Privacy and cookie notice
This notice explains how AIO Holdings (Pty) Ltd, trading as ClubAIO, processes personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA). It covers our website, our demo and sign-up forms, and the ClubAIO service used by clubs, their staff and their players.
Who is responsible
For our own purposes, such as running our website, answering enquiries, managing customer relationships, billing and securing our systems, AIO Holdings (Pty) Ltd is the responsible party. Contact our Information Officer, Damian D’Oliveira, at hi@clubaio.com or 1 Roslyn Road, Rondebosch, Cape Town, 7700, South Africa.
For club records, such as staff rosters, sales, memberships, player profiles and event entries, your club is the responsible party and we are its operator. We process that information only on the club’s instructions, under a written agreement. Your club’s own privacy notice explains its purposes. If you contact us about club records, we will pass your request to the club and help it respond.
What we collect and why
Name, email, phone, club name, city, number of courts, Playtomic link and your answers on the demo form
- Source
- You
- Purpose
- To respond to your request, prepare and give a demo, and, if you ask, set up your club’s account
- Lawful basis
- Steps you asked for before a contract; our legitimate interest in answering enquiries
Account details: name, email, phone, role, club, permissions and sign-in records
- Source
- You, or the club that invites you
- Purpose
- To create your account, sign you in and control what you can access
- Lawful basis
- Performance of a contract; the club’s instructions
Club records: rosters, attendance, sales, stock, cash-ups, memberships, player profiles, bookings, events and uploaded photos
- Source
- Your club, its users and the services it connects (Playtomic, Xero)
- Purpose
- To provide the service to the club
- Lawful basis
- The club’s lawful basis, on whose behalf we act
Billing contacts, invoices and payments
- Source
- The club
- Purpose
- To invoice for and administer subscriptions
- Lawful basis
- Performance of a contract; legal obligations under tax law
Technical data: IP address, browser and device type, pages requested, errors and email delivery status
- Source
- Your device and our service providers
- Purpose
- To operate, secure and troubleshoot the service and measure website use in aggregate
- Lawful basis
- Our legitimate interest in a secure, working service
Correspondence and support requests
- Source
- You
- Purpose
- To help you and keep a record of what was agreed
- Lawful basis
- Performance of a contract; legitimate interest
What you must provide
You do not have to give us information, but we need your name and email address to answer a demo request or create an account, and a club needs basic staff and member details to use ClubAIO. No law requires you to give us information on our website forms. Optional fields are marked as optional.
What we do not do
- We do not sell personal information, or use it for third-party advertising.
- We do not use club records to train artificial intelligence models.
- We do not send direct marketing without your consent, or, for existing customers, without giving you an easy way to opt out in every message, as section 69 of POPIA requires.
- We do not make decisions about you based solely on automated processing.
- We do not collect card numbers. Clubs take card payments through their own providers.
Processing outside South Africa
Our service providers store and process information on servers outside South Africa, including in the European Union and the United States. Under section 72 of POPIA, we transfer personal information across borders only where the recipient is bound by law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA, or where another ground in section 72 applies, such as the transfer being necessary to perform a contract with you.
If you use ClubAIO from outside South Africa, your information is processed in South Africa and in the locations above. Where the law of your country, such as the EU or UK General Data Protection Regulation, gives you rights in addition to those described here and applies to our processing, we will honour them. Contact us at hi@clubaio.com.
How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, or as the law requires.
- Demo requests that do not lead to an account: up to 24 months after our last contact, then deleted.
- Accounts and club records: for as long as the club subscribes. When a subscription ends, we provide an export on request and delete the club’s data from the live service no earlier than 30 days later, as our terms describe.
- Invoices and accounting records: 5 years from the date of submission of the relevant tax return, as section 29 of the Tax Administration Act 28 of 2011 requires, and longer where the Companies Act requires.
- Technical and security logs: for the limited period our providers retain them, usually no more than 90 days.
- Backups are overwritten in the ordinary course of rotation.
Within the service, photos attached to resolved maintenance requests and checklist comments are scheduled for removal 30 days later. Cash-up and petty-cash evidence photos are kept for 7 years, so clubs can support their financial records.
How we protect it
As section 19 of POPIA requires, we take appropriate, reasonable technical and organisational measures to protect personal information. They include encryption in transit, database rules that keep each club’s records separate and limit each user to the permissions their club grants, restricted and logged administrative access, managed hosting with regular backups, and code review before changes reach the live service.
No system is completely secure. If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where the club is the responsible party, the club, as section 22 of POPIA requires, and affected people where we are responsible for doing so.
Your rights
Under POPIA you may:
- ask whether we hold personal information about you, free of charge, and request a copy of it and a list of those who have had access to it;
- ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent where we rely on it, without affecting processing that took place before;
- complain to the Information Regulator.
Email hi@clubaio.com. We will respond within 30 days, and may ask you to confirm your identity first. For requests about records your club controls, we will refer you to the club and help it respond. Our PAIA & POPIA manual describes the formal request process.
The Information Regulator (South Africa): inforegulator.org.za/complaints · enquiries@inforegulator.org.za · 010 023 5200. You do not have to contact us first.
Children
Our website and club administration features are intended for adults. Where a club registers players under 18 in its player portal, the club is responsible for obtaining the consent of a competent person, such as a parent or guardian, as section 35 of POPIA requires. We do not knowingly collect children’s information for our own purposes.
Changes to this notice
We will update this notice when our processing changes, and show the new effective date at the top. If a change materially affects you, we will tell club account owners by email before it takes effect. Earlier versions are available on request. This notice describes our practices as POPIA requires. It does not create contractual rights or obligations beyond those in our terms of service, a signed agreement, and the law.