Privacy Policy

Effective 26 July 2026. This describes the data the platform actually collects and how it is handled today. It is a working baseline and has not been reviewed by counsel.

1. Who controls your data

Athlytica Technologies Limited, Nairobi, Kenya, is the data controller. We process personal data under the Kenya Data Protection Act, 2019. Contact us at legal@athlyticahq.com.

2. What we collect

• Registration details — parent or guardian name and email, athlete name and age, preferred campus, and the programme selected.
• Payment records — the M-Pesa receipt number, amount, and registration reference returned by Safaricom when a payment settles.
• Performance and session data — coach evaluations, session attendance, skill metrics, and where recorded, biometric and injury records held in the athlete passport.
• Account data — the email address you sign in with and the workspace roles granted to you.

3. Phone numbers are not stored

Your M-Pesa phone number is used to send the payment prompt and is then discarded. What we keep is a one-way keyed hash of the number, used solely to match an incoming payment to the right registration. The number itself cannot be recovered from that hash.

4. Why we process it

To register athletes and take payment (performance of a contract), to run coaching programmes and report progress to parents (legitimate interest), and to keep financial and audit records (legal obligation). Athlete performance history is retained so a passport remains meaningful over a career; settled registration records are retained as part of the payment audit trail.

5. Children’s data

Most athletes are minors. Registration is completed by a parent or guardian, and consent to process the athlete’s data is given by them. A guardian may request access to, or correction of, their athlete’s records at any time.

6. Who else sees it

• Safaricom PLC — processes M-Pesa payments through the Daraja API.
• Supabase — hosts the database and authentication.
• Vercel — hosts the web application.
• Coaches and administrators — see only the athletes and workspaces their role grants them.

We do not sell personal data and we do not use it for advertising.

7. Your rights

Under the Data Protection Act, 2019 you may request access to your data, correction of inaccurate data, deletion where we have no overriding obligation to retain it, and you may object to certain processing. Write to legal@athlyticahq.com; we respond within 30 days. You may also complain to the Office of the Data Protection Commissioner.

8. Security

Access to athlete and financial records is restricted by workspace role and enforced on the server. Payment settlement notifications are authenticated before they are accepted. If a breach affects your data, we will notify you and the Commissioner as the Act requires.