Privacy Notice
NEXT LEVEL ATHLETE (PTY) LTD · Registration number 2026/682028/07 Registered office: 76 Kloof Road, Sea Point, Cape Town, Western Cape, 8005 luca@nextlevelathlete.co.za · 073 281 6915
Version 1.1 · 26 August 2026 · Next review: 26 August 2027
This tells you what information Next Level Athlete holds about your athlete, why it is held, who else can see it, how long it is kept, and what you can do about any of it. It is written for the parent or guardian, because where the athlete is under 18 you are the person whose consent the law requires.
Required under section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible for the information
The responsible party is NEXT LEVEL ATHLETE (PTY) LTD, a private company registered in South Africa under registration number 2026/682028/07, with its registered office at 76 Kloof Road, Sea Point, Cape Town, Western Cape, 8005.
The company was incorporated on 26 August 2026. Before that date the business operated as a sole proprietorship in the name of Luca Inglese. No athlete information was collected under the old structure that has not been carried into the company, and the way it is handled has not changed.
The person accountable for every piece of information described below, and the person you contact about any of it, is Luca Inglese, director.
| Responsible party | NEXT LEVEL ATHLETE (PTY) LTD |
| Registration number | 2026/682028/07 |
| Registered office | 76 Kloof Road, Sea Point, Cape Town, Western Cape, 8005 |
| Why this address is here | Section 18(1)(a) of POPIA requires the name and address of the responsible party to be given to you. This is the only client document that carries a street address, and it carries it because a statute says it must. |
| Contact for all privacy questions | Luca Inglese, Director |
| luca@nextlevelathlete.co.za | |
| Phone and WhatsApp | 073 281 6915 |
2. What is collected
About the athlete:
| Category | Examples |
|---|---|
| Identity | Name, date of birth, age, gender, school, sport, playing position |
| Contact | WhatsApp number, email address |
| Health and body | Height, weight, injury history, current pain, medical conditions, medication, allergies, dietary restrictions, previous surgery, doctor or physio clearance |
| Training | Sessions completed, weights lifted, sprint times, jump heights, test results, weekly check-in answers |
| Food and habits | Typical daily eating, sleep hours, hydration, appetite, energy levels |
| Goals | Stated performance goals, team selection targets |
| Media | Photographs or video, only where a separate media release has been signed |
About the parent or guardian: name, relationship to the athlete, phone number, email address, emergency contact details, and the payment reference on your EFT.
Banking details are not collected or stored. Payment is by EFT into the account on the invoice. Next Level Athlete never sees or holds your card details, and never asks for them.
The important part
Health information about a child is "special personal information" under POPIA. It carries a higher bar than ordinary information: it can only be processed with the consent of a competent person, which for an athlete under 18 means you. That consent is the tick boxes on the intake form and the signed Health Declaration. It is not buried anywhere and it can be withdrawn.
3. Why it is collected, and what happens without it
| Purpose | Why the information is needed | Legal basis |
|---|---|---|
| Building a safe programme | A programme written without injury history can load an injured joint. Calorie targets are calculated from age, height, weight and gender using the Mifflin-St Jeor equation, so those four fields are arithmetic, not curiosity. | Your consent, and performance of the coaching agreement |
| Adjusting the programme | Weekly check-ins are what change the next four weeks | Consent and contract |
| The monthly parent report | Written for you, from the check-in rows | Consent and contract |
| Emergency response | So a paramedic can be told about an athlete's asthma without waiting for a phone call | Protecting a legitimate interest of the athlete |
| Invoicing and tax records | SARS requires records to be kept | Legal obligation |
| Marketing | Only with a signed media release. Never by default. | Separate, specific consent |
Supplying the information is voluntary. You may decline any of it.
What happens if you do: the health and body fields are the ones that matter. Without a complete and honest health declaration, a programme cannot be written safely, and it will not be written. That is not a commercial position, it is the safeguarding one. Every other field can be left blank at a cost only to how well the programme fits.
4. Where it comes from
Almost all of it comes directly from you and your athlete, through the intake forms, the weekly check-in, and WhatsApp conversations.
Nothing is bought from a data broker, scraped from social media, or obtained from your athlete's school or club without telling you first.
5. Who else can see it
Next Level Athlete is one coach. Information is not sold, rented or shared for anyone else's marketing, ever. It is held inside the following services, which process it on Next Level Athlete's instruction:
| Service | What it holds | Where it is hosted |
|---|---|---|
| Typeform | Intake form answers, including health answers | United States, on Amazon Web Services, under Standard Contractual Clauses |
| Everfit | Programme, sessions, logged training | Outside South Africa, on Amazon Web Services. Everfit does not publish the region |
| WhatsApp (Meta) | Day to day messages with you and the athlete | Outside South Africa |
| n8n | Athlete records and check-in rows | Self-hosted by the Company, not on n8n's cloud |
| Zoho Mail | Email with parents and athletes | Outside South Africa |
| Google (Gmail) | A copy of every email sent to the Company, forwarded from Zoho | Outside South Africa |
| The Company's laptop | Programme files, reports, signed documents | South Africa, on an encrypted device |
People: where a second coach, assistant or contractor works with the Company, they see only what they need to coach the athlete in front of them, they are bound in writing to the same terms as this notice and the safeguarding policy, and you are told their name before they have any access to your athlete's information.
Nobody else. Not your athlete's school, not their club, not their team coach, unless you ask for it in writing or an emergency requires it.
Information leaving South Africa
Most of the services above store information outside South Africa. Section 72 of POPIA permits this where the receiving country has comparable protection, where the processor is bound by comparable terms, or where you consent to it. By using the Company's forms and app you are consenting to that transfer. If you would rather your athlete's information stayed on a South African system only, say so, and the answer will be an honest one about what can and cannot be done.
6. How long it is kept
| Record | Kept for | Why |
|---|---|---|
| Signed agreement, indemnity, health declaration, media release | Until the athlete turns 18, then a further 3 years | Under the Prescription Act 68 of 1969 a minor's claim does not begin running while they are still a minor. Destroying the signed consent before then destroys the only evidence of what was agreed. |
| Incident and injury reports | Same as above | Same reason, more so |
| Programmes, check-ins, reports, training data | 3 years after coaching ends | Long enough to answer a question about what was prescribed |
| Invoices and financial records | 5 years | Tax Administration Act record keeping |
| WhatsApp conversation threads | 3 years after coaching ends | The thread is the safeguarding record and is not deleted mid-relationship |
| Photographs and video under a media release | 24 months from signature, or on withdrawal, whichever is first | Matches the release term |
| Enquiries that never became clients | 12 months | Then deleted |
At the end of a period the record is deleted, or the identifying fields are stripped so that what remains cannot be traced back to your athlete.
Anonymised training data may be kept indefinitely. Aggregate numbers with no name, school or identifying detail attached, used to make the programmes better. If you would rather your athlete's data was not included even anonymised, say so and it will be excluded.
7. How it is protected
Honest about the scale of this: it is one coach with a laptop and a phone, not a company with a security team.
- The laptop is full disk encrypted and password protected.
- The phone is PIN and biometric locked.
- Every service listed in section 5 has a unique password held in a password manager, with two factor authentication where the service supports it.
- Signed documents live in the athlete's own folder, not in email, not in a shared drive.
- Nothing about an athlete is discussed in a group chat, on social media, or with another parent.
If there is a breach, POPIA section 22 requires the Information Regulator and every affected person to be notified as soon as reasonably possible. You will be told what happened, what was exposed, and what is being done, in plain language and not weeks later.
8. Your rights
You may, at any time and at no charge:
| Right | What it means | POPIA |
|---|---|---|
| Ask what is held | Get a copy of everything held about your athlete | s23 |
| Correct it | Fix anything wrong, incomplete or out of date | s24 |
| Delete it | Have it destroyed where there is no longer a lawful reason to keep it | s24 |
| Object | Object to a particular use, on reasonable grounds | s11(3) |
| Withdraw consent | Withdraw consent for anything based on it, including the media release | s11(2) |
| Complain | Complain to the Information Regulator | s74 |
Withdrawing consent for the health information ends the coaching, because a programme cannot be written safely without it. That is the only case where a right exercised here changes the service. Every other right can be exercised with no effect on your athlete's coaching at all.
How to exercise any of them: message or email Luca Inglese on the details in section 1. A response comes within 14 days. There is no form to fill in and no fee.
9. Complaining to the Information Regulator
If you are not satisfied with how a privacy issue was handled, you can go over the Coach's head directly. You do not need permission and you do not need a lawyer.
| Information Regulator (South Africa) | |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| Phone | 010 023 5200 |
| Toll free | 0800 017 160 |
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Online | inforegulator.org.za, eServices Portal, POPIA Form 5 |
Contact details verified against inforegulator.org.za/contact-us on 26 August 2026. Check them again before each version of this notice goes out.
10. Children
Every athlete coached by the Company is treated as a child under POPIA unless they are 18 or older.
- Nothing is processed without a parent or guardian's consent.
- No athlete under 18 is signed up directly. A parent or guardian completes intake and is party to the agreement.
- No direct messaging with an athlete under 18 on Instagram or any social platform. Anyone who messages there is moved to a WhatsApp thread the parent is in.
- Parents are welcome on any review call and are told so.
Full detail is in the Safeguarding Policy and Code of Conduct, which you get whether you ask for it or not.
11. Changes to this notice
If this notice changes materially, you are told directly, not by a silent update to a web page. The version number and date at the top are how you tell.
Orientation, not legal advice. This notice and the rest of the document pack should be reviewed by a South African attorney in a single paid hour before the roster grows. The retention periods in section 6, and the position on a minor's claim not prescribing until they turn 18, are exactly the kind of thing worth confirming in that hour.