Trading as "Able Rugby" · Registration No. 2017/325344/07 · Last updated: 19 October 2026
Able Directory (Pty) Ltd ("Able Directory", "we", "us", "our") respects your privacy and is committed to protecting personal information processed through the Able Rugby platform (the "Service"). This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights you have over it.
This Policy is written to comply with South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA"). Because spectators may access the Service from outside South Africa, we also describe, where relevant, how we meet the expectations of the EU/UK General Data Protection Regulation ("GDPR") for those users. Where the two differ, we apply whichever standard gives you stronger protection.
Please read this Policy alongside our Terms & Conditions, which governs your use of the Service. By registering for or using the Service, you acknowledge that you have read and understood this Policy.
Able Directory (Pty) Ltd is the "Responsible Party" (POPIA) / "Data Controller" (GDPR) for personal information processed through the Service, except where stated otherwise in Section 6 below (school-entered player information, where Able Directory acts as an "Operator" / "Processor" on the school's instruction).
| Company | Able Directory (Pty) Ltd |
|---|---|
| Registration Number | 2017/325344/07 |
| Registered Address | [enable JavaScript to view our address] |
| Information Officer | Stefan Potgieter |
| Contact | [enable JavaScript to view our email address] (alternative: [enable JavaScript to view our email address]) |
Our Information Officer is responsible for ensuring compliance with POPIA and is your point of contact for any privacy question, access request, complaint, or concern.
We also maintain a PAIA Manual under the Promotion of Access to Information Act 2 of 2000, describing the categories of records we hold and how to request access to them. It is available on request from our Information Officer.
Coaches and school staff may enter a limited player registry for their school's own use: a player's first name, last name, initials, date of birth, and playing position. Children do not create accounts or submit this information themselves. It is entered on their behalf by the school's own staff for the purpose of running training, matches, and team administration. See Section 6 ("Children's Personal Information") for how responsibility for this data is allocated between the school and Able Directory.
When a school uses the Service to run or record a match (scores, cards, substitutions, injuries, timing), that data is stored against the school, the fixture, and (where a player has been linked from the player registry) that player's record, so a school can track a player's history across a season.
Some match events a Technical Table or coach can log are injury-related, for example a Blue Card (suspected head injury, "recognise and remove"), a Serious Injury, an Injury to Hospital, or a Blood injury. This is "special personal information" (health information) under POPIA section 26, and, for a minor player, is additionally sensitive under Section 6 ("Children's personal information") below. We only ever record a bare occurrence/category (e.g. "Blue Card, suspected head injury"), the same way a paper team sheet or match report would; the Service has no field for a medical diagnosis, treatment note, or other clinical detail, and Schools must not enter any into free-text fields.
Processing this category of information relies on the lawful grounds in POPIA section 27: the consent obtained by the School from the player (or a parent/guardian, for a minor) as part of the same consent that covers Player Data generally (Section 6), and/or its being necessary to keep an accurate record of a match-day incident for the School's and player's own protection. It is used only to maintain that match record, never for any other purpose, and never as, or in place of, a medical assessment (see our Terms & Conditions, Section 12, "Not a medical, safety, or return-to-play system").
Able Rugby is provided under a per-school subscription model. Where a school subscribes to a paid plan, we (or our payment processor, once appointed) will collect the billing contact's name, email, and payment details necessary to process the subscription. We do not, and will not, store full payment card numbers ourselves. Card processing will be handled by a PCI-DSS-compliant third-party payment processor, who will have their own privacy policy governing that data.
We do not use advertising cookies, analytics or tracking scripts that run in your browser, or social media pixels. Our only visit statistics come from the server's own access logs (Section 5.3). We do not sell personal information to any third party, for any purpose, ever. We also do not collect any medical, allergy, or emergency-contact information. Schools should continue to keep that outside the Service, in whatever system they already use for it.
This Policy is structured around POPIA's eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. This section addresses purpose specification and processing limitation directly; the other conditions are addressed throughout this Policy (openness in Section 1, security safeguards in Section 9, data subject participation in Section 10, and so on).
| Purpose | What we use | Lawful basis |
|---|---|---|
| Creating and securing your account, authenticating you | Account info, technical/log info | Necessary to perform our contract with you (POPIA s11(1)(b) / GDPR Art. 6(1)(b)) |
| Providing the core Service (match tracking, team/player administration, reporting) | Account, player, match/activity info | Contract necessity |
| Sending account-related emails (verification, password reset, security notices) | Email address | Contract necessity / legitimate interest in account security |
| Billing a subscribing school | Billing information | Contract necessity |
| Understanding how many people visit the website and which pages they use, so we can keep it working well | Web server access logs (Section 5.3) | Legitimate interest in running and improving the Service (POPIA s11(1)(f) / GDPR Art. 6(1)(f)) |
| Detecting and preventing fraud, abuse, or unauthorised access | Login IP, failed-attempt history | Legitimate interest in platform security (POPIA s11(1)(f) / GDPR Art. 6(1)(f)) |
| Complying with legal obligations (e.g. responding to a lawful request from the Information Regulator or a court) | Any information legally required | Legal obligation (POPIA s11(1)(d) / GDPR Art. 6(1)(c)) |
We do not use your personal information for direct marketing, and we do not send marketing communications without your separate, explicit opt-in consent, as required by POPIA section 69.
We do not sell your personal information. We share it only in the following limited circumstances:
We keep this to the minimum. Almost everything below is needed for the Service to work. The only optional item is Google Fonts, and we only load it if you say yes. We use no advertising, analytics, or tracking cookies of any kind.
| Name | Type | What it does | How long it lasts | Needs your consent? |
|---|---|---|---|---|
| PHPSESSID | Cookie | Keeps you signed in while you use the Service | Until you close your browser | No, needed to run the Service |
| remember_me | Cookie | Keeps you signed in on this device. Only set if you tick "Remember me" when signing in | 30 days | No, you asked for it |
| ableConsent | Cookie | Remembers the choices you make in our cookie banner | 180 days | No, needed to respect your choice |
| ableRugbyTheme | Browser storage | Remembers whether you chose the light, dark, or system theme | Until you clear your browser data | No, you asked for it |
| rugbyTrackerSession | Browser storage | Keeps a copy of a match you are recording on your own device, so nothing is lost if your connection drops | Until the match ends or you clear your browser data | No, needed to run the Service |
| Google Fonts | Request to Google | Loads our typefaces from Google's servers (fonts.googleapis.com and fonts.gstatic.com). This sends your IP address and browser details to Google | Each page view, only while you allow it | Yes, optional |
The first time you visit any page of the Service or of our website, a banner asks whether to allow the optional Google Fonts. "Reject optional" and "Accept all" are equally easy to choose, and nothing optional is switched on beforehand. If you say no, nothing is sent to Google and your device's standard fonts are used instead.
You can change your mind at any time with the Cookie settings link in the footer or menu of every page. Withdrawing consent takes effect from your next page view. We ask again after six months, or sooner if the list above changes. You can also clear cookies and site data in your browser at any time, which will sign you out and forget your choices.
Storage that is strictly necessary to provide a service you asked for, such as staying signed in, does not need consent under POPIA, the EU ePrivacy rules, or GDPR, and is covered by the contract basis in Section 3. Loading Google Fonts discloses your IP address to a third party, so we rely on your consent for it (POPIA section 11(1)(a) and GDPR Article 6(1)(a)).
We measure visits using AWStats, a tool that reads our host's own web server access logs. It sets no cookies, runs no script in your browser, and sends nothing to any third party. The logs record, for each request, your IP address, the date and time, the page requested, your browser and device type, and the page you came from. AWStats turns these into totals such as visits per day and most-viewed pages, which we use only to run and improve the website. The logs are held on our host's servers in South Africa (Section 4) for as long as the host's log schedule keeps them. Because no cookies or browser storage are involved, there is nothing to consent to or switch off here; you can object to this processing at any time by contacting our Information Officer (Section 14).
If your school subscribes to a paid plan, you are sent to our payment processor's own website to pay. That site sets its own cookies and is governed by its own policy, not this one.
The Service is primarily used by adults: coaches, team managers, school administrators, and spectators. A person under 18 may self-register their own spectator account only with the permission of a parent or legal guardian, confirmed at registration (Section 8); we do not independently verify this. Beyond that account-level information, a child does not submit their own player information. See below.
As part of running a school sports programme, a coach or authorised staff member at a subscribing school may enter limited information about a player who is a minor (name, initials, date of birth, playing position) into that school's own player registry. In relation to this specific category of information:
Spectators may access the Service from outside South Africa. Our servers and database are located in South Africa. By using the Service, you understand and agree that your personal information will be processed in South Africa, which may not have data protection laws identical to your home country's. We nonetheless apply the protections described in this Policy to everyone's information, regardless of location.
Where your information is transferred outside South Africa (for example, if you access the Service from another country), we rely on one or more of the safeguards required by POPIA section 72: your consent to the transfer (given by using the Service), the transfer being necessary to perform our contract with you, or the recipient being subject to a law, binding agreement, or other arrangement providing an adequate level of protection substantially similar to POPIA.
If you are in the European Union, the United Kingdom, or another jurisdiction with its own data protection authority, you may also have the right to lodge a complaint with your local supervisory authority, in addition to South Africa's Information Regulator (Section 13).
Our processing of EU/UK spectators' information is occasional, limited to what Section 2 describes, and does not involve special personal information about them or large-scale monitoring, so we rely on the exemption in GDPR/UK GDPR Article 27(2) and do not currently appoint an EU or UK representative. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
Self-registering an account does not require providing or verifying a date of birth. Instead, at registration you confirm, by ticking a checkbox, that you are 18 years of age or older, or that you have the permission of a parent or legal guardian to use the Service. We rely on this confirmation as given and do not independently verify age or the existence of parental or guardian permission; we keep only a timestamped record that the confirmation was made (Section 2.1).
If you are a parent or legal guardian and believe a child has registered an account without your permission, or has misrepresented the permission given, please contact us (Section 14) and we will remove the account.
This is separate from Player Data (Section 6): a player who is a minor does not register their own account or make this confirmation themselves. Their information is entered by their school's own coaching or administrative staff, on the school's own authority.
We apply reasonable technical and organisational measures to protect the information we hold, including:
No system can be guaranteed 100% secure. If we become aware of a security incident affecting your personal information, we will notify the Information Regulator and affected individuals as soon as reasonably possible, and in any event within 72 hours of becoming aware of it, as required by POPIA section 22, giving enough detail for you to take protective measures of your own.
Subject to applicable law, you have the right to:
To exercise any of these rights, contact our Information Officer (Section 1). We will respond within the timeframe required by applicable law (POPIA allows a reasonable period, generally within 30 days).
We retain personal information for as long as your account is active, plus a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Historical match/event data may be retained for longer, in de-identified or aggregated form where practicable, as it forms part of a school's own sporting records. If you close your account, we will delete or de-identify your personal information within a reasonable period, unless we are required by law to retain it for longer.
Player Data (Section 2.2) is retained for as long as the relevant School's subscription remains active, or until the School instructs us to delete a specific record, whichever is earlier. The Service is a tool for the School, not the School's official system of record. A School remains separately responsible for keeping its own required learner records (for example, records the Department of Basic Education requires schools to keep for a set number of years after a learner leaves) outside the Service, in line with its own record-keeping obligations.
We may update this Policy from time to time, for example when the Service changes, or when payment processing launches. We will post the updated Policy on this page with a new "Last updated" date, and for material changes, we will notify registered users by email or in-app notice before the change takes effect.
If you believe we have not handled your personal information in accordance with POPIA, you may lodge a complaint with:
| Information Regulator (South Africa) |
Website: inforegulator.org.za Email: complaints.IR@justice.gov.za |
|---|
We would appreciate the opportunity to address your concern directly first. Please contact our Information Officer (Section 1).
Questions about this Policy or how your information is handled? Contact our Information Officer, Stefan Potgieter, at [enable JavaScript to view our email address] (alternative: [enable JavaScript to view our email address]), or write to us at [enable JavaScript to view our address].