Last updated [date]
Draft for Vanessa to review. It describes what the Rockfit app and website actually store, but it is not legal advice. Check it, fill in the [bracketed] details, and consider having it reviewed before launch. Delete this note before publishing.
Rockfit (“we”, “us”) provides climbing coaching in [Area], Cape Town. This policy explains what personal information we collect, why, how we keep it safe and the rights you have under the Protection of Personal Information Act, 2013 (POPIA). It covers this website, our coaching and the Rockfit app our coaches use.
Who is responsible
The responsible party is Rockfit, run by [Vanessa’s full name] ([registered business name, if any]). Our Information Officer is [Vanessa’s full name], who you can reach at [privacy email address] or [phone number].
What we collect
Clients, and parents or guardians
| Information | Why we need it |
|---|---|
| Name, phone number and email address | To arrange sessions and contact you |
| For a child: the parent or guardian’s name and phone number | To arrange sessions and send invoices to the right person |
| Bookings and attendance | To run the schedule and charge correctly |
| Session notes: what was worked on, progress and a session rating | So your coach can plan your coaching and you can see your progress |
| Invoices and payments | To bill you and keep the records the law requires |
We do not ask for ID numbers, banking details or medical information. If you tell a coach about an injury or a health condition that matters for your safety, they may note it in your session notes, and only so they can coach you safely.
Coaches
Name, email address, availability, the sessions they coach and their pay. Passwords are stored only in a scrambled (hashed) form that cannot be turned back into the password.
Website visitors
[REVIEW: the original text said “no contact form, no advertising, no analytics and no cookies” and named Cloudflare as host. This WordPress site has a cookie banner (CookieAdmin) and a different host, so reword this section to match what the site actually does before publishing.]
Children
We coach children only with the consent of a parent or guardian, who books for them, receives the invoices and can use every right in this policy on the child’s behalf. A child’s information is seen only by Vanessa and the coaches who coach that child.
Who can see your information
- Vanessa (the owner) sees all client records, invoices and coach pay.
- Coaches see only the clients they coach and the sessions they run. They never see invoices, prices or anyone’s pay.
- Service providers who help us run the business, under agreements to protect it:
- Our database and app server, in South Africa.
- Cloudflare, which carries traffic to the app securely. Its network is international, so information may pass through servers outside South Africa, protected by Cloudflare’s data protection terms.
- [An email service, once invoices are emailed from the app.]
- Google Play, which delivers the coaches’ app to their phones. It does not receive client information.
We never sell your information or use it for advertising.
How we protect it
- All connections to the app and website are encrypted.
- Every user has their own login. Access is limited by role, as described above, and is enforced by our server, not only by the app’s screens.
- Coaches’ phones keep a copy of their own schedule and clients so the app works without signal. The copy is protected by the phone’s screen lock. The app can use a fingerprint or face unlock; that is handled by the phone itself, and we never receive biometric information.
- When a coach no longer coaches a client, that client’s details are removed from the coach’s phone at its next sync.
- We keep backups so information is not lost, including an encrypted copy stored away from our premises.
How long we keep it
- Invoices and payment records: five years, as South African tax law requires.
- Client details and session notes: while you are a client and for [two years] after your last session, then deleted.
- Coach records: for as long as employment and tax law require.
Your rights
Under POPIA you may:
- ask what information we hold about you, and for a copy of it;
- ask us to correct or delete information that is wrong, out of date or no longer needed;
- object to how we use your information; and
- complain to the Information Regulator (inforegulator.org.za) if you are unhappy with how we handled it.
To use any of these rights, contact our Information Officer (above). We will respond within a reasonable time, normally within 30 days.
Changes
We will update this page if how we handle information changes. The date at the top shows when it last changed.