Privacy Notice

Version 2026-10

Vikapu Elite Basketball Academy (“Vikapu”, “we”), Nairobi, Kenya, is the data controller for the personal data described here, under the Kenya Data Protection Act, 2019.

What we collect

  • About the player: name, date of birth, gender, school and class, basketball experience, branch, any medical conditions or instructions you choose to share, attendance, evaluations and coach notes, kit issued.
  • About the parent/guardian: name, phone, email, and (optional) home address.
  • Payments: M-Pesa phone number, amounts, transaction references.
  • Photos and videos of players only with your separate consent.

Why we use it

To register and train your child, keep them safe (medical information), organise teams, games and attendance, share progress reports with you, take and confirm payments, and send you service messages (payment reminders, schedule updates). Legal basis: your consent and our agreement to provide training. We do not sell your data or use it for advertising.

Who receives it

Only what each needs:

  • Our coaches and staff (coaches do not see your email or address).
  • Nobuk (M-Pesa payment processing).
  • SasaSignal (SMS).
  • Brevo (email, servers in the European Union).
  • GreenGeeks (hosting of our database, servers outside Kenya).
  • Vercel (website hosting, United States).
  • Google (maps and fonts on the website).

Data sent outside Kenya is protected by these providers’ security and data-processing terms.

How long we keep it

  • Registrations that are never paid: deleted after 6 months.
  • Player records: while your child trains with us and up to 2 years after they leave.
  • Payment and accounting records: as long as Kenyan tax law requires.
  • Activity logs: 24 months.

Your rights

You have the right to be told how your data is used; to get a copy; to correct it; to have it deleted; to object to or withdraw consent (including photo consent) at any time; and to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). To use any right, contact us below; we reply within 14 days.

Children’s data

We only register a child with the consent of a parent or legal guardian.

Security

Our system is staff-only, with individual logins and roles, encrypted connections (https), and access and change logs. We will tell you and the ODPC if a breach puts your data at risk.

Contact