Privacy Policy

Zaroda Sports Management System (“Zaroda Sports”, “we”, “us”) is provided by Zaroda Solutions in Kenya. It helps schools, sports associations and tournament organisers (“organisers”) run championships: registration, call rooms, results, rankings and promotions.

We handle personal data in line with Kenya’s Data Protection Act, 2019 and its regulations.

Organisers decide what learner data to collect and why. When a school or organiser registers learners, team players or officials for a championship, the organiser is the data controller for that data and Zaroda Solutions is the data processor: we store and process it on the organiser’s instructions to run the championship.

We are the data controller for the accounts people create with us (name, email, phone), for subscription payments, and for messages sent through our contact form.

Account holders (organisers, tournament admins, officials and team managers): name, email address, phone number, organisation name and county, password (stored only as a one-way hash), and the roles you hold in each championship.

Learners and players, as entered by their school or organiser: name, gender, school, bib and shirt number, the events and teams they are entered in, their results, and - to confirm identity and age - their date of birth, birth certificate entry number and photo.

Payments: for subscriptions paid by M-Pesa through TUMA, the M-Pesa phone number, amount, M-Pesa receipt number and payment status. For team entry fees paid through Paystack, the payer’s email, the team’s details and the payment status. We never see or store card numbers or M-Pesa PINs.

Security and usage records: sign-in attempts (email, IP address, time, success), a record of changes made in the system (who changed what, and when), and IP addresses used for rate limiting.

Contact form messages: your name, email, optional phone number and message.

• To run championships: registration, entering learners in events, call-room checks, results, rankings, medal tables and promotion to higher levels.
• To stop learner impersonation and over-age entries, using photos, dates of birth and birth certificate numbers.
• To publish results the organiser has chosen to make public.
• To create and secure accounts, send account set-up links, and protect the service against misuse.
• To take and confirm payments, and issue receipts.
• To answer your messages and support requests.
• To understand how people find and use the site (see Cookies below).

We process account and payment data to perform our contract with you, and security records for our legitimate interest in keeping the service safe.

Learner data is processed on the organiser’s instructions. Organisers must have a lawful basis for it - for learners under 18, that normally means the consent of a parent or guardian as required by section 33 of the Data Protection Act - and must collect only what the championship needs.

Most learners are children, so their data gets extra protection:

• Photos, dates of birth and birth certificate numbers are never public. Only the championship’s officials, and a team manager for their own school’s learners, can see them. Photos are stored inside our database, not at public web addresses.
• Call-room officials cannot change a learner’s photo, so a photo can’t be swapped for whoever turns up.
• After registration closes, only the championship’s tournament admins can change learners’ details, and every change is recorded.
• Publicly, a learner appears only by name, school, bib number and results - and only once the organiser publishes the championship.

We do not sell personal data. We share it only as needed to run the service:

• The championship’s organiser and officials, according to their role.
• Higher-level championships, when an organiser promotes a learner or team (for example from Zone to Sub-County): the learner’s record, including photo and birth certificate number, goes with them.
• The public, for results the organiser publishes.
• Service providers who host or support the service for us: Vercel (website hosting and file storage), Neon (database), Resend (email), TUMA (M-Pesa payments), Paystack (card and team-fee payments) and Meta (site analytics, see Cookies).
• Authorities, where the law requires it.

Our database is hosted in the European Union (Frankfurt, Germany), and our website and file storage run on Vercel’s global network. These providers protect data with encryption in transit and at rest and are bound by data protection terms. By using Zaroda Sports you understand that data is transferred outside Kenya for this purpose, with safeguards in line with Part VI of the Data Protection Act.

• Championship data (learners, entries, results, photos) is kept until the organiser deletes the championship or asks us to delete it. Past results stay available so rankings and promotions keep working.
• Accounts are kept until you ask us to close them. Officials’ access to a championship’s private data ends when their role expires after the championship.
• Payment records are kept as long as the law requires for tax and accounting.
• Sign-in records are deleted after 30 days, and rate-limiting records after one day.

• Passwords are stored as strong one-way hashes; repeated failed sign-ins are blocked.
• Every person sees only what their role allows, and every change is recorded in an audit log.
• Connections are encrypted (HTTPS), and the site uses strict browser security settings.
• Payment notifications are verified before any payment is recorded.

Under the Data Protection Act you have the right to:

• be told how your data is used, and get a copy of it;
• have wrong or out-of-date data corrected;
• have data deleted, or object to how it is processed;
• receive your data in a portable format.

For a learner’s data, a parent or guardian should first ask the school or organiser who registered the learner - they control that data and can correct or remove it. We will help them. For your own account, contact us directly.

You can also complain to the Office of the Data Protection Commissioner (ODPC).

• Sign-in cookie - keeps you signed in. Essential; the site’s accounts don’t work without it.
• Theme setting - remembers light or dark mode in your browser.
• Meta Pixel - tells us how visitors reach and use the site, for example from Facebook. Meta may use cookies to do this. You can limit it through your Facebook ad settings or by blocking third-party cookies in your browser.

We may update this policy as the service changes. We will change the date at the top, and tell account holders about significant changes.

For privacy questions or requests, use our contact form, WhatsApp 0781230805 or call 0724282065. We aim to respond within 7 days, and to complete requests within the time the Data Protection Act allows.