Privacy Policy

1.1Data Protection Legislation regulates the manner in which Personal Information may be Processed by Athlete Connect. The concept of Processing is broad, and includes any operation or activity concerning the collection, receipt, storage, updating, use, distribution and destruction of Personal Information.

1.2Athlete Connect is required to ensure that it Processes Personal Information in compliance with the conditions for lawful Processing set out in POPIA when it Processes Personal Information.

1.3In order to ensure that Athlete Connect fulfils its obligations under applicable Data Protection Legislation, including POPIA, this Policy sets out how Athlete Connect (and other persons Processing Personal Information on Athlete Connect SA's behalf) must collect, store, update, destroy and otherwise Process Personal Information.

2.1All Employees are responsible for ensuring that they comply with this Guideline and that they implement appropriate practices, processes and controls to ensure compliance.

2.2All Data Subjects (as defined by POPIA) consent to the processing and/or storage of their personal information and special personal information (where applicable) in accordance with the provisions of this policy, which aligns to the provisions of POPIA.

3.1Athlete Connect adheres to the conditions relating to the Processing of Personal Information set out in POPIA, which require that Personal Information is:

• 3.1.1Processed lawfully, in a reasonable manner, and given the purpose for which it is Processed, it is adequate, relevant and not excessive (Processing Limitation);

• 3.1.2collected with the Data Subject's knowledge of the purpose for which their Personal Information is collected (Purpose Specification);

• 3.1.3Processed in a manner compatible with the purpose for which it was originally collected (Further Processing Limitation);

• 3.1.4complete, accurate, not misleading and updated where necessary (Information Quality);

• 3.1.5not Processed in a manner that is obscured from the Data Subject (Openness);

• 3.1.6protected by appropriate and reasonable technical and organisational security measures (Security Safeguards); and

• 3.1.7accessible to the Data Subject (Data Subject Participation).

3.2Athlete Connect is responsible for and must be able to demonstrate compliance with the data protection conditions listed above (Accountability).

3.3Accordingly, Athlete Connect must ensure that it adheres to the conditions of lawful Processing.

4.1POPIA restricts the manner in which a person may Process Personal Information. Processing must be adequate, relevant and not excessive given the purpose for which the Personal Information is Processed. These restrictions are not intended to prevent Processing, but to ensure that Athlete Connect Processes Personal Information lawfully and in a reasonable manner that does not infringe the privacy of the Data Subject.

4.2Processing is allowed under specific circumstances, some of which are set out below:

• 4.2.1the Data Subject Consents to the Processing;

• 4.2.2Processing is necessary to carry out actions for the conclusion or performance of a contract to which the Data Subject is party;

• 4.2.3Processing complies with an obligation imposed by law on the Responsible Party;

• 4.2.4Processing protects a legitimate interest of the Data Subject;

• 4.2.5Processing is necessary for the proper performance of a public law duty by a public body; and

• 4.2.6Processing is necessary for pursuing the legitimate interests of the Responsible Party or of a third party to whom the information is supplied.

4.3Athlete Connect and Athlete Connect's Employees must identify and document the legal ground being relied on for each Processing activity.

4.4Athlete Connect may only Process Personal Information when performing its job duties, subject to the other requirements set out in this paragraph 4 being complied with. Athlete Connect cannot Process Personal Information for any reason unrelated to its business activities.

4.5Athlete Connect may not collect excessive Personal Information. It will ensure that any Personal Information collected is adequate and relevant for the intended purposes.

4.6You must ensure that when Personal Information is no longer needed for specified purposes, it is deleted or de-identified (anonymised).

4.7A Data Subject Consents to the Processing of their Personal Information if they indicate agreement either by a statement or positive action to the Processing. Consent requires affirmative action so silence, pre-ticked boxes or inactivity are insufficient.

4.8Data Subjects must be easily able to withdraw Consent to Processing at any time and withdrawal must be promptly honoured. Consent may need to be refreshed if you intend to Process Personal Information for a different and incompatible purpose which was not disclosed when the Data Subject first Consented.

4.9Athlete Connect will need to evidence Consent captured and keep records of all Consents (both given and withdrawn by a Data Subject) so that Athlete Connect can demonstrate compliance with Consent requirements.

4.10Before Athlete Connect processes Special Personal Information, it must ensure that it can identify the lawful basis for Processing such information. For example, Processing of Special Personal Information can take place if:

• 4.10.1Processing is carried out with the Consent of a Data Subject;

• 4.10.2Processing is necessary for the establishment, exercise, or defence of a right or obligation in law;

• 4.10.3Processing is necessary to comply with an obligation of international public law;

• 4.10.4Processing is for historical, statistical or research purposes to the extent that the purpose serves a public interest and the Processing is necessary for the purpose concerned; or it appears to be impossible or would involve a disproportionate effort to ask for Consent, and sufficient guarantees are provided for to ensure that the Processing does not adversely affect the individual privacy of the Data Subject to a disproportionate extent;

• 4.10.5information has deliberately been made public by the Data Subject; or

• 4.10.6the specific authorisation requirements set out in POPIA are complied with, if the information relates to a Data Subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, criminal behaviour, or biometric information.

5.1Athlete Connect may only collect, store, update, destroy, or otherwise Process Personal Information for specified purposes related to Athlete Connect's functions.

5.2Athlete Connect will need to ensure that the Data Subject is aware of the purpose for which Athlete Connect is collecting Personal Information. Athlete Connect may only Process Personal Information for the purpose known by the Data Subject and not for any incompatible purpose.

5.3Athlete Connect cannot use Personal Information for new, different or incompatible purposes from those disclosed to the Data Subject when the Personal Information was first obtained unless Athlete Connect has informed the Data Subject of the new purposes and they have Consented, where necessary.

5.4Personal Information must not be retained any longer than is necessary for achieving the specific purpose for which it was collected.

6.1Any further Processing of Personal Information is compatible with the purpose for which it was originally collected.

6.2To establish whether further Processing is compatible with the purpose of collection, consider:

• 6.2.1the nature of the information concerned;

• 6.2.2the manner in which the information has been collected;

• 6.2.3the relationship between the purpose of the intended further Processing and the purpose for which the information was originally collected;

• 6.2.4the consequences of the intended further Processing for the Data Subject; and

• 6.2.5any contractual rights and obligations between the Data Subject and Athlete Connect SA.

6.3Athlete Connect cannot use Personal Information for new, different or incompatible purposes from that disclosed when it was first collected unless they have informed the Data Subject of the new purposes and they have Consented where necessary. Where Consent is relied on as a basis for the further Processing, such Consent must be recorded and retained as proof and basis for the further Processing.

6.4Should Athlete Connect SA wish to Process Personal Information for a different or incompatible purpose (to the original purpose), consult the Information Officer.

7.1Personal Information must be complete, accurate and not misleading, and kept up to date. It must be corrected or deleted without delay when inaccurate.

7.2Athlete Connect will, where necessary, and taking into consideration the purpose for which the Personal Information was collected, take reasonable steps to ensure that the Personal Information Athlete Connect holds and uses is complete, accurate, not misleading and is updated.

8.1Athlete Connect must take reasonably practicable steps to ensure the Data Subject is aware of various matters related to the collection of Personal Information, including, but not limited to:

• 8.1.1the type of Personal Information collected and the source from which it is collected;

• 8.1.2Athlete Connect's details (name and address);

• 8.1.3the purpose for which the Personal Information is collected;

• 8.1.4whether the supply of the Personal Information is voluntary or mandatory;

• 8.1.5the consequences for failing to provide the Personal Information;

• 8.1.6any law, including Data Protection Legislation, which requires the collection of the Personal Information;

• 8.1.7whether Athlete Connect intends to transfer the Personal Information to another country and the level of protection afforded to that Personal Information in that country;

• 8.1.8the recipients of the Personal Information;

• 8.1.9the Data Subject's right to access, rectify, or object to the collection or Processing of the Personal Information; and

• 8.1.10the right to lodge a complaint with the appropriate Regulator.

8.2Whenever Athlete Connect collects Personal Information directly from Data Subjects, Athlete Connect SA must provide the Data Subject with all the aforementioned information. This information must be presented when the Data Subject first provides the Personal Information; this can be done by providing the Data Subject with Athlete Connect's Privacy Policy. In relation to Personal Information which is obtained for employment purposes, the aforementioned information will be provided prior to or at the commencement of the employment relationship.

8.3When Personal Information is collected indirectly (for example, from a third party or publicly available source), Athlete Connect must provide the Data Subject with all the above information as soon as reasonably possible after collecting or receiving the information. Athlete Connect must also check that the Personal Information was collected by the third party in accordance with applicable Data Protection Legislation and on a basis which contemplates Athlete Connect SA's proposed Processing of that Personal Information.

8.4Athlete Connect must maintain documentation of all Processing operations in sufficient detail to facilitate a request for access to the Records of Processing operations.

8.5Athlete Connect must keep and maintain accurate corporate Records reflecting Athlete Connect SA's Processing including Records of Data Subjects' Consents and procedures for obtaining Consents.

8.6If Athlete Connect has used a Record of Personal Information to make a decision about a Data Subject, then that Record must be retained in accordance with Athlete Connect SA's Record Retention Policy.

9.1Protecting Personal Information:

• 9.1.1Appropriate and reasonable technical and organisational measures must be taken to secure the integrity and confidentiality of Personal Information to prevent the loss of, damage to, unauthorised destruction of and unlawful access to, or Processing of Personal Information.

• 9.1.2Athlete Connect will endeavour to identify all reasonably foreseeable internal and external risks to the security of Personal Information in Athlete Connect SA's possession or under its control. Athlete Connect SA will develop, implement and maintain safeguards appropriate to its size, scope and business, available resources, the amount of Personal Information that it owns or maintains on behalf of others and identified risks, and will regularly evaluate and test the effectiveness of those safeguards.

• 9.1.3Athlete Connect must adhere to the security measures imposed against unlawful or unauthorised Processing of Personal Information and against the accidental loss of, or damage to, Personal Information. Athlete Connect SA will exercise particular care in protecting Special Personal Information from loss and unauthorised access, use or disclosure.

• 9.1.4Athlete Connect will follow all procedures and measures which it puts in place to maintain the security of all Personal Information from the point of collection to the point of destruction. It may only transfer Personal Information to third-party service providers (Operators) who agree to comply with Data Protection Legislation and who agree to put adequate measures in place, as requested.

• 9.1.5It must maintain data security by protecting the confidentiality and integrity of the Personal Information, bearing in mind that confidentiality means that only people who have a need to know and are authorised to use the Personal Information can access it; and integrity means that Personal Information is protected against loss, damage or unauthorised destruction.

• 9.1.6It must comply with, and not attempt to circumvent, the administrative, operational, physical and technical safeguards and standards that Athlete Connect SA implements and maintains to protect Personal Information.

• 9.1.7Anyone who Processes Personal Information on behalf of Athlete Connect is required to Process Personal Information only with the knowledge or authorisation of Athlete Connect, and to treat Personal Information which comes to their knowledge as confidential. Athlete Connect is required to conclude a written agreement with all third parties who Process Personal Information on our behalf.

9.2Reporting a Personal Information breach: Athlete Connect will follow the data breach policies it implements for this purpose.

10.1Data Subjects have rights when it comes to how Athlete Connect handles their Personal Information. These include the right to:

• 10.1.1be notified that Personal Information is being collected;

• 10.1.2be notified of a Personal Information breach;

• 10.1.3access Personal Information held by Athlete Connect;

• 10.1.4request the correction, destruction or deletion of Personal Information;

• 10.1.5object to Processing;

• 10.1.6restrict Athlete Connect's Processing of the Data Subject's Personal Information;

• 10.1.7object to direct marketing;

• 10.1.8request that Athlete Connect transfers their Personal Information to a third party in an easily accessible format;

• 10.1.9object to automated decision making; and

• 10.1.10submit a complaint to the appropriate Regulator.

10.2Athlete Connect SA must verify the identity of an individual making a request under any of the rights listed above (do not allow third parties to persuade you into disclosing Personal Information without proper authorisation).

10.3Athlete Connect SA must immediately forward any external Data Subject requests to the Information Officer.

11.1Special Personal Information includes:

• 11.1.1the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a Data Subject; and

• 11.1.2the criminal behaviour of a Data Subject to the extent that such information relates to the alleged commission of any offence by a Data Subject, or any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings.

11.2Special Personal Information may only be Processed:

• 11.2.1with the Consent of the Data Subject;

• 11.2.2if Processing is necessary for the establishment, exercise or defence of a right or obligation in law;

• 11.2.3if Processing is necessary to comply with an obligation of international public law;

• 11.2.4if Processing is for historical, statistical or research purposes to the extent that the purpose serves a public interest and the Processing is necessary for the purpose concerned; or it appears to be impossible or would involve a disproportionate effort to ask for Consent, and sufficient guarantees are provided for to ensure that the Processing does not adversely affect the individual privacy of the Data Subject to a disproportionate extent;

• 11.2.5information has deliberately been made public by the Data Subject; or

• 11.2.6the authorisation requirements set out in POPIA apply.

11.3It is Athlete Connect SA's policy to keep the Processing of Special Personal Information to a minimum and for as short a period as is practical. Instances where Athlete Connect SA Processes this type of information include, for example, as part of employment related background checks, in which case Special Personal Information must be Processed with the explicit Consent of the Data Subject.

11.4If in doubt about whether You are permitted to Process Special Personal Information, consult the Information Officer.

12.1Athlete Connect may in certain instances Process Personal Information of children (people under the age of 18 years) including in the course of providing services to Athlete Connect clients or as part of employee administration. In such cases, the Processing of Personal Information of children is conducted with the Consent of a competent person or to comply with an obligation in law.

12.2Athlete Connect will not knowingly collect Personal Information of children without express Consent to do so or without a legal obligation to do so.

12.3For any questions in respect of the Processing of Personal Information of children, consult the Information Officer.

13.1Athlete Connect is responsible for, and must be able to demonstrate, compliance with the conditions of lawful Processing of Personal Information. In this regard, Athlete Connect is required to have adequate resources and controls in place to ensure and to document compliance including:

• 13.1.1appointing a suitably qualified Information Officer accountable for data privacy;

• 13.1.2integrating the conditions of lawful Processing into internal documents including this Policy and all other Data Protection Policies and Guidelines;

• 13.1.3regularly training Athlete Connect Employees on Data Protection Legislation, this Policy, other Data Protection Policies and Guidelines and data protection matters including, for example, Data Subjects' rights, Consent, the conditions of lawful Processing, and Personal Information breaches; and

• 13.1.4regularly testing the privacy measures implemented and conducting periodic reviews and audits to assess compliance, including using results of testing to demonstrate compliance improvement effort.

14.1We keep this Guideline under regular review. In the event that there are material changes to Data Protection Legislation or other applicable laws or if Athlete Connect wishes to enhance any aspect of this Guideline, amendments will be made as necessary.

14.2This Guideline does not override any applicable Data Protection Legislation.