Privacy Policy

1. Who we are

This Privacy Policy explains how the Imarika Super Cup organising committee ("we", "us") collects and uses personal data through this website and when running the tournament. We are the data controller for this information, and we handle it in line with Kenya's Data Protection Act, 2019 and its regulations.

2. What we collect

Account holders (coaches and other users): name, username, email address, phone number, your role, and when you accepted our terms. Passwords are stored only in scrambled (hashed) form — we can never read them.

Players (entered by their coach): first and second name, date of birth, a birth certificate or passport, a profile photo, position, preferred foot, team and age category, match statistics (goals, assists, cards and so on), and whether a parent/guardian has consented to the player's photo being shown publicly.

Payments: the M-Pesa phone number, amount, payment reference, M-Pesa receipt number and payment status. We never receive or store M-Pesa PINs.

Messages: what you send us through the Contact form (your name, email address and message).

Technical information: your IP address and login attempts (used to block password-guessing attacks), and the essential cookies described below.

3. Children's information

Most players are under 18. We process a child's information only with the consent of their parent or legal guardian, which the coach confirms when registering the player, and only to run the tournament fairly and safely.

• Birth certificates and passports are stored privately. Only the authorised organisers and the player's own coach can open them, through secure, short-lived links.
• A player's date of birth is never shown publicly.
• The public website shows only a player's name, team, age category, position and match statistics.
• A player's photo is shown publicly only if their parent/guardian has consented. Otherwise we show their initials. Consent can be withdrawn at any time.
• Guests who are not signed in cannot browse squad lists.

4. How we use information, and why

We use personal data to:

• register and approve teams, coaches and players, and check age-category eligibility (to perform our agreement with you, and in our legitimate interest in a fair competition);
• schedule fixtures, record results and publish standings, leaderboards and the Imarika Index (legitimate interest);
• take and reconcile registration payments (to perform our agreement, and to meet accounting obligations);
• send account emails such as email verification, password resets, approvals and payment confirmations;
• answer messages you send us;
• keep the website and its users safe, including blocking repeated failed logins and keeping an audit trail of administrative actions (legitimate interest and legal obligation);
• publish players' photos, where a parent/guardian has consented (consent).

We do not use personal data for advertising, and we do not sell it.

5. Who we share it with

• Authorised organisers — only the committee roles that need it (for example, the Super Admins who approve players).
• Service providers who run parts of the service for us under contract: Safaricom (M-Pesa payments), our email delivery provider, and our cloud hosting and file-storage providers.
• Authorities, where the law requires it or a child's safety is at risk.

We never sell or rent personal data.

6. Where it is stored

Our website and files are hosted with cloud providers whose servers may be outside Kenya. Where data is transferred outside Kenya we rely on providers that apply appropriate security safeguards, as the Data Protection Act requires.

7. How long we keep it

• Identity documents are kept only as long as needed to verify eligibility for the editions a player takes part in, and are then deleted.
• Accounts are kept while they are in use. You can ask us to delete yours at any time.
• Payment records are kept for 5 years, as tax and accounting rules require.
• Results, match statistics and Imarika Index positions form the permanent history of the tournament and are kept, but a player's personal details can be removed or anonymised on request.
• Contact messages are kept for up to 12 months.

8. How we protect it

We use encrypted connections (HTTPS), private storage for identity documents, short-lived secure links to open them, role-based access for organisers, automatic lockout after repeated failed logins, and an audit log of administrative actions. No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the Office of the Data Protection Commissioner as the law requires.

9. Cookies

We use only essential cookies: one keeps you signed in, and one protects forms against forgery (CSRF). We do not use advertising or tracking cookies, so there is nothing to opt out of.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used;
• see the personal data we hold about you or your child;
• have incorrect data corrected;
• have data deleted where we no longer need it;
• object to how we use your data, and withdraw consent (for example, for a child's photo) at any time;
• receive your data in a portable format.

To use any of these rights, contact us through the Contact page. We will reply within the time the law allows. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed, and we will tell registered coaches about important changes by email.

12. Contact us

Questions or requests about your personal data? Send us a message through the Contact page. Please say which team or player your request is about, so we can help quickly.