SCAH Privacy Policy

This Policy explains how SCAH collects, uses, discloses, and protects personal data of athletes (including minors), scouts, academies, and visitors to the Platform.

It should be read together with the Cookie Policy.

We do not knowingly collect biometric identifiers (e.g., facial-recognition templates) at this time; if SCAH later introduces facial recognition or biometric matching, this Policy and consent flows will be updated before launch.

4.1 Where an account belongs to a user aged 13–17

1. Verifiable parental/guardian consent obtained before account activation.
2. No use of a minor's data for behavioural advertising, profiling for marketing, or sale/sharing with data brokers.
3. No public display of precise location, school, or home address.
4. Parent/guardian has standing rights to access, export, and delete the minor's data at any time.
5. Retention of minors' data limited to what is necessary, with automatic deletion after 6 months of inactivity or when the user turns 18 and does not re-consent.

4.2 Under-13 registration

SCAH does not knowingly collect data from a person under 13 through a self-registered account. If we learn we have inadvertently collected such data, we will delete it promptly and notify the submitting guardian.

5.1 We share data with:

• Other users, based on profile visibility settings and, for minors, subject to the Guardian-CC'd Channel.
• Service providers including hosting, infrastructure, cloud storage, analytics, customer support, and ID-verification vendors under confidentiality agreements.
• Academies and scouts users actively engage with through tryout applications.
• Law enforcement/regulators where legally required or necessary to protect a child from harm.
• A successor entity in the event of merger, acquisition, or asset sale.

5.2

We do not sell personal data and do not share data for cross-context behavioural advertising purposes involving minors' data.

SCAH's infrastructure may process data outside Nigeria (for example cloud hosting in the EU/US).

Where EU/UK resident data is transferred outside the EEA/UK, we rely on Standard Contractual Clauses or the UK IDTA, supplemented by a transfer risk assessment.

Where Nigerian data subjects' information is transferred outside Nigeria, SCAH ensures adequate protection consistent with NDPA 2023 requirements.

We apply technical and organisational measures including encryption in transit (TLS), access controls, and staff training, particularly for personnel with access to minors' data or safeguarding reports.

In the event of a personal data breach, we will notify the Nigeria Data Protection Commission (NDPC) within the NDPA mandated timeframe and notify affected users without undue delay.

All users may request access, correction, deletion, restriction of processing, data portability, and objection to processing based on legitimate interest.

Guardians of minor accounts may exercise these rights on behalf of the minor at any time.

EU/UK users may lodge complaints with their local supervisory authority.

California residents have rights under CCPA/CPRA including access, deletion, correction, and opting out of sale/sharing.

Verified requests will generally be responded to within 30 days as a working standard.

SCAH may use algorithms to rank or recommend tryout listings or suggested people. These systems do not make final scouting or selection decisions.

Users may request human review of rankings that materially affect their visibility.

We will notify users of material changes through in-app notices and email at least 30 days in advance.

For minor accounts, guardians will also be notified and additional consent may be requested where data use expands.