Data Privacy & Your Information.

Section 01

Why this notice exists

When you fill in a form on this website — registering a player, applying for a trial, volunteering, sponsoring, subscribing to updates, or raising a concern — you are giving the academy personal information about yourself and, often, about a child. This notice explains what happens to that information in return. It is written to be read, not to be skimmed past: we would rather you know exactly what the academy does with your data than wonder about it later.

The academy handles personal information in line with the Kenya Data Protection Act 2019. In practice that means we follow six commitments: we tell you plainly what we collect and why (transparency); we use it only for the purposes we stated (purpose limitation); we collect only what our programmes need (minimisation); we keep it accurate and correct it when you ask (accuracy); we store it securely and restrict who can open it (integrity and confidentiality); and we do not keep it longer than it is needed (retention). The rest of this notice shows what each of those commitments means for the forms on this site.

Section 02

What we collect and why

Each form on this site collects a different set of details, matched to what the academy genuinely needs to act on that form. The table below summarises the position; if a form asks for something not listed here, the reason will be stated on the form itself.

• Player Registration (Form 01) — the player’s biographical and school details, guardian identity and contacts, emergency contacts, and a short voluntary health note (conditions or allergies our coaches should know during sessions). Why: to register the player, reach the right adult in an emergency, and keep the child safe during football activity. We do not collect identity-document numbers (birth certificate, NEMIS/UPI, national ID or passport), insurance details, blood group or medical history online — a full medical form is completed on paper with the coach at enrolment, which also keeps it out of this website’s systems. The health note is the most restricted field we hold online.
• Trial Application (Form 02) — applicant identity and age, playing position, guardian contacts, and a medical declaration. Why: to arrange a safe, age-appropriate assessment.
• Parent Association (Form 03) — parent/guardian identity and contact details. Why: to register membership of the association and communicate with it.
• Volunteer and Coach Applications (Forms 04–05) — identity, contacts, background and availability. Why: to assess the application; roles involving children require further checks before approval.
• Sponsorship, Donation and Partnership forms (Forms 06–07, Partnership) — business or donor contact details. Why: to respond to your enquiry. No payment card or mobile-money credentials are ever collected on this website — payment details are only ever shared with you directly, by the academy office, when you decide to support us.
• Contact and Enquiry forms (Form 08, General Enquiry) — your name, email or phone, and your message. Why: to reply to you.
• Media & Photo Consent (Form 09) — the player’s identity and your consent decisions. Why: to record exactly which photos and media uses you have agreed to. Nothing is published about a child without this record.
• Safeguarding Report (Form 10) — details of a concern, with the option to stay anonymous. Why: to protect children. These reports are stored separately and can be opened only by the Designated Safeguarding Officer — see Section 3.
• Newsletter — your email address only. Why: to send you academy updates. Every message includes a way to stop receiving them.

We also record the technical details that any website sees: your browser’s user-agent string and the page you came from, attached to the submission itself, so that abuse of the forms can be detected and rate-limited. We do not run advertising trackers on this site, and we do not profile visitors.

Section 03

Who can see your information

Ordinary form submissions (registrations, applications, enquiries) are recorded in the academy office’s submissions ledger, which requires a staff account to open. Within that ledger, the most sensitive categories — medical details and identity-document numbers — are further restricted so that only portal administrator accounts can view them; other staff see that the fields exist but not their contents. Published squad pages show only what a guardian has consented to through Form 09 (typically the player’s name, number, position and photo).

Safeguarding reports sit in a separate, restricted store. They are never emailed to the general academy inbox, never appear in the staff dashboard, and cannot be opened by ordinary staff or even by the academy’s own administrators without an explicit, auditable grant of the DSO role. Every viewing and every action on a report is written to a tamper-evident audit log. If you chose to include your identity in a report, it stays within that restricted store; if you chose anonymity, the system discards your identity details before storing the report.

Section 04

Children’s information

Most of the personal information this website holds relates to children, and we treat it with the corresponding care. Registration (Form 01) and media consent (Form 09) are completed by a parent or guardian, whose authority we rely on to collect the child’s details. We ask for the minimum needed to run a safe football programme: identity and contact information so we know who is on the pitch and who to call, and a short voluntary health note so a child with asthma or an allergy is not put at risk by our sessions. Identity-document numbers, insurance details and full medical history are not collected through this website at all — they stay on the paper forms held by the coach.

Children themselves do not create accounts on this website. The guardian portal is accessed through an invitation issued to a verified guardian, and a guardian can see only their own child’s record. Where the law requires it — above all where a child is at risk — the Designated Safeguarding Officer may share the necessary information with statutory authorities such as the Children’s Officer or the Police, as explained on the reporting form itself and in our Safeguarding & Child Protection Policy.

Section 05

What happens on your device

Two features of our forms work inside your own browser, and we tell you about both because they involve your device’s storage rather than the academy’s systems. First, while you are filling in a form, your in-progress answers are automatically saved on your device, so that an accidental refresh or a closed tab does not lose your work. Second, if you submit a form at a moment when the academy server cannot be reached, a copy of the submission is kept on your device and sent automatically the next time you visit the site.

Both kinds of device copy expire and are deleted 48 hours after they were saved, and neither is ever sent anywhere except to the academy’s own server. You can clear them at any time by clearing this website’s data in your browser settings. If you are using a shared or public computer to raise a safeguarding concern, consider using the anonymous option and a private browsing window — and remember that if a child is in immediate danger, a phone call to Childline Kenya 116 comes before any form.

Section 06

Emails and notifications

When a form is delivered, the academy office is notified by email so that your submission does not sit unseen. Those notification emails deliberately exclude the most sensitive fields: medical details and identity-document numbers are withheld from email bodies and can be viewed only by signing in to the restricted ledger. If you leave an email address on an ordinary form, you may receive a courteous acknowledgement containing your reference number — nothing more.

A safeguarding report triggers a different, minimal notification: the Designated Safeguarding Officer receives a short message saying that a report is waiting, with a reference number and a link to the secure desk. The report itself — the narrative, the child’s name, your identity if you gave it — never travels by email. If you asked for confidential follow-up, your acknowledgment email contains only your reference number and emergency contact numbers.

Section 07

How long we keep information

We keep each category of information only as long as it serves the purpose it was collected for. Registration records are kept while the player is registered with the academy and for a defined period afterwards, in case of a later medical or safeguarding question; enquiries, applications and partnership conversations are kept while the matter is open and for a short period after it closes; newsletter addresses are kept until you unsubscribe; and safeguarding records are kept for 24 months — or, if the case is still open when that period ends, until the case is closed and then for 24 months from closure — as set out in our Safeguarding & Child Protection Policy, which reflects the seriousness with which those records must be kept.

When a retention period ends, the information is deleted from the academy’s systems and from our backups as they rotate. If you would like the current retention period for a specific category of information, contact the academy office and we will tell you plainly.

Section 08

Your rights and choices

Under the Kenya Data Protection Act 2019 you have the right to know what personal information we hold about you, to get a copy of it, to have it corrected if it is wrong, and — subject to the legal duties that apply to a children’s football academy, particularly around safeguarding records — to have it deleted or to object to a particular use. Parents and guardians can exercise these rights on behalf of their children.

To use any of these rights, send us a message through the contact form on this site or speak to the academy office, and tell us the reference number from your submission if you have one. We will confirm who you are before making changes, and we will respond within the timeframes the Act requires. If you believe we have handled your information incorrectly, you also have the right to complain to the Office of the Data Protection Commissioner (Kenya). Unsubscribing from the newsletter takes effect immediately from the link in any message.

Section 09

How we protect information

Protection on this site is layered rather than relying on any single measure. Access to submitted information requires a staff account with a password, and every login surface is protected against repeated password guessing. Role restrictions separate the office ledger, the guardian portal and the safeguarding store, so that authority over one is not authority over another. Player photos are checked and re-encoded when uploaded so that hidden location metadata is removed before storage. The safeguarding store keeps a tamper-evident audit log of every access and every action.

The academy’s systems are backed up on a regular schedule, and we keep the software behind this site current. No system is perfect, and we will not pretend otherwise: if something ever goes wrong with your information, we will tell the affected people and the authorities what happened, as the law requires, and we will fix the cause.

Section 10

Changes and contact

This notice is versioned and reviewed at least once a year, and sooner if our forms or the law change. When it changes in a way that matters to you, we will update the version line at the top of this page and say what changed. The version you saw when you submitted a form is the version that applied to that submission.

Questions about anything in this notice are welcome and deserve a straight answer: send them through the contact form on this site, or speak to the academy office. Concerns about the safety of a child should go, as always, through the confidential reporting form or directly to the Designated Safeguarding Officer — and in an emergency, to Childline Kenya 116.