Version 1.0 · Effective 15 September 2026 · vegaaiautomations@gmail.com
This notice explains how personal information is handled when schools use Vega Velocity at vegaautomations.co.za, including through its installed progressive web app. It covers school representatives, coaches, players, parents and guardians, website visitors, and people appearing in material uploaded to the service.
Vega Velocity supports school netball programmes through squad management, Match Day, match analysis, coaching reviews, trial assessments and opposition scouting. The information processed depends on the features a school uses and the material its staff provide.
Vega Velocity is supplied by Estienne Bruwer, trading as Vega AI Automations (Vega, we, us or our).
For a player record or coaching decision, contact the relevant school’s Information Officer first. The school must provide its own identity, address and privacy contact details in its notices to players and parents. If you cannot identify or reach the school contact, contact Vega and identify the school so we can help route the request.
The school is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for player and programme information where it determines the purposes and means of processing. It decides what to collect, what features to use, who has access, and how coaching information is acted upon. It is responsible for its lawful basis, required notices and authorisations, and handling people’s rights.
Vega acts as the school’s operator when storing or analysing that information on its behalf and instructions. Our written operator agreement addresses those activities. Vega remains responsible for its own operator duties, including confidentiality, appropriate security and incident notification.
Vega acts as a responsible party for information it uses for its own business purposes, such as managing subscriptions, billing, enquiries, security administration and legal records. Roles follow the actual processing activity; this notice does not transfer Vega’s legal duties to a school.
We receive information directly from school representatives and other people who contact us; through the school’s staff and uploads; from service providers involved in delivering the service; and through the operation of the website and app. Analysis also creates new information, including ratings, extracted text and written assessments.
| Category | Examples and sources |
|---|---|
| School account and subscription | School name, contact details, authorised representative details, account identifiers, subscription plan and acceptance records supplied during registration or purchase. |
| Players and squads | Player names and identifiers, age groups U14 to U19, A/B/C team allocation, positions and squad changes entered by school staff. No date of birth and no photograph is stored on a player record. |
| Match Day | Lineups, positions, substitutions, player movements and related match records entered by coaches. |
| Footage and coaching material | Videos, images, scorecard photographs, team sheets and notes uploaded by staff. These may contain faces, voices, kit details and information about opponents, officials or bystanders. |
| Analysis and trial records | Text extracted from scorecards, scores, ratings, coaching observations, heat maps, scouting reports and AI generated assessments derived from submitted material. |
| Billing and communications | Invoice and transaction references, payment status, billing details, support messages and attachments. Payments are taken through Yoco’s hosted checkout. Vega receives the checkout and payment references, the amount, the currency and the payment status. Card details are entered on Yoco’s own page; no card number, expiry date or security code is received or stored by Vega. |
| Technical and security records | An authentication session cookie, server request logs kept by our hosting provider, and error reports. Error reports are sent with personal information disabled, without session recording or performance tracing, and any field whose name suggests a player, roster, name, email, report, scouting, trial, opponent, token, key or cookie is removed before the report leaves the browser. No analytics or advertising trackers are used. |
Uploads may reveal health, injury or other special personal information even when there is no dedicated field for it. Schools must avoid including unnecessary sensitive information. Processing such information requires the additional authorisation and safeguards applicable under POPIA.
A photograph or video can identify a person without naming them. Identifiable assessments and opinions about a player are also personal information, including when an assessment is generated by AI or later found to be incorrect.
Account, contact and billing information needed to supply the subscription is required for that service. Without it, we may be unable to create or administer the account, process payment or respond to a request. Individual feature inputs are required only when the school chooses the relevant feature; for example, video analysis requires suitable footage.
POPIA does not itself require a school to upload players’ information to Vega Velocity. The school must explain which information it requires from players, whether any particular law requires it, and the consequences and available alternatives if it is not provided. Optional marketing choices are separate from access to the service.
On the school’s instructions, Vega organises squads; records Match Day participation; analyses matches, technique and decisions; extracts trial scores; generates AI recommendations; and describes opposition patterns. This includes the storage, retrieval, support, correction and deletion needed for those functions. Vega uses business account and contact information to manage subscriptions, invoice schools, answer enquiries, investigate faults and abuse, secure the service, keep necessary legal records and send service messages. Marketing is addressed in section 14.
Processing is limited to the relevant purpose. New uses require an appropriate lawful basis and compliance with POPIA’s further-processing rules.
For school programme information, the school must identify and document a lawful basis under POPIA section 11 and, for children’s information, an applicable authorisation under section 35. A contract between Vega and a school does not by itself provide a lawful basis for every use of a player’s information.
For information Vega processes as a responsible party, the applicable basis depends on the activity: performance of a contract with the data subject where applicable; compliance with a legal obligation for required records; legitimate interests in administering the school relationship, responding to enquiries and protecting the service where lawfully justified; or consent where the activity requires it. These bases are not interchangeable permission for all processing.
POPIA generally treats a person under 18 who is not legally competent to act without assistance in the relevant matter as a child. Before processing a child’s information, the school must obtain valid prior consent from a competent person, normally a parent or guardian, or establish another applicable section 35 authorisation. The normal processing conditions still apply. Players aged 18 or over retain their own privacy rights and require an appropriate lawful basis.
The school must explain the actual intended uses, including AI analysis, who receives information and relevant overseas processing. General permission to play netball or appear in school photographs must not be assumed to cover every use in this app. The school retains evidence of the required consent or other authorisation; Vega does not obtain parental consent for the school.
If the school ticks a purchase acknowledgement, that records its acknowledgement or contractual acceptance. It is not a parent’s consent, a waiver of privacy rights or consent to every future use. Where consent is relied upon, it can be withdrawn for future processing. Withdrawal does not retrospectively invalidate processing that was lawful before withdrawal.
AI features process submitted content and relevant context to produce extracted text, observations, ratings, recommendations and visual summaries. Information can be sent to an external AI service to perform that task.
AI output may be incomplete, biased or inaccurate. Coaches must review it and make the final selection, promotion, demotion and coaching decisions. A player or competent person may ask the school to correct factual errors, explain how an assessment was used and arrange meaningful human review. Decisions with legal or similarly substantial effects must comply with POPIA section 71.
Vega does not use school content to train any model. Google’s Gemini API Paid Services terms state that prompts and responses are not used to improve Google’s products and are processed under its data processor addendum, with limited-period logging for abuse detection. This depends on the API being used on paid quota, which is how the service is configured.
Access and disclosure are limited to the relevant purpose and a lawful basis. Recipients may include authorised staff at the school; Vega personnel who need access to provide support or administer the service; contracted hosting, storage, authentication, AI and communications providers; payment providers for billing; and professional advisers, regulators or authorities where a lawful need or obligation applies. School player information is not made available to another school merely because it uses Vega Velocity.
Where a supplier acts as an operator, processing must be governed by appropriate written terms, confidentiality obligations, security requirements and authorised purposes. Where a payment provider or other recipient acts independently as a responsible party, its notice applies to its own activities. Necessary supplier processing is not permission for unrelated advertising or reuse.
Personal information is not sold, rented or shared for advertising. School player information is not used for product demonstrations, public testimonials or product research. Any secondary use would require a separately assessed lawful basis and the school’s authorisation.
Personal information may be processed outside South Africa where a disclosed supplier hosts, analyses, backs up or accesses it abroad. This includes remote support access.
| Service | Provider and processing disclosure |
|---|---|
| Hosting and storage | Application data is held by Supabase in Ireland and served from Railway in Amsterdam, both in the European Economic Area. Material submitted for analysis is processed by Google under the Gemini API Paid Services terms and may be stored transiently or cached in any country in which Google or its agents maintain facilities. These are transfers outside South Africa for the purposes of section 72 of POPIA, made to provide the service the school has contracted for and subject to each provider’s data processing terms. |
| AI analysis and OCR | Analysis uses the Google Gemini API on paid quota, through a Google Cloud project with active billing, which makes it a Paid Service under Google’s Gemini API Additional Terms. Material sent includes match video, photographs of paper scorecards, and prompts that may contain player names and positions. Under those terms Google does not use prompts or responses to improve its products, processes them under the Data Processing Addendum for products where Google is a data processor, and logs them only for a limited period to detect abuse and meet legal obligations. |
| Authentication and support | Supabase (database, authentication and file storage; West EU, Ireland); Railway (application hosting; EU West, Amsterdam); Google (Gemini API, for analysis); Yoco (payments, South Africa); Sentry (error reporting). Each receives only what its function requires, under that provider’s terms. |
| Payments and other services | Yoco processes payments in South Africa and receives the payment details entered on its checkout. Supabase sends the account invitation email. Sentry receives error reports with personal fields removed. No analytics provider is used. |
Cross-border transfers must satisfy POPIA section 72, for example through an adequate level of protection secured by applicable law or a binding agreement, or another applicable statutory ground. Where section 57 requires prior authorisation for a transfer of children’s or special personal information, the required regulatory process must be completed before processing may lawfully proceed. A school’s purchase checkbox does not replace those requirements.
Personal information is kept only for as long as authorised and necessary for its purpose, subject to applicable legal requirements and valid preservation obligations. The school determines the necessary retention of its programme records and gives lawful deletion or return instructions under the operator agreement. An active subscription alone does not justify retaining every record indefinitely.
| Record | Retention and deletion |
|---|---|
| Player profiles and programme records | For the school’s documented programme purpose, with review and deletion instructions. After account closure: 30 days to request a copy of the school’s data, and deletion from live systems within a further 30 days. |
| Source videos and scorecard images | Vega does not keep source video. Match video is uploaded to Google’s analysis service, referenced for the length of the analysis and then left to expire under Google’s own retention; only the written analysis is saved. A video supplied as a link is never uploaded at all. Scorecard photographs are sent for analysis without being stored by either Vega or Google, so only the extracted text and scores remain. Do not assume a report’s expiry also deletes its source material. |
| Opposition scouting reports | 120 days under the stated product policy. The 120 day period for an opposition scouting report runs from the review date recorded on that report. Deletion is automatic and runs daily. A report whose date cannot be read is kept and flagged for a person to check rather than deleted. |
| Other analysis and trial results | For the school’s authorised purpose and long enough to allow any legally required opportunity to request access to a decision record. Reviewed annually, with deletion completed within 30 days of account closure. |
| Billing and acceptance records | For applicable accounting, tax, contractual and dispute requirements. Billing and payment records are kept for five years to meet South African tax and company record-keeping requirements. Records of acceptance of the terms are kept for the duration of the account and for three years afterwards, as evidence of the agreement between the parties. |
| Support and technical records | Support messages are kept for 12 months. Access and security logs are kept for 90 days. Error and diagnostic reports are kept for 90 days. |
| Backups and provider copies | Deleted records may persist in our providers’ backups until those backups expire, up to 30 days. Material submitted to Google for analysis is retained under Google’s Gemini API Paid Services terms, which provide for limited-period logging for abuse detection only. Deleted information must not return to ordinary use after a restoration. |
Deletion may be restricted where retention is lawfully required for a dispute, investigation, statutory obligation or another POPIA ground. The retained information must be limited and protected, with access restricted to that purpose. We explain any applicable limit on a deletion request. School-held exports and screenshots follow the school’s own lawful retention process.
We are required to establish and maintain appropriate, reasonable technical and organisational safeguards for information under our control, assess foreseeable risks and keep safeguards under review. These obligations include protecting confidentiality and restricting access to authorised purposes. No online service can guarantee that every security incident will be prevented.
All traffic to the service is encrypted in transit over HTTPS. Each school’s records are separated inside the database by row-level security rules, so a school’s data cannot be returned to another school’s account even if application code were at fault. Passwords are set by the school and stored only as hashes by Supabase; Vega never sees them. Error reports are stripped of personal fields before being sent. Card details are never received. Encryption at rest and backup facilities are provided by Supabase and Railway under their terms. No security certification or independent audit is claimed.
Where Vega acts as an operator, we notify the school immediately when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. We cooperate with investigation and containment. The school handles the notifications required of it under POPIA section 22. Where Vega is the responsible party, Vega makes its own required notifications to the Information Regulator and affected people as soon as reasonably possible, subject to the Act’s qualifications.
Report suspected unauthorised access or disclosure to the privacy contact in section 1. Include the school name and enough detail to investigate, but do not send passwords or unnecessary player information.
Service messages concern the account or its operation, such as billing, support and security notices. If we send electronic direct marketing, we do so only where POPIA permits it, including through valid consent or the applicable existing-customer exception and its conditions. Marketing messages identify the sender and provide a way to opt out without charge. You may also contact us to stop marketing. Opting out does not prevent necessary service messages.
No marketing is sent. The only message the service generates is the invitation email that lets a new school set its password. No parent contact details are collected, and school programme data is not used for marketing.
Subject to POPIA and other applicable law, you may ask whether a responsible party holds your information; request access to it and information about relevant third-party access; request correction of inaccurate or misleading information; request deletion of information that is unlawfully obtained or no longer authorised to be retained; object to processing on grounds recognised by POPIA; withdraw consent where consent is the basis; and request restriction of processing where the statutory conditions apply.
You may also raise concerns about automated decisions and lodge a complaint with the Information Regulator. These rights apply to AI generated information about you as well as information originally supplied. A competent person may act for a child where legally authorised. We may require reasonable proof of identity and authority, limited to what is necessary to prevent disclosure to the wrong person.
For school programme records, send the request to the school’s Information Officer. Vega assists the school under the operator agreement. If you contact Vega directly, we will help identify the responsible party and refer or coordinate the request where appropriate. For information Vega controls for its own purposes, contact Vega directly using section 1.
Describe the information or decision, the school concerned and what you want corrected, accessed, restricted or deleted. Do not send a full identity document unless it is needed and a suitable submission method has been agreed. We respond within the applicable legal time limits and explain any lawful refusal, necessary limitation or permitted fee. You do not need a paid Vega account to exercise your rights.
A withdrawal, objection or deletion request may mean that a particular feature can no longer process your information. It does not automatically require deletion of information that must lawfully be retained. The responsible party must assess the request and explain the outcome, rather than treating school participation as a blanket waiver of privacy rights.
You may raise a privacy concern with Vega or the school, depending on the processing concerned. You may also complain to the Information Regulator. This notice does not make an internal complaint a prerequisite to exercising a POPIA complaint right.
Information Regulator South Africa
Complaint guidance and submission options
Information Regulator eServices Portal
The Regulator’s complaint guidance directs users to register a profile and submit through its eServices Portal. Consult its current guidance or contact it for help choosing the appropriate complaint route.
We update this notice when the service, processing or legal requirements change. We identify the version and effective date and communicate material changes to the school account contact. Schools must pass relevant changes to affected people where required.
Changes do not retrospectively authorise processing. New uses require a lawful basis, updated disclosures and any necessary consent; continued use alone does not provide that consent.
Read this notice with the Terms of Service, school POPIA acknowledgement and written operator agreement. They address the subscription, school responsibilities and operator processing respectively. None overrides statutory rights.
Schools must also provide their own notices covering their collection, purposes, lawful grounds, recipients and rights process.
At purchase, a checkbox records acknowledgement of this notice alongside contractual acceptance. It requires no handwritten signature and does not replace consent for children’s data, optional marketing or optional tracking.