS) and at rest.
• Role-based access: parents see only their own children; coaches see only their teams.
• Access logging and error monitoring.

6. Breach notification (section 22)

If we become aware of unauthorised access to personal information we will notify the affected school(s) without undue delay so that the Information Regulator and affected data subjects can be notified as required.

7. Hosting and cross-border transfers (section 72)

Data is hosted on secure cloud infrastructure. Where hosting is outside South Africa, transfers happen only to jurisdictions and providers offering an adequate level of protection by law or binding agreement. South African hosting is available on request for schools that require it.

8. Retention and deletion

We retain personal information for as long as the school's agreement is active, or as the school instructs. On termination, the school receives an export of its data and we delete it, including from backups on their normal rotation (30 days). See Data deletion.

9. Your rights

Data subjects (or a competent person on a child's behalf) may request access to, correction of, or deletion of personal information. Requests go to the school in the first instance (as responsible party); we support and give effect to every such instruction. You may also lodge a complaint with the Information Regulator of South Africa.

10. Contact

Privacy queries: raise a support ticket in the app, or write to the contact address on your school's agreement. Our Information Officer's details are provided in the operator agreement.