Legal

1. Overview

This Privacy Policy explains how iBall processes personal data in compliance with the Kenya Data Protection Act 2019 and principles of:

• - Lawfulness, fairness, transparency
• - Purpose limitation
• - Data minimization
• - Accuracy
• - Storage limitation
• - Integrity and confidentiality

2. Data Controller

iBall acts as a Data Controller for user accounts and a Data Processor / Joint Controller for school-submitted player data, depending on context.

3. Categories of Data Collected

a) Personal Data

• - Full name
• - School affiliation
• - Contact details (where applicable)

b) Player Performance Data

• - Statistics (points, assists, rebounds)
• - Physical attributes
• - Match history

c) Sensitive Considerations

While not typically collecting sensitive personal data, we treat minor data as high-risk and apply enhanced safeguards.

d) Technical Data

• - IP address
• - Device/browser data
• - Usage logs

4. Legal Basis for Processing

We process data based on:

• - Consent (especially for minors and profiles)
• - Legitimate interest (sports analytics, talent discovery)
• - Contractual necessity (user accounts)

5. Consent Framework

iBall implements:

• - Explicit opt-in consent for:
  • - Player profile creation
  • - Media uploads
• - Parental consent verification for minors:
  • - School certification OR
  • - Guardian email confirmation workflow
• - Granular consent controls:
  • - Public vs restricted profiles
  • - Media visibility toggles

Users can withdraw consent at any time.

6. Children's Data Protection

For minors:

Data must be submitted by:

• - Schools, coaches, or guardians

We provide:

• - Right to erasure upon request
• - Profile visibility controls

We do not knowingly exploit or monetize minor data

7. Purpose of Data Use

We use data to:

• - Display player profiles
• - Enable scouting and recruitment
• - Improve analytics and platform performance
• - Ensure safety and integrity

8. Data Sharing

We may share data with:

• - Schools and sports organizations
• - Verified scouts and recruiters
• - Service providers (cloud hosting, analytics)

We ensure:

• - Data Processing Agreements (DPAs)
• - Adequate safeguards for cross-border transfers

We do not sell personal data.

9. Cross-Border Data Transfers

Where data is transferred outside Kenya:

• - We ensure adequate safeguards
• - Transfers comply with Kenyan regulatory requirements

10. Data Retention

We retain data:

• - While accounts are active
• - As needed for historical sports records
• - Until deletion is requested or legally required

11. Data Subject Rights (Kenya)

Users have the right to:

• - Access their personal data
• - Correct inaccurate data
• - Request deletion ("right to erasure")
• - Object to processing
• - Withdraw consent
• - Lodge complaints with the Office of the Data Protection Commissioner (ODPC)

12. Security Measures

We implement:

• - Access controls and authentication
• - Encryption (in transit where applicable)
• - Role-based data access
• - Audit logging