SASA Digital · School sports eligibility verification and results portal · Version 1 · 15 July 2026
Privacy Notice
Sub10 (Pty) Ltd t/a SASA Digital (“SASA Digital”, “we”, “us”) operates the online portal (“the Portal”) used by schools to register athletes for school sporting events, including the National School Sport Championships (NSSC), verify eligibility, publish results, and provide reports to the South African Schools Athletics Association (SASA). This notice explains, in accordance with POPIA, how personal information is processed on the Portal.
1. Who we are
SASA Digital operates the Portal used by schools to register athletes for school sporting events, including the National School Sport Championships (NSSC), verify eligibility, publish results, and provide reports to SASA. Our Information Officer can be contacted at hello@sasadigital.co.za.
2. Our role: SASA Digital acts as an operator
SASA Digital processes personal information on the Portal as an operator (processor) for three separate parties, and does not itself decide the purpose of any of this processing:
- for each school, in relation to the athlete registration and eligibility records the school uploads;
- for the relevant event convener, in relation to running the eligibility-verification check at an event; and
- for the South African Schools Athletics Association (“SASA”), in relation to compiling and providing the reports described in section 4 below.
The school, the event convener, and SASA each remain the responsible party for their own use of the personal information. This Privacy Notice explains how SASA Digital processes personal information on their behalf; the applicable Processing Notice issued by the School to parents/guardians is the primary notice for parents and remains the source of consent.
3. What we process
The Portal processes the categories of personal information described in the School's Processing Notice, issued at registration, summarised below. Parents/guardians should read the School's Processing Notice for the full detail (purpose, mandatory or voluntary status, and recipients for each field).
| Personal information collected | Why we need it | Mandatory / voluntary | Who it is shared with, and why |
|---|---|---|---|
| Full name and surname | To identify the athlete on all school, provincial and national NSSC records, team lists and published results. | Mandatory. The athlete cannot be registered or compete without it. | The school, provincial DSAC, National DSAC, the NSSC organising committee, and the SASA Digital portal. Name only appears in public results. |
| Gender | To place the athlete in the correct gender-categorised event and verify eligibility. | Mandatory. | Provincial/National DSAC, event conveners (eligibility check), SASA (reporting). |
| Home language | Administrative and communication planning, and Department of Basic Education monitoring of school sport participation. | Requested as mandatory on the form; declining should only have an administrative consequence, not affect eligibility. | Provincial/National DSAC. |
| Athlete's contact number | Direct communication with the athlete before and during the event. | Mandatory. | The school, event organisers and coaches. |
| ID number | To verify the athlete's identity and confirm age/grade-band eligibility against the certified birth certificate or ID supplied. | Mandatory (required to verify eligibility). | The school (retains) and provincial/National DSAC (verification only). Not published, and not shared with event conveners, SASA reports or the public; masked wherever the full number is not needed. |
| Race (Black / White / Coloured / Indian / Other) | Intended for Department of Basic Education / DSAC demographic and transformation monitoring and reporting, including the EPG (Eminent Persons Group) Report, an independent annual audit of demographic and administrative transformation across national sport federations. | Special personal information under POPIA. Requires the parent/guardian's explicit, separate consent. Race does not affect eligibility to compete, so declining should not affect participation. | Provincial DSAC and National DSAC, for aggregate demographic reporting only. Not shared with the SASA Digital public portal, event conveners, or published results. |
| Home address, and urban / semi-urban / township / rural classification | Travel and logistics planning for the trip, and Department of Basic Education socio-economic monitoring linked to school quintile funding. | Mandatory for logistics. | Provincial/National DSAC, and travel and accommodation coordinators. |
| School, EMIS number, learner registration number, grade, school quintile level | Confirms the athlete's school and grade-band eligibility, and cross-checks enrolment against the Department's EMIS/LURITS learner records. | Mandatory. | The school, provincial/National DSAC, and the Department of Basic Education's EMIS system. The SASA Digital portal receives school and grade only, not the EMIS number, learner registration number or quintile level. |
| School Principal and contact number | Confirms the school's endorsement of the registration and provides a school-level contact. | Mandatory. | Provincial/National DSAC. |
| School league, and club/academy and coach details | Team and league administration, and an event-day contact for the athlete's coach. | Mandatory for league and school coach fields; club/academy fields apply only where the athlete belongs to one. | The NSSC organising committee and event conveners. |
| Certified copy of birth certificate/ID, and a recent colour ID photograph | Primary documentary proof of identity and age, used to prevent substitution or fraudulent entries. The photograph is cross-stamped to the certified document. | Mandatory supporting documents. Certification must be by a person with Commissioner of Oaths authority, dated within 6 months of the championship. | Provincial DSAC and National DSAC, for verification. Retained with the physical form; not published. |
| Parent/guardian name, relationship, contact number, email and address (primary, and a second guardian where applicable) | Establishes who may lawfully consent on the athlete's behalf (a “competent person” under POPIA), and gives primary/secondary emergency contacts for the trip. | Mandatory. At least one parent/guardian's details are required. | Provincial officials supervising the trip, and National DSAC. Not published. |
| Medical aid name, number and main member | Enables access to medical treatment and claims while travelling. | Mandatory if the athlete has medical aid; mark “not applicable” if not. | Provincial officials and medical/treatment providers, only if treatment is needed. |
| Treating doctor/medical practitioner and contact number | Enables medical history follow-up in an emergency. | Mandatory if applicable. | Attending medical practitioners and provincial officials, in an emergency. |
| Known food and medication allergies, and dietary requirements (including Halaal/Kosher) | Athlete safety, allergy and catering management. Dietary requirements may also indicate religious observance, which is itself special personal information under POPIA. | Mandatory for health and safety planning. | Catering and accommodation providers, and provincial officials. |
| Medical background, current medication and dosage, COVID-19 vaccination status, and the listed condition checklist (asthma, epilepsy, heart conditions, and others) | Emergency preparedness. Enables event medical staff and provincial officials to respond safely if the athlete becomes unwell or is injured. | Mandatory. Special personal information (health) requiring the parent/guardian's explicit consent. | Event medical staff and provincial officials, strictly on a need-to-know basis. Not shared with coaches, conveners, or the SASA Digital portal beyond what is needed for safety at the event. |
| Participation/travel consent, and emergency medical treatment authorisation | Legal authorisation for the athlete to travel and compete, and to authorise emergency treatment if the parent/guardian cannot be reached. | Mandatory. Required before the athlete may travel or compete. | Provincial officials; medical staff (treatment authorisation only). |
| Consent for use of the athlete's images in promotional or marketing material | A separate, optional purpose: publicising the championship. | Voluntary. Capable of being declined without affecting the athlete's participation. Separated from the participation/medical consent block on the form so it is clearly optional. | The NSSC organising committee, and media/promotional partners, only if this consent is given. |
4. Who we share personal information with, and why
| Recipient | What they receive | Why |
|---|---|---|
| The athlete's school | The full record the school itself uploaded | The school is the responsible party for its own athletes' personal information |
| Event conveners | Name, photograph, derived age band, sex/gender, and a pass/fail eligibility result | To verify the athlete is eligible to compete in a specific event; not the raw ID number or race |
| SASA (the South African Schools Athletics Association) | Sex/gender, age band, race, and school | Association-level reporting; not the raw ID number, photograph, or contact details |
| Provincial and National DSAC (Department of Basic Education; Sport, Arts and Culture) | Personal information required for event administration and verification, per the field table | Statutory/administrative oversight of the National School Sport Championships |
| General public / other third parties | Name, school, and results only | Publishing sporting results |
| Hosting and technical service providers | Whatever is technically necessary to operate the Portal | Hosting, security, and technical support of the Portal, under a written operator agreement. The current list is on our Sub-operators page. View our sub-operators. |
5. Cookies and similar technologies
The Portal uses strictly necessary cookies for login and session management, and preference cookies to remember your choices. Analytics cookies are only set with your consent via the cookie banner. You can control cookies through your browser settings and via the “Cookie preferences” link in the footer. Disabling strictly necessary cookies may prevent the Portal from working correctly. See our Cookie Policy for detail.
6. Security
- Role-based access control, so each user (school, convener, SASA, DSAC) sees only the fields required for their role.
- Encryption of personal information at rest and in transit, including the ID photograph.
- The ID number is masked wherever it is not strictly needed for verification.
- Multi-factor authentication for all school, convener, SASA and DSAC accounts.
- Audit logging of who accessed or exported which athlete's record.
- No bulk export of athlete-level personal information, particularly race and health fields.
- A documented incident response process, and a duty on all recipients to notify SASA Digital immediately of any suspected security compromise.
7. Retention
| Record | Retention approach |
|---|---|
| ID number, birth date, and the certified birth certificate/ID image/photocopy | Retained only for as long as needed to verify eligibility for the relevant championship, plus a short period to resolve any dispute; then securely destroyed or de-identified. |
| Race | Retained only for as long as the confirmed reporting purpose requires (see the field table above); not retained indefinitely. |
| Medical and health personal information | Retained only for the duration of the relevant championship and a short period after, unless a longer period is needed for an ongoing medical or insurance matter. |
| Name, school and results (public record) | May be retained for longer as a historical sporting record, subject to a defined period rather than indefinitely. |
| Laminated paper form held by National DSAC | Requires its own defined retention and secure-destruction schedule, given it is a long-lived physical record containing an ID number, race and full medical history. |
| Consent records | Retained for the retention period of the underlying data, plus a further period to demonstrate accountability. |
8. Cross-border transfer
The Portal is hosted in South Africa, and personal information is processed within South Africa. It is not transferred outside South Africa. If SASA Digital engages any service provider that processes personal information outside South Africa (for example, email delivery, SMS, or analytics), this notice will be updated to disclose the transfer and the level of protection that applies, before it happens.
9. Children's personal information
Athletes registered on the Portal are children. SASA Digital does not collect personal information directly from children; it is uploaded by the school, on the strength of consent obtained by the school from the athlete's parent or legal guardian. If you are a parent or guardian with questions about what was submitted or how to exercise your rights, please see the school's Processing Notice or contact us using the details in section 13 below.
10. Your rights
In terms of POPIA you have the following rights in relation to your personal information:
- Correction, to ask for inaccurate or outdated personal information to be corrected.
- Access, to ask for a copy of the personal information held about the athlete.
- Objection/deletion, to object to the processing of the athlete's personal information, or ask for it to be deleted, on reasonable grounds. Some records may need to be retained where the Department of Basic Education or DSAC requires it, or to resolve a dispute.
- Withdraw consent at any time, including specifically for use of the athlete's images in promotional or marketing material, without needing to withdraw consent for participation itself.
- Object to automated processing, including for purposes of direct marketing.
- Complain to the Information Regulator (South Africa) if you believe the athlete's personal information has been processed unlawfully.
Where the personal information was collected by a school on behalf of an athlete, please also refer to that school's Processing Notice, which is the primary point of contact for exercising these rights.
11. Complaints
To exercise any of these rights, or to lodge a complaint, contact the Information Regulator (South Africa) at enquiries@inforegulator.org.za, www.inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
12. Changes to this notice
We may update this notice from time to time. The current version and its version number appear at the top of this document; material changes will be brought to the attention of schools and, where practicable, parents/guardians.
13. Contact us
SASA Digital's Information Officer: hello@sasadigital.co.za. See also our PAIA Manual and Operator Agreement.