Protection of Personal Information Act (Act 4 of 2013)
ROXScore is committed to complying with the Protection of Personal Information Act (POPIA) of South Africa. This statement outlines how we handle personal information in accordance with our obligations as a responsible party under POPIA.
1. Responsible party
ROXScore operates as the responsible party for personal information collected through the ROXScore platform. Contact the Information Officer at support@roxscore.co.za.
2. Purpose limitation
We only process personal information for a specific, explicitly defined, and lawful purpose related to the provision of our event management, results, and payment facilitation service. We do not process personal information in a way that is incompatible with the purpose for which it was collected.
3. Lawful processing grounds
We process personal information on the basis of: (a) the data subject's consent (account registration, and separately, opting in to receive WhatsApp messages or share data with HYROX); (b) necessity for the performance of a contract (event registration and payment processing, including sharing your contact details with the hosting venue by default, unless you opt out, and processing a recipient's details when an athlete initiates an entry transfer to them); and (c) our legitimate interests in operating a secure and functional platform, where those interests are not overridden by your rights.
4. Information quality
We take reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary. Athletes may update their profile information at any time through the platform.
5. Openness
We document all processing activities and maintain a POPIA manual available on request. We notify data subjects before or at the time of collecting their personal information about the purpose of collection, the categories of data processed, and their rights.
6. Security safeguards
We maintain appropriate technical and organisational measures to secure the integrity and confidentiality of personal information in our possession. This includes TLS encryption in transit, row-level security controls, and restricted access by role. In the event of a security compromise affecting personal information, we will notify the Information Regulator and affected data subjects as required by POPIA.
7. Third-party processors
We share personal information with the hosting venue's chosen payment provider — Yoco, Peach Payments, PayFast, or Paystack — to process online payments where enabled by a venue, and with Meta Platforms, Inc. to deliver WhatsApp messages where you have opted in and provided a phone number. These payment providers and Meta each process data as operators under our instructions and are contractually required to implement appropriate security measures. We also use Supabase for infrastructure and Resend for transactional email. All operators are bound by confidentiality obligations.
8. Special personal information
We do not intentionally collect special personal information as defined by POPIA (such as health information, biometric data, racial or ethnic origin, or criminal records) through the ROXScore platform.
9. Data subjects' rights
As a data subject you have the right to: (a) be notified that your information is being collected; (b) access your personal information held by us; (c) request correction or deletion of your information; (d) object to the processing of your information, including withdrawing WhatsApp opt-in, HYROX data sharing opt-in, or venue data sharing at any time via your profile (venue data sharing opt-out hides your contact details from venue administrators; your name, category, and bib number remain visible for event operations) or the opt-out link sent with your confirmation message; and (e) submit a complaint to the Information Regulator. To exercise rights (a)–(d), contact us at support@roxscore.co.za.
10. Trans-border flows
Personal information is stored on Supabase infrastructure hosted in the European Union, outside South Africa. We take reasonable steps to ensure such transfers comply with POPIA section 72, including confirming that adequate protection comparable to South African standards is in place.
11. Retention and destruction
Personal information is retained for as long as required for the purpose of collection or as required by law. Payment transaction records are retained for a minimum of five years. When information is no longer required, it is deleted or anonymised.
12. Information Regulator
You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your POPIA rights have been violated. Website: www.inforegulator.org.za. Email: inforeg@justice.gov.za.
13. POPIA manual
Our full POPIA manual is available on request. Contact support@roxscore.co.za to obtain a copy.