Privacy Policy

1. Introduction

The South African Precision Rifle Federation (NPC) ("SAPRF", "we", "us", or "our") operates the SAPRF platform at saprf.co.za (the "Platform"). This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African law.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Responsible Party

Entity	South African Precision Rifle Federation (NPC)
Information Officer	SAPRF Information Officer
Email	privacy@saprf.co.za
Country	Republic of South Africa

3. Personal Information We Collect

We collect the following categories of personal information:

3.1 Account & Identity

• Full name
• Email address
• Password (stored in hashed form only)
• South African ID number (optional, used for age verification and membership compliance)
• Date of birth
• Province of residence
• Phone number (optional)

3.2 Membership

• SAPRF membership number
• Membership type and status
• Payment status and payment references (we do not store banking or card details)
• Membership start and expiry dates

3.3 Competition & Performance

• Match registrations and attendance
• Scores, rankings, and standings
• Division classification
• Rifle configurations and ammunition load data

3.4 Technical

• Session cookies (authentication and CSRF protection only)
• IP address and browser information (server access logs)

4. Legal Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Contractual necessity (Section 11(1)(b)): Processing required to fulfil your membership agreement and competition participation.
• Legitimate interest (Section 11(1)(f)): Federation administration, maintaining accurate competition records, and ensuring fair play.
• Legal obligation (Section 11(1)(c)): Compliance with sports governance requirements and reporting obligations (e.g., SASCOC).
• Consent (Section 11(1)(a)): Where you voluntarily provide optional information such as your SA ID number, phone number, or equipment details.

5. How We Use Your Information

• Register and manage your SAPRF membership
• Process match registrations and record competition results
• Calculate and publish rankings, standings, and season results
• Send transactional emails (registration confirmations, membership notices, match updates)
• Generate reports required by sports governance bodies
• Maintain audit trails for administrative actions
• Improve the Platform and resolve technical issues

6. Public Display of Information

The following information is publicly visible on the Platform to all visitors without authentication:

• Your name, province, and division in match results and season standings
• Your match scores, rankings, and normalised season points

This public display is integral to the operation of a competitive sports federation and is based on legitimate interest. Your email address, SA ID number, date of birth, and contact details are never publicly displayed.

7. Cross-Border Data Processing

Your personal information is primarily stored and processed in South Africa. However, we use the following third-party services that may process limited data outside of South Africa:

Service	Purpose	Data Shared	Location
Mailgun	Transactional email delivery	Name, email address, email content	European Union

These transfers are made in compliance with Section 72 of POPIA. Each third-party provider maintains data protection standards that are substantially similar to POPIA. We do not sell, rent, or trade your personal information to any third party.

8. Data Retention

• Active accounts: Personal information is retained for the duration of your membership and account activity.
• After account closure: Core identity data is retained for 2 years after your last active membership to facilitate re-registration and resolve any disputes.
• Competition records: Scores, rankings, and standings are retained indefinitely as part of the Federation's official historical record. This is standard practice for sports governing bodies.
• Audit logs: Administrative action logs are retained for 5 years for governance and compliance purposes.
• Server logs: Technical access logs are retained for up to 90 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Hashed password storage using industry-standard algorithms
• Role-based access controls limiting who can view and modify data
• Regular software updates and security patches
• Server-level firewalls and access restrictions

10. Cookies

The Platform uses only essential session cookies required for authentication and security (CSRF protection). We do not use tracking cookies, analytics cookies, or advertising cookies. No third-party cookie-based tracking is present on the Platform.

11. Your Rights Under POPIA

As a data subject, you have the right to:

• Access your personal information held by us
• Correct any inaccurate or incomplete personal information
• Delete your personal information, subject to our legal retention obligations and the legitimate interest in maintaining competition records
• Object to the processing of your personal information on reasonable grounds
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at privacy@saprf.co.za. We will respond within 30 days as required by POPIA.

12. Children's Information

The Platform may be used by persons under the age of 18 (junior and sub-junior competitors). Accounts for minors must be created with the knowledge and consent of a parent or legal guardian. We process minors' information on the same basis as adult members, with the additional safeguard that a parent or guardian may exercise data subject rights on behalf of the minor.

13. Information Regulator

If you are not satisfied with our handling of your personal information, you may lodge a complaint with:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@justice.gov.za
Tel: 010 023 5207

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users or by a notice on the Platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact Us

For any questions or requests related to this Privacy Policy or your personal information, contact:

SAPRF Information Officer
Email: privacy@saprf.co.za
General enquiries: info@saprf.co.za