Privacy Policy
Phakama Analytics ("Phakama", "we", "us") is a division of SamWill Enterprises. We provide AI-powered football analytics to South African clubs. This Privacy Policy explains how we collect, use, store, and share personal information, in line with the Protection of Personal Information Act, 2013 ("POPIA").
We process personal information lawfully and only for the purposes stated below. We treat the data of lower-tier players with the same care we would treat the data of a Bafana captain.
1. Who we are
| Responsible Party | Phakama Analytics, a division of SamWill Enterprises |
|---|---|
| Information Officer | Ramone Samuels |
| Contact | popia@phakama.co.za |
| Address | Cape Town, Western Cape, South Africa |
The Information Officer is registered with the Information Regulator.
2. What information we collect
2.1 From clubs (our paying customers)
- Account information: club name, primary contact name, role, phone number, email, banking reference.
- Roster: player names, jersey numbers, positions, dates of birth (where supplied).
- Match footage uploaded by the club.
- Communications with us (WhatsApp, email).
2.2 From players (via the club)
- Identity data: name, jersey number, position.
- Performance data extracted from footage: events touched (passes, shots, tackles), location on the pitch, contribution to expected goals, etc.
- Image data: stills and clips drawn from match footage.
We do not collect biometric data, ID numbers, contact details, or sensitive personal information about players unless the club explicitly provides it for a contractual reason and the player has consented in writing.
2.3 From third-party public sources
For opposition-report generation we may use publicly available data (FBref, league websites, club social media) about teams and players. We do not collect private or paywalled information.
3. Why we collect it (lawful purpose)
- To deliver the services in our Service Agreement — match reports, opposition reports, clip reels, dashboards.
- To bill and account — invoices, receipts, statutory records.
- To improve our models — aggregated, anonymised performance data.
- To communicate with the club's primary contact.
- To operate the optional Player Database for cross-club recruitment shortlists (only with both club and player opt-in).
We will never sell personal information.
4. How we share it
We share personal information only as needed to deliver the services:
- With sub-processors under written data-processing agreements (Google Workspace for storage; Anthropic for LLM commentary; Roboflow for computer-vision; Supabase for the event database; Make.com or n8n for automation; WhatsApp Business API for delivery).
- With law enforcement or regulators where compelled by law.
Reports are confidential to the buying club. We do not show one club's reports to another club, ever.
5. How long we keep it
| Data | Retention |
|---|---|
| Match footage (raw) | 90 days from upload, then deleted (or moved to client-owned cold storage on request) |
| Structured event data | Length of the active Service Agreement plus 12 months |
| Reports + clip reels | Stored in the client's Drive folder; the client owns them and chooses how long to keep them |
| Billing records | 5 years (statutory requirement) |
| Marketing communications | Until the recipient opts out |
6. How we keep it safe
- All data lives in South African or EU-region cloud regions where available.
- API keys and credentials are stored in environment variables only, never in code repositories or shared documents.
- Two-factor authentication is required on every administrative account.
- Access to client folders is limited to the founder and operations lead.
- Sub-processors are vetted for POPIA-equivalent or stronger standards.
7. Your rights (POPIA Section 23 onwards)
- Be informed that we process your personal information (this policy is that notice).
- Access the personal information we hold about you.
- Correct any personal information that is inaccurate.
- Delete personal information that is no longer needed for its lawful purpose.
- Object to processing on reasonable grounds.
- Withdraw consent at any time, where consent is the basis for processing.
- Lodge a complaint with the Information Regulator: complaints.IR@inforegulator.org.za.
To exercise any of the above, email popia@phakama.co.za. We will respond within 30 days.
8. Cross-border transfers
Some of our sub-processors store data outside South Africa (e.g. Anthropic, Roboflow). We only transfer personal information to such sub-processors where they offer protections adequate under POPIA (typically GDPR-equivalent contracts).
9. Cookies and our website
This website uses essential cookies only. We do not run third-party advertising or tracking pixels. Analytics, when added, will use a privacy-respecting tool (e.g. Plausible) with no personal identification.
10. Changes to this policy
We will publish any material change to this policy here and notify active clients by WhatsApp at least 30 days before the change takes effect.
Questions: popia@phakama.co.za. We answer within 30 days, usually within 3.