Privacy policy

ClubCentered is a product of Lighthub, South Africa ("we", "us"). This policy explains how personal information is handled on clubcentered.co.za and on the ClubCentered platform, in line with the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are and what this policy covers

ClubCentered (clubcentered.co.za) is operated by Lighthub, based in South Africa. We handle personal information in two distinct roles, and this policy covers both:

• This website. For visitors to clubcentered.co.za — including anyone who submits the demo-request form — Lighthub is the responsible party under POPIA. This policy governs that information directly.
• The ClubCentered platform. Member information inside each club's ClubCentered system (applications, membership records, licences, payments) belongs to that club. The club is the responsible party for its members' information, and Lighthub processes it on the club's behalf as an operator under POPIA, governed by the written agreement between Lighthub and the club. Members with questions about their personal information should contact their club first — we assist the club in responding. The platform sections below describe our practices as operator, for transparency.

2. What we collect

On this website. When you submit the demo-request form we collect your name, club name, email address and phone number. The site also records basic technical information needed to serve pages (such as IP addresses in server logs). This site does not use advertising or tracking cookies.

On the platform (as operator for clubs). Clubs use ClubCentered to collect and manage information from their members, which may include: identity details (names, date of birth, and South African ID numbers — stored encrypted); contact and address details; emergency contact details; membership applications, payment and renewal records; athletics-licence information, which can include demographic information required by national sporting bodies (treated as special personal information under POPIA, with restricted access); and documents such as member photos. What a given club collects is determined by that club's configured forms and declarations.

3. How we use personal information

Website enquiries. We use demo-request details to respond to you, arrange and follow up on demonstrations, and keep a record of the enquiry. The lawful basis is your consent in submitting the form and the steps needed towards a possible agreement. We do not sell this information or add you to third-party marketing lists.

Platform member information. We process member information only on the club's instructions and only to provide the service: processing applications and renewals, generating licence forms, reconciling payments, sending transactional emails (confirmations, approvals, reminders) on the club's behalf, and producing the club's own reports. We do not use member information for our own marketing, do not sell it, and do not combine it across clubs.

4. Who we share it with and where it lives

We use a small number of service providers (operators under POPIA) to run the service:

• Hosting and database: Supabase (data hosted in the European Union — Frankfurt, Germany) and Vercel (application hosting).
• Email delivery: Mailgun (EU region) — for transactional emails sent on clubs' behalf.
• Payments: clubs connect their own payment provider (such as PayFast or Yoco). Payments flow directly between the member and the club's provider account — ClubCentered never holds card details or member funds.

Cross-border transfers. Because hosting is in the EU, personal information is transferred outside South Africa. These transfers are made under section 72 of POPIA to providers subject to laws and contractual commitments (including the GDPR) that provide an adequate level of protection. We may also disclose information where the law requires it. We do not otherwise share or sell personal information.

5. Security and retention

We take reasonable technical and organisational measures appropriate to the sensitivity of the information, including: encryption in transit and at rest; additional application-level encryption of ID numbers, which are masked in everyday views; strict separation of each club's data from every other club's; role-based access controls; and audit logging of access to and exports of members' personal information.

Retention. Website enquiry details are kept for a limited period after the enquiry is concluded. Platform member information is retained according to the club's instructions and its agreement with us; when a club's agreement ends, its data is returned or deleted in line with that agreement. Exact retention periods are being confirmed before this policy is published. No security measure is absolute, but if a breach affecting personal information occurs we will notify the Information Regulator and affected parties as POPIA requires.

6. Your rights under POPIA

You have the right to ask what personal information we hold about you, to request correction or deletion, to object to processing, and to complain to the Information Regulator.

• Website enquiries: contact us directly (details below) and we will respond within a reasonable time.
• Platform member information: direct your request to your club, which is the responsible party for your membership data — we support clubs in meeting these requests.

Children. Club membership systems may hold information about members under 18, captured through the club's own processes with the consent of a parent or guardian (for example, junior memberships and dependants on a family account).

Information Regulator (South Africa): complaints may be lodged via inforegulator.org.za.

7. Changes and contact

We may update this policy from time to time; the current version is always published on this page with its effective date, and material changes will be flagged here.

Contact / Information Officer: Lighthub — melinda@lighthub.co.za.