Privacy Policy

1. Introduction

This Privacy Policy explains how Lebelosport (Pty) Ltd collects, uses, shares, retains and protects your personal information when you use the Lebelo platform at lebelosport.co.za and any associated mobile or installable application (together, the "Services").

Lebelosport (Pty) Ltd (registration number 2026/504186/07) is a private company registered in the Republic of South Africa. "Lebelo" is our trading style. We are the responsible party for the personal information described in this policy, and we process it in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This policy tells you what we collect, why we collect it, the lawful basis we rely on for each purpose, who we share it with, how long we keep it, and the rights you have. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

2. Who we are and how to contact us

We have designated an Information Officer, registered with the Information Regulator, who is responsible for our compliance with POPIA and for handling requests and complaints relating to your personal information. All privacy requests should be sent to compliance@lebelos.co.za so that they reach the right person and are logged and tracked.

3. What personal information we collect

3.1 Information you give us

• Account details: name, surname, email address, mobile number, and authentication credentials.
• Athlete profile: date of birth, gender, province, display name or username, and profile photograph where you choose to add one.
• Club and membership information: the club you belong to, your membership and roster status, and membership fee status recorded by your club administrator.
• Athletics licence application information: the information required by the applicable athletics licence application form, including your South African identity number or passport number, club, province and licence category.
• Emergency contact details: the name, relationship and contact number of a person you nominate. You are responsible for ensuring that person is aware you have provided their details to us.
• Health and medical information: medical aid details, allergies, conditions or other health information, only where you choose to provide it for event-safety purposes.
• Event and results information: event entries, finish times, positions, categories and certificates.
• Content you post: messages, announcements, comments and other content you submit to a club board or community board.
• Payment information: transaction records for entries, memberships, subscriptions and licence fees. Card details are handled by our payment processor and are not stored by Lebelo.
• Photographs and images you upload: your profile photograph, and any images you choose to post — training photographs, race-day and finish-line photographs, club event photographs. These may show you, and may show other people.
• Support information: the information you give us when you contact us for help, including any account details you share so we can investigate. Where necessary to resolve a reported issue, we may need to access your account.

3.2 Location information

Location information is central to several features and is treated with particular care.

• Route and course data: the geographic co-ordinates of routes you build or events you create, including start and finish points and the jurisdictions a route passes through.
• Activity location: where you connect a fitness service, the recorded route of your activities, which can include the precise start and end points of a run.
• Province and area: the province recorded on your profile and, where you join an area group, the area you select.

Precise location can reveal sensitive things about you, including where you live and work and when you are away from home. Please use location-sharing features responsibly, particularly if you hold a sensitive role or position. Where the platform allows you to hide or obscure the start and end of an activity, or to keep a route private, we encourage you to use those controls. We do not publish precise activity start points on public leaderboards.

3.3 Photographs — metadata and other people

Running is a visual sport and the platform is built to carry photographs. Two things about images need saying plainly.

We strip location metadata from images on upload. A photograph taken on a phone usually carries hidden EXIF data — the exact GPS co-ordinates and the time it was taken. A finish-line photograph, or a picture from a training run, can therefore disclose precisely where you were and when. We remove location and device metadata from uploaded images automatically. Where you want a photograph associated with a route or an event, that association comes from the record you attach it to, not from hidden data in the file.

Photographs of other people. Race and club photographs usually show other runners. An identifiable image of a person is their personal information. If you upload an image showing other people, you are responsible for having their agreement where the setting makes that reasonable — and always where a child is identifiable. Anyone who appears in an image on the platform can ask us to remove it by contacting compliance@lebelos.co.za, and we will act on that request without requiring them to explain themselves.

We do not run facial recognition. We do not analyse images to identify people, tag them automatically, or build biometric templates. Photographs are associated with an athlete, an event or a club only because someone attached them there.

3.4 Information we generate about you

• Performance metrics: we calculate metrics from your information, including personal bests, age-graded performance, training consistency and the Lebelo Score. These are derived values, not information you give us directly.
• Rankings and standings: your position on club, provincial and national leaderboards, and your club's position in club competitions.
• Compliance and readiness scores: where you are an event organiser, a calculated readiness score for your event's permitting documentation.

3.5 Information collected automatically

• Technical data: IP address, device and browser type, operating system, and application version.
• Usage data: features used, pages viewed, interaction logs, and crash or diagnostic reports.
• Consent and audit records: a record of the consents and acknowledgements you give, including the policy version, date and time.

3.6 Information from third parties you connect

• Training and activity data from a fitness service you choose to connect (for example Strava), including activity distance, duration, pace, route and heart-rate data where available. We receive this only after you authorise the connection, and we stop receiving it when you disconnect.
• Race results published by event organisers or timing providers, where you claim a result as your own.
• Club-administrator entries, where your club records roster, membership or verification information about you.
• Other users, for example where another member comments on a club post you made, or where a club captain adds you to a relay team.
• Third-party sign-in, where you choose to sign in using an account with another provider. In that case we receive only the information needed to authenticate you.

3.7 Special personal information

Some information we process is "special personal information" under POPIA and receives additional protection:

• Health and medical information.
• Race or ethnic origin, where a licence or governing-body application form requires a demographic field.

We process special personal information only with your explicit consent, or where POPIA otherwise permits it. Consent for special personal information is requested separately and can be withdrawn independently of your other choices. See section 5.

3.8 Children and minors

The minimum age to hold a Lebelo account is 16. A person aged 16 or 17 may use the Services only with the consent of a parent or legal guardian, captured through the guardian consent process. A child under 16 may not hold an account, but may be recorded as a junior athlete by a parent, legal guardian or club administrator for club membership, event entry or a licence application. In that case we process the child's information on the authority of that competent person.

Where the Services are used by a person under 18, we process that person's personal information only with the prior consent of a competent person (a parent or legal guardian), as required by POPIA. Guardian consent is captured and recorded as part of the minor registration and licence flow. A guardian may withdraw consent and request deletion at any time by contacting compliance@lebelos.co.za.

Where a member is under 18, privacy-protective settings apply by default, including public leaderboard listing being switched off.

4. Why we process your information

We process your personal information to:

• create, manage, secure and authenticate your account;
• provide the core platform: your athlete profile, training log, route mapping, race history and personal bests;
• operate club functionality, including rosters, membership records, fee tracking, announcements and communications;
• process and administer athletics licence applications, including verification by your club and submission to the applicable athletics authority;
• operate event listings, entries, results and certificates;
• operate leaderboards, scores, challenges and club competitions in which you take part;
• compile compliance and event-permitting documentation for event organisers;
• process payments, subscriptions and refunds;
• send you operational messages such as entry confirmations, payment receipts, licence expiry reminders and safety notices;
• send you marketing communications where you have asked to receive them;
• moderate content reported on club or community boards, and keep a record of moderation decisions;
• maintain the security, integrity and reliability of the Services, and investigate misuse; and
• comply with our legal, tax and regulatory obligations.

5. The lawful basis we rely on

POPIA requires a lawful basis for each processing purpose. We do not present as optional any processing that the Services cannot operate without. The table below sets out the basis we rely on for each category.

Withdrawing consent. Where we rely on your consent you may withdraw it at any time from the Privacy screen in your account, or by emailing compliance@lebelos.co.za. Withdrawal takes effect going forward and does not affect processing already carried out. Where withdrawal means we can no longer provide a particular function — for example, a licence application that cannot proceed without a required field — we will tell you before you confirm.

6. How we share your information

We do not sell your personal information, and we do not serve third-party advertising on the Services.

We share personal information only as set out below.

6.1 Your club

If you are a member of a club on Lebelo, that club's administrators can see the membership, roster, fee-status and licence-verification information necessary to administer your membership. Your club acts as a separate responsible party for the purposes for which it uses that information, under a written operator or data-sharing agreement with us.

6.2 Athletics authorities

Where you apply for an athletics licence, your application is submitted to the applicable provincial athletics body and to Athletics South Africa. Those bodies remain the issuer and record-holder of your licence. Where a licence form includes a demographic field or health information, that element is submitted only with your explicit consent.

6.3 Event organisers

When you enter an event, we share with the organiser the information they need to run it safely and to record your result — including your name, category, entry details, licence number where applicable, and your emergency contact and any medical information you have provided.

6.4 Operators (service providers)

We use the following operators, who process personal information on our behalf under written contract and may not use it for their own purposes:

6.5 Information visible to other users and the public

Some information is visible to others as an ordinary part of how the platform works. We keep public-by-default to a minimum, but you should understand what is visible:

• Visible to your club: your name, profile photo, membership and licence status, and any content you post to the club board.
• Visible publicly where you switch it on: your name, club and ranking on public leaderboards. This is off unless you enable it.
• Visible publicly by nature: race results. Once you have taken part in a public event, your name, category, finishing position and time form part of that event's published record — as they would in any published set of race results.
• Visible to event organisers: your entry details for events you enter.
• Photographs: visible wherever you posted them — a club board, an event, or your profile. A photograph attached to a public event record is visible publicly.

Content you post to a club or community board can be seen, copied or shared by other members. Please treat anything you post as potentially permanent.

6.6 Aggregated and de-identified information

We may produce and use aggregated or de-identified information — for example participation trends by province, or event-sector statistics — that cannot reasonably be linked back to you. Where we share such information with partners or use it publicly, it does not identify individuals. If de-identified information could ever be re-linked to you, we treat it as personal information.

6.7 Legal and safety

We may preserve, disclose or use personal information where we reasonably believe it is necessary to:

• comply with a law, regulation, court order, subpoena or other legal or regulatory process;
• prevent death or serious injury, or respond to an emergency at an event;
• detect, prevent or address fraud, security incidents, or breaches of our terms; or
• establish, exercise or defend a legal claim, or protect the rights, safety and property of Lebelo, our users or the public.

6.8 Business transfer

If Lebelo is involved in a merger, acquisition, restructuring or sale of assets, personal information may be transferred as part of that transaction. We will notify you and the receiving party will remain bound by this policy or a policy no less protective.

7. Cross-border transfers

Our primary database and storage are hosted in the European Union, and some of our operators store or process information outside South Africa. Where personal information is transferred across borders, we transfer it only where the recipient is subject to a law, binding corporate rules or a contract that provides an adequate level of protection substantially similar to POPIA, or where another basis permitted by section 72 of POPIA applies.

8. How we protect your information

We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing. These include:

• encryption in transit (TLS) for all connections;
• encryption at rest for identity numbers and other sensitive identifiers, using AES-256-GCM;
• row-level access controls in the database, so users and clubs can access only their own data;
• role-based access, with production data access restricted to named individuals;
• exclusion of sensitive identifiers from self-service data exports;
• secure authentication, and audit logging of sensitive actions;
• no third-party advertising, analytics or tracking cookies on the platform; and
• periodic internal security and privacy review.

No system is completely secure. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as required by section 22 of POPIA, and in accordance with our Breach Response Protocol.

9. How long we keep your information

We keep personal information only for as long as necessary for the purposes set out in this policy, or as required by law.

When you delete your account, we delete or irreversibly anonymise your personal information within 90 days, except where we are required to retain specific records for legal, tax or regulatory purposes. Anonymised information can no longer be linked to you and may be retained for statistical and historical purposes, including aggregate race records.

9.1 What remains after you close your account

Some information does not disappear when you close your account, and it is fairer to say so plainly than to imply a clean erasure we cannot deliver:

• Race results form part of the published record of a public event and remain in that event's results, as they would in any published results list.
• Content you posted to a club or community board may remain visible where removing it would break the thread it belongs to, though it is dissociated from your profile.
• Financial and licence records are retained for the statutory periods above.
• Information already held by your club or an athletics authority is not ours to delete. Your club and your provincial body hold their own records, and you would need to approach them directly.

Everything else is deleted or irreversibly anonymised. Once anonymised, information cannot be restored or re-linked to you.

10. Artificial intelligence and automated processing

We do not use your personal information to train artificial intelligence or machine-learning models, and we do not sell or supply your personal information to third parties for that purpose.

Where we use automated processing, it is limited and rule-based:

• Scores, rankings and metrics are calculated by a defined formula from your own activity and results. The components of your Lebelo Score are shown to you so you can see how it is derived.
• Compliance readiness scores are calculated from the documentation an organiser has supplied against a published checklist.
• Security and integrity checks may flag unusual activity — for example a result that cannot have been achieved on the recorded course — for review by a person.

These are enrichment and integrity measures. They are not medical, health, coaching or eligibility assessments, and they do not by themselves determine your membership, your licence or your eligibility to compete. Any decision affecting your standing on the platform is reviewed by a person. If a third-party service that uses artificial intelligence is ever introduced, we will update this policy and, where required, seek your consent before it is used on your information.

11. Your rights

As a data subject under POPIA you have the right to:

• be told what personal information we hold about you, and request access to it;
• request correction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• request deletion or destruction of information we are no longer entitled to retain;
• object, on reasonable grounds, to processing based on legitimate interests;
• withdraw a consent you have given, at any time;
• object to receiving direct marketing;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects for you; and
• lodge a complaint with the Information Regulator.
• obtain a copy of your information in a portable format.

You can exercise many of these rights directly in the application: correct your profile, adjust your privacy and consent settings, remove individual activities, export a copy of your data, and close your account.

For anything else, contact compliance@lebelos.co.za. We may need to verify your identity before acting on a request. We will respond within a reasonable period and in any event within the timeframes required by POPIA. A formal request for access may be made using the Form 2 prescribed under the Promotion of Access to Information Act; our PAIA manual sets out that process and is available on request.

Automated decision-making is addressed in section 10.

Direct marketing. Every marketing message includes a way to opt out, and opting out is free and takes effect promptly. Opting out of marketing does not stop operational messages such as entry confirmations, payment receipts, licence expiry reminders or event safety notices.

12. Cookies and similar technologies

We use cookies and similar technologies only where they are necessary for the Services to work — for example to keep you signed in and to maintain your session securely. We do not use advertising cookies, and we do not run third-party analytics or tracking tags. You can control cookies through your browser settings, but disabling essential cookies will prevent you from signing in.

13. Changes to this policy

We may update this policy from time to time. Each version carries a version number and effective date. Where a change is material, we will notify you in the application or by email and, where the change affects a purpose for which we rely on your consent, we will ask for your consent again. We keep a record of which version you accepted and when.

14. Complaints

If you have a question, request or complaint about how we handle your personal information, please contact us first:

• Email: compliance@lebelos.co.za
• Information Officer: Odirile Moalusi
• Address: 4 Dexter Road, Northumberland Park, North Riding, Gauteng

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa.

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200 · Toll free: 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

A complaint to the Regulator is lodged on the prescribed Form 5, which is available from the Regulator's website.