ApexTrack ("we", "us", "ApexTrack") provides a comprehensive football performance, squad management, and payroll platform built for clubs across Ghana and Africa. This policy outlines what information we collect, why, and how we protect your club's data, in alignment with the Data Protection Act, 2012 (Act 843) of Ghana as well as applicable international standards (including UK/EU GDPR where applicable).
1. Who We Are
ApexTrack is operated as a cloud-based software service for sports clubs, academies, and professional sports organisations. For privacy and data protection inquiries, contact our Data Protection Officer at admin@apextrackgh.com.
2. Data We Process
Depending on your club's active modules, we process:
- Account & User Data: Name, work email, phone number, user role (Superadmin, Admin, Coach, Physio, Analyst), login credentials, and session logs.
- Athlete & Squad Profiles: Player identity, age, position, match performance statistics (goals, assists, xG, xA, ratings), contract details, and transfer histories.
- Medical & Injury Logs: Injury type, recovery progress, treatment notes, return-to-play clearance dates, and rehab logs.
- ApexPay Payroll & Wallet Data: Staff salary amounts, Mobile Money (MoMo) account details, transaction reference numbers, wallet balances, and disbursement logs.
- Club Assets & Documents: Official logos, contract PDFs, and generated executive reports.
- Technical Data: IP addresses, browser types, device identifiers, and system diagnostic logs.
3. Purpose and Legal Basis for Processing
- Service Delivery: Managing club rosters, generating performance reports, executing squad management workflows, and processing Mobile Money disbursements via ApexPay.
- Security & Access Control: Enforcing strict tenant isolation (PostgreSQL Row Level Security) to prevent unauthorized access across clubs.
- Administrative Communications: Sending service notifications, email verification links, and billing alerts.
- Compliance: Fulfilling financial record-keeping requirements for payroll transactions and meeting legal obligations under local laws.
For athlete and injury data, your club acts as the Data Controller, while ApexTrack serves as the Data Processoracting on the club's instructions.
4. Sub-Processors & Service Providers
We work with trusted third-party providers to deliver high availability and secure transactions:
- Supabase — Cloud database, user authentication, and encrypted file storage.
- Vercel — Web application hosting, serverless execution, and edge routing.
- Paystack & Moolre — Mobile Money (MTN MoMo, Telecel Cash, AT Money) and card payment processing for club subscriptions and wallet top-ups.
- Resend — Transactional email delivery for notifications and verification emails.
5. Data Security
We employ multi-layer security measures, including HTTPS/TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access controls (RBAC), and Row Level Security (RLS) policies at the database layer to guarantee complete isolation of club databases.
6. Data Retention & Deletion
Club data is maintained for the duration of your active subscription or trial. Upon account termination or written deletion request, records are securely deleted or anonymized within 30 days, except where financial or legal obligations mandate longer retention.
7. Your Rights
Individuals have the right to request access to, correction of, or deletion of their personal information. Athletes and staff should contact their club administrator directly for records managed by the club, or email admin@apextrackgh.com for platform assistance.