Privacy Policy
Last updated: {{ now()->format('F j, Y') }} · Aligned with NDPA 2023, NTF Guidelines, ITF Privacy Standards
1. Introduction
Hotshots Tennis Academy ("the Academy", "we", "our") is committed to protecting the privacy and personal data of all players, parents, guardians, and visitors in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Tennis Federation (NTF) operational guidelines, and the International Tennis Federation (ITF) privacy standards.
This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding your data.
2. Data Controller
Hotshots Tennis Academy acts as the data controller for all personal data collected through enrollment forms, the administration portal, and the parent portal. For inquiries regarding your data, contact us at the email address listed in the Academy's settings.
3. Data We Collect
We collect the following categories of personal data:
| Category | Data Points | Purpose |
|---|---|---|
| Player Information | First name, last name, date of birth, gender, school, t-shirt size | Program enrollment, group assignment, ID cards |
| Guardian Information | Full name, phone number, email, relationship to player | Communication, consent verification, emergency contact |
| Emergency Contacts | Name, phone, relationship | On-court safety response |
| Medical Records | Allergies, medical conditions, medications, doctor info | Player safety during training |
| Performance Data | Skill assessments, attendance logs, coach notes | Player development tracking |
| Financial Data | Payment amounts, status, transaction references | Tuition management |
| Media | Photos and videos of player progress | Progress documentation (with consent) |
4. Processing Children's Data
Under the NDPA 2023, a child is defined as any person under 18 years of age. We process children's data under the following safeguards:
- Parental/Guardian Consent: Enrollment requires explicit, informed consent from a parent or legal guardian via the enrollment form.
- Data Minimization: We collect only data strictly necessary for enrollment, safety, and development purposes.
- Age Verification: Date of birth is collected and verified during enrollment to confirm program eligibility.
- Child-Friendly Communication: All communications regarding a child's data are directed to the registered guardian.
5. Legal Basis for Processing
- Consent — Guardian consent obtained during enrollment (NDPA 2023, Section 25)
- Contractual Obligation — Processing necessary to provide training services
- Legitimate Interest — Player safety, emergency response, program quality
- Legal Obligation — Compliance with NTF player registration and ITF I-PIN requirements
6. How We Use Your Data
- Enrolling and managing player registrations
- Assigning players to training groups and programs
- Tracking attendance, skill progression, and coaching notes
- Processing tuition payments and issuing receipts
- Generating emergency roster PDFs for on-court safety
- Providing parent portal access via secure magic links
- NTF tournament registration and ITF I-PIN applications (where applicable)
- Communicating schedule changes, payment reminders, and progress updates
7. Data Sharing
We do not sell or rent personal data. Data may be shared with:
- Nigeria Tennis Federation (NTF) — for tournament registration and national ranking purposes
- International Tennis Federation (ITF) — for I-PIN registration and international competition entries
- Payment Processors (Paystack) — encrypted transaction data only, for payment verification
- Emergency Services — medical/emergency data when a player's safety is at immediate risk
8. Data Security
- All data is stored on secure, access-controlled servers
- Admin access is protected by authenticated sessions with device limits (max 3 concurrent sessions)
- Parent portal access uses time-limited magic links with optional PIN protection
- Medical records and sensitive data are access-restricted to authorized coaches only
- Public-facing URLs use UUIDs to prevent sequential ID enumeration
9. Your Rights
Under the NDPA 2023, you have the right to:
- Access — Request a copy of your or your child's personal data
- Rectification — Request correction of inaccurate data
- Erasure — Request deletion or anonymization of data (subject to retention obligations)
- Objection — Object to processing based on legitimate interest
- Data Portability — Request data export in a machine-readable format (CSV)
- Withdraw Consent — Withdraw previously given consent at any time
To exercise any right, contact the Academy administration. Requests will be processed within 30 days as required by the NDPA.
10. Complaints
If you are unsatisfied with how your data is handled, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.