African Dart Group

Privacy Policy

Privacy Policy

Last updated: 16 May 2026 · Effective: 16 May 2026

This policy explains how African Dart Group (Pty) Ltd ("ADG", "we", "us") collects, uses, stores, and protects your personal information when you use our player app (app.africandartgroup.com), admin app (admin.africandartgroup.com), or marketing site (www.africandartgroup.com).

We process personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") of the Republic of South Africa, and where applicable, the Kenya Data Protection Act 2019 and Nigeria Data Protection Act 2023.

1. Information Officer

2. What we collect and why

Category	Examples	Why
Identification	Full name, nickname, email, phone	To create your player profile, log you in, contact you about fixtures and events.
Authentication	Password (hashed with PBKDF2 — never stored in plain text)	To verify your identity at sign-in.
League activity	Fixtures played, scores, averages, 180s, checkouts, attendance, achievements	To run leagues and tournaments, publish standings, and surface your own performance history.
Profile content	Avatar image (optional), reactions, comments, wall posts	Only when you choose to upload or post. Visible to other players in your franchise.
Payments	Event entry-fee status (paid / pending / refunded) and amount	To manage event registrations and franchise finance. We do not store card numbers — no in-app payment gateway is active today.
Device & push	Web push subscription endpoint (browser-generated, anonymous), notification preferences	To deliver match reminders, event announcements, and result notifications. Removed when you uninstall the app or revoke permission.
Lead capture	Name, email, optional phone, franchise of interest, consent timestamp	Only collected when you submit the public "Register to play" or "Notify me later" form on the marketing site, and only after you affirmatively tick the consent checkbox.

We do not collect ID numbers, banking details, racial or biometric information, or any other "special personal information" as defined by POPIA section 26.

3. Lawful basis for processing

• Contractual necessity (POPIA s11(1)(b)) — to operate the league you joined.
• Consent (POPIA s11(1)(a)) — for lead-capture forms, marketing emails, push notifications, and optional avatar uploads. Consent can be withdrawn at any time.
• Legitimate interest (POPIA s11(1)(f)) — for security logging, error monitoring, and internal product analytics in aggregate.

4. Who we share information with (sub-processors)

We use the following third parties to deliver the service. Each is bound by a data-processing agreement and processes data only on our instructions:

Provider	Purpose	Location
Cloudflare, Inc.	App hosting, edge compute (Workers), media CDN (R2)	Global edge — primary EU/US
Neon, Inc.	PostgreSQL database (player, fixture, event, league data)	EU / US
Resend	Transactional email (welcome, password reset, weekly digest)	US
DartConnect, LLC	Tournament scoring portal — match results, averages, leg-by-leg statistics	US
GitHub, Inc.	Routing the in-app Feedback form to our private issue tracker (only the body of your feedback is sent)	US

We do not sell your personal information. We do not share it with advertisers or data brokers.

5. Cross-border transfers

Our cloud providers operate globally; consequently your personal information may be processed and stored outside South Africa. Where this happens, we rely on contractual safeguards (the provider's standard data-processing terms) and ensure the receiving country has an adequate level of protection or that the transfer is necessary for the performance of your contract with us (POPIA s72).

6. How long we keep it

• Active accounts — for as long as you remain a player or admin on the platform.
• Closed accounts — when you delete your account, your identifying information (name, email, phone, avatar, nickname) is anonymised within 30 days. Your league activity (historic match results, standings, statistics) is retained in anonymised form because removing it would break league-wide records and other players' history.
• Leads — kept for up to 24 months after first contact unless converted to a player account or archived sooner.
• Push subscriptions — deleted immediately when you revoke permission or uninstall the app.
• Email logs — Resend retains delivery metadata for 30 days; we keep no copy.

7. Your rights under POPIA

You have the right to:

• Access — request a copy of the personal information we hold about you. Available in the player app at Profile → Privacy & Data → Download my data.
• Correction — update inaccurate information. Most fields are self-serve from your Profile page; for the rest contact your franchise admin or our Information Officer.
• Deletion — request that we anonymise your personal information. Available at Profile → Privacy & Data → Delete my account. A 30-day grace period applies during which you can cancel.
• Objection — object to processing for direct marketing at any time; opt out of push notifications from your device settings.
• Withdraw consent — where processing relies on consent.
• Lodge a complaint with the South African Information Regulator if you believe we are not handling your information lawfully: inforegulator.org.za · complaints.IR@inforegulator.org.za.

8. Security

We take reasonable, appropriate technical and organisational measures to protect personal information:

• All traffic between your device and our servers is encrypted with TLS 1.3.
• Passwords are hashed using PBKDF2 (SHA-256, 100k iterations) with per-user salts — we never see your plain-text password.
• Authentication tokens are signed JWTs with short lifetimes.
• Database backups are encrypted at rest.
• Access to production data is restricted to a small operations team and audit-logged.
• We monitor application errors continuously and respond to incidents promptly.

If we become aware of a breach affecting your personal information, we will notify you and the Information Regulator as required by POPIA section 22.

9. Cookies and similar technologies

We use a minimal number of cookies, all of which are strictly necessary for the service to function:

• Auth token — keeps you signed in.
• Cloudflare — bot mitigation and load balancing.

We do not use third-party analytics, behavioural advertising, or tracking pixels. No cookie banner is required because no non-essential cookies are set.

10. Children

Our platform is intended for darts players aged 13 and older. Players under 18 require parental consent to register, captured by the franchise admin at sign-up.

11. Changes to this policy

We will update this page when our practices change. Material changes will be announced via in-app notification and email. The "Last updated" date at the top reflects the current version.

12. Contact