Legal

Club Terms

Interim Edition 1.0 · effective 15 October 2026

These documents are the agreement between your club and Pylos Systems for the use of the Pylos club-management software. If you have any questions, email pylossystems@gmail.com.

---

Part 1 — Subscription Terms

Interim Edition 1.0 · effective 15 October 2026 · includes the refund and cancellation policy

These terms are the agreement between Jason Holshausen, an individual trading as Pylos Systems ("Pylos", "we", "us"), and the club, school, academy or team that uses a Pylos workspace ("the Club", "you"). If the Club is run by one person as a sole proprietor, that person is the Club.

Pylos Systems is currently run by its founder as a sole proprietor. When Pylos forms a company, clause 19 explains what happens to this agreement.

1. Who we are

1.1 As required by section 43 of the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"):

• Full name and legal status: Jason Holshausen, an individual (sole proprietor) trading as Pylos Systems. Pylos is not a company, so it has no company registration number.
• Physical address, and address for service of legal documents: Durbanville, Western Cape (full street address to be published here before the effective date).
• Telephone: 084 887 9952
• Email: pylossystems@gmail.com (general, billing, legal notices, privacy and security reports).
• Website: https://pylossystems.com
• VAT: Pylos is not registered for VAT and does not charge VAT.
• Codes of conduct and self-regulatory bodies: Pylos does not subscribe to any code of conduct and is not a member of any self-regulatory or accreditation body.

1.2 The other information section 43 requires is in this agreement: the main features and price of the Club's Plan (the pricing page and the Acceptance Form), the minimum duration of one month and how to cancel (clauses 5 and 6), the manner of payment (clause 5), refunds (clause 6), how we protect information (Part 2) and our privacy policy (Part 3). How the Club can keep a full record of this agreement is in clause 16.

2. Definitions

• Service — the Pylos Systems club-management software, the Club's workspace at its own subdomain, and the related websites, apps and support.
• Club Data — all information the Club, its staff, its families or its athletes put into the Service, including personal information.
• Authorised Users — the Club's owners, administrators, coaches and staff, and the parents, guardians and athletes the Club invites.
• Emergency Information — the fields in an athlete's record for allergies, medical conditions, medical aid, doctor and emergency contacts.
• Operator Agreement — Part 2 of this agreement.
• End-User Terms — Part 4, which apply to Authorised Users.
• Acceptance Form — Part 5, or the equivalent acceptance screens in the Service.
• Plan — the subscription tier the Club chooses, as shown on the pricing page or the Acceptance Form.
• POPIA — the Protection of Personal Information Act 4 of 2013.

3. The Service

3.1 We provide the Service to the Club for the Club's own operations: registering families and athletes, attendance, training, competition results, invoicing and payments, and communication with families.

3.2 The Service is in active development, and we add and improve features often. We will not remove a feature that is central to the Club's Plan without at least 30 days' notice. If we do remove one, the Club may cancel before the removal takes effect and we will refund the fees it paid for any period after the removal.

3.3 We do not offer an uptime guarantee, but the Club is protected by the Service Failure credit in clause 12.3. The live status of the Service is published at pylossystems.com/status.

3.4 Club Data is stored in the European Union (Ireland) and processed in the places listed in Annex B of the Operator Agreement. We will not move it to another country without the notice described in clause 4.3 of the Operator Agreement.

4. Free trial

4.1 A new workspace starts with a 14-day free trial. No card is needed and nothing is charged during the trial.

4.2 At the end of the trial the Club chooses a Plan to continue. If no Plan is chosen, access to the workspace is paused; Club Data is kept for 30 days so that the Club can subscribe or export it, and is then deleted as described in clause 11.

4.3 This agreement, including the Operator Agreement, applies during the trial in the same way as it does to a paid Plan.

5. Fees and billing

5.1 Fees are in South African rand, as shown on the pricing page or the Acceptance Form. The price shown is the full price: there are no other fees, and no VAT is added.

5.2 Subscriptions are billed monthly in advance through Paystack. The first charge is made when the Club chooses a Plan, and then on the same date each month (or on the last day of a month that has no such date). The minimum duration of a subscription is one month. Pylos does not see or store card numbers; Paystack holds them.

5.3 If the Club moves to a higher Plan, the change takes effect immediately and the Club is charged the difference for the rest of the current billing period, worked out day by day. If the Club moves to a lower Plan, the lower price starts from the next billing date.

5.4 If a payment fails we will retry it and tell the Club's owner. If the fees remain unpaid 14 days after we first notify the Club, we may restrict the workspace until they are paid. Before we restrict it, we will send the owner a full export of Club Data, including Emergency Information, so that athletes remain safe at training and events. Club Data is not deleted while the workspace is restricted.

5.5 We may change our prices on at least 30 days' written notice. A price change applies from the next billing period after the notice ends. The Club may cancel before the change takes effect and nothing further is charged.

5.6 Fees that families pay to the Club are between the Club and its families. Those payments go directly to the Club's own payment-provider account. Pylos is not a party to those arrangements, is not a payment intermediary, and does not collect, hold or refund those fees.

6. Cancellation and refunds

6.1 The Club may cancel at any time from the Plan & Billing settings in its workspace, or by emailing pylossystems@gmail.com.

6.2 Cancellation takes effect at the end of the billing period already paid for. The Club keeps access until then, and nothing further is charged.

6.3 Fees already paid are not refundable, including for part of a month left when the Club cancels, features the Club did not use, or a move to a lower Plan, except as set out in clauses 6.4 and 6.5.

6.4 We refund or credit as follows:

1. in full, for the charge concerned, if we made a billing mistake (for example charging the wrong amount or twice), if we charged after a cancellation took effect, or if the Club cancels during a cooling-off period the law gives it (clause 6.5);
2. pro rata, for fees paid for the period after the relevant date, if the Club cancels because we remove a central feature (clause 3.2) or change these terms, our prices or a sub-operator; if we end the agreement for a reason that is not the Club's fault; if the Club cancels because we transfer this agreement (clause 19); or if an event beyond our control stops the Service for more than 30 days;
3. as a Service Failure credit, under clause 12.3; and
4. in any other case where the law requires a refund.

6.5 Cooling-off. If the Club is a natural person (for example a sole proprietor), section 44 of ECTA may give it the right to cancel within seven days after the agreement is concluded. When the Club chooses a paid Plan, it asks us to continue providing the Service immediately and agrees that the Service begins before that seven-day period ends (section 42(2)(d) of ECTA). If the law nevertheless gives the Club a cooling-off right, we will honour it and refund any payment within 30 days of cancellation.

6.6 To ask for a refund or credit, email pylossystems@gmail.com with the Club's workspace address and the date and amount of the charge. We reply within 5 business days. Approved refunds go back to the original payment method within 10 business days of approval, and never later than any period the law sets. Credits are applied to the next invoice.

7. The Club's responsibilities

7.1 The Club is the responsible party under POPIA for the personal information of its families, athletes and staff. Pylos processes that information as the Club's operator under the Operator Agreement.

7.2 The Club must have a lawful basis for the information it puts into the Service. That includes the consent of a competent person, such as a parent or guardian, for children's information (POPIA sections 34 and 35), and consent or another ground under POPIA section 27 for health information. The enrolment forms in the Service record consent and come with default wording; the Club decides the final wording and is responsible for it. The Club should collect only the health information it needs to keep athletes safe.

7.3 The Club is responsible for who it invites as Authorised Users, for keeping their logins secure, and for what they do in the Service. The Club must make the End-User Terms available to the people it invites (the invitation emails link to them), must invite a child only with the consent of the child's parent or guardian, and must link each child's account to that parent or guardian.

7.4 The Club must not use the Service to:

1. break the law;
2. send direct marketing to anyone who has not given the consent required by POPIA section 69 and the Consumer Protection Act, or who has opted out;
3. put health information into messages, notes or free-text fields other than the fields made for it;
4. interfere with the Service or other clubs' data; or
5. try to get around its security.

7.5 The Club must keep the name and contact details of its information officer up to date in its workspace settings.

8. Club Data and intellectual property

8.1 The Club owns Club Data. The Club gives Pylos permission to host, copy, process and display Club Data only to provide, secure, support and improve the Service, and as the Operator Agreement allows.

8.2 Pylos owns the Service, its software and its content. Nothing in this agreement transfers ownership of them to the Club.

8.3 We may use aggregated information that has been de-identified, so that it cannot reasonably be used to identify the Club or any person, to measure and improve the Service. We never sell Club Data and never use it for advertising.

8.4 If the Club sends us suggestions or feedback, we may use them freely.

9. Confidentiality and security

9.1 Each party will keep the other's confidential information confidential and use it only for this agreement. This obligation continues after the agreement ends.

9.2 Pylos will protect Club Data with the security measures described in the Operator Agreement and on pylossystems.com/trust.

10. Suspension, termination and continuity

10.1 We may suspend access immediately if it is needed to protect the Service, other clubs or any person, or if the Club seriously breaches this agreement. We will limit the suspension to what is needed, tell the Club why, give the owner access to Emergency Information where that is safe, and restore access once the cause is dealt with.

10.2 Either party may end this agreement if the other seriously breaches it and does not fix the breach within 14 days of written notice.

10.3 Pylos may end this agreement for any other reason, for example if it stops offering the Service, on at least 90 days' written notice. Pylos will refund fees paid for any period after the agreement ends, and the Club can export its data until the end of the period in clause 11.2.

10.4 If Pylos cannot continue. Because Pylos is currently run by one person, Pylos intends to name a trusted backup person (to be confirmed before the effective date) to have emergency access to the Service, bound by confidentiality, for one purpose only: if the founder dies or becomes unable to run the Service, to give each club an export of its Club Data and then delete the Club Data as clause 11 describes.

11. What happens to Club Data when the agreement ends

11.1 While the agreement is in force, the Club can export its data using the export tools in the Service (for example athletes, invoices and club statistics).

11.2 After the agreement ends, Club Data is kept for 30 days so that the Club can export it or ask us for an export. It is then deleted from the live system, including files the Club uploaded. Copies in database backups are overwritten as backups roll over, within 7 days after that. On request, we will confirm the deletion in writing.

11.3 Where a law requires us to keep particular records for longer, such as our own tax records, we keep only those records and only for as long as that law requires.

12. Warranties and service standard

12.1 We will provide the Service with reasonable skill and care, and in line with generally accepted information-security practice for a service of its kind and size.

12.2 Apart from that, and to the extent the law allows, the Service is provided "as is". We do not warrant that it will be uninterrupted or error-free, or that it will meet requirements the Club has not told us about in writing.

12.3 Service Failure credit. If, in any billing month, the Service is unavailable, or a core function (enrolment, attendance, invoicing or messaging) does not work, for more than 24 hours in total for reasons within our control, the Club may ask for a credit of one-thirtieth of that month's fee for each full or part day affected. Scheduled maintenance announced at least 48 hours ahead, and problems caused by the Club or by third-party services the Club chooses to connect, do not count. The Club must ask within 30 days after the month ends. If the Club has cancelled, we pay the credit as a refund.

12.4 Clause 12.3 is in addition to, and does not limit, any right the Club has under section 54 of the Consumer Protection Act.

15. Changes to this agreement

15.1 We may update this agreement. We will give the Club's owner at least 30 days' notice of any material change by email, saying what is changing and why.

15.2 If the Club does not want the change, it may cancel before the change takes effect. Nothing further is charged, and we will refund the fees it paid for any period after the change takes effect.

15.3 If the Club keeps using the Service after the change takes effect without cancelling, the new version applies.

15.4 A change that a law or regulator requires, or that is needed to deal with a security risk, may take effect sooner. We will tell the Club as soon as we can, and clause 15.2 still applies.

15.5 Changes that are not material, such as corrections or new contact details, take effect when we publish them with a new version number.

16. Accepting this agreement and keeping a record

16.1 Before accepting, the Club can review its Plan, the price and this agreement, correct any mistakes, and withdraw without being charged.

16.2 The Club accepts this agreement by signing the Acceptance Form, by hand or electronically, or by ticking the acceptance boxes in the Service. The parties agree that either is the Club's signature of this agreement. We keep a record of the version accepted, who accepted it and when.

16.3 We send the owner a copy of the accepted agreement. Every version remains available at pylossystems.com/legal.

18. General

18.1 This agreement (Parts 1 to 5) is the whole agreement between the parties about the Service. If its parts conflict, the Operator Agreement wins on the processing of personal information, the Acceptance Form wins on the Club's Plan and price, and otherwise these Subscription Terms win.

18.2 This agreement is governed by the law of the Republic of South Africa. Under section 45 of the Magistrates' Courts Act 32 of 1944, the parties consent to the jurisdiction of the magistrate's court for the district in which Pylos's physical address is, but either party may bring a claim in the High Court if it exceeds the jurisdiction of the regional court.

18.3 Before going to court, the parties will try in good faith to settle a dispute by discussion for at least 14 days. This does not prevent either party from seeking urgent relief from a court, or the Club from complaining to the National Consumer Commission, the Consumer Goods and Services Ombud or the Information Regulator.

18.4 Nothing in this agreement limits any right the Club has under the Consumer Protection Act 68 of 2008 or any other law that cannot be excluded by agreement.

18.5 Notices to Pylos go to pylossystems@gmail.com, and legal documents may be served at the physical address in clause 1. Notices to the Club go to the email address of the workspace owner. Notices sent by email are notices in writing.

18.6 Neither party is liable for a delay or failure caused by events beyond its reasonable control. This does not excuse the Club's obligation to pay, or Pylos's security obligations. If such an event stops the Service for more than 30 days, either party may end this agreement and Pylos will refund fees paid for any period after that.

18.7 The Club may not transfer this agreement without Pylos's written consent.

18.8 If any part of this agreement is invalid, the rest remains in force. A party that does not enforce a right straight away has not given it up.

18.9 Clauses 8, 9, 10.4, 11, 13, 14, 17, 18 and 19 continue after this agreement ends.

19. When Pylos becomes a company

19.1 The founder intends to form a private company to run Pylos Systems. The Club agrees that Pylos may transfer this agreement to that company (ceding its rights and delegating its obligations), or to a buyer of the Pylos Systems business, on at least 30 days' written notice, as long as the new party takes on all of Pylos's obligations, including the Operator Agreement.

19.2 From the transfer date, the new party is the Club's contracting party and operator. The founder remains responsible for anything that happened before the transfer.

19.3 The Club may cancel before the transfer takes effect, and we will refund the fees it paid for any period after that.

19.4 At the same time we may introduce a new version of this agreement under clause 15.

---

Part 2 — Operator Agreement (POPIA)

Interim Edition 1.0 · effective 15 October 2026

This agreement is between the Club (the responsible party) and Jason Holshausen, trading as Pylos Systems ("Pylos", the operator). It is the written contract that section 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA") requires between a responsible party and an operator. It forms part of the agreement between the Club and Pylos. If it conflicts with the Subscription Terms on the processing of personal information, this agreement wins.

Words defined in POPIA — personal information, special personal information, processing, data subject, responsible party, operator, competent person, de-identify — have the same meaning here.

1. What Pylos processes, and why

1.1 Purpose. Pylos processes personal information only to provide the Service to the Club: running the Club's workspace, enrolment, attendance, training, competition results, invoicing, payments, messages to families, and the support, security and backups that go with them.

1.2 Duration. From the moment Club Data is first entered (including during a free trial) for as long as the Subscription Terms are in force, plus the deletion period in clause 9.

1.3 Data subjects. Athletes and learners (including children), their parents and guardians, the Club's owners, administrators, coaches and staff, and people who apply to join the Club.

1.4 Categories of personal information. Names and contact details; dates of birth; enrolment, squad, attendance, training and competition records; photographs where the Club has a media release; invoices, payment records and payment-provider tokens (card numbers are held by the payment provider, never by Pylos); staff qualifications and certificates; messages sent through the Service; login and audit records.

1.5 Special personal information. Health information entered in enrolment (allergies, conditions, medical aid and doctor details) and personal information of children.

1.6 Location. The Club's database, files and application servers are hosted in the European Union (Ireland). The places where each sub-operator processes personal information are listed in Annex B.

2. Pylos's obligations as operator (POPIA sections 20 and 21)

Pylos will:

1. process the personal information only with the knowledge or authorisation of the Club — that is, as the Club configures and uses the Service, as this agreement describes, or on the Club's other documented instructions — unless a law requires otherwise, in which case Pylos will tell the Club first if the law allows;
2. treat the personal information as confidential and not disclose it except as this agreement allows or a law requires;
3. make sure that every person who can access it, including any contractor and the backup person named in clause 10.4 of the Subscription Terms, is bound by a written confidentiality undertaking and has been trained on POPIA and information security;
4. keep the security measures in Annex A in place and review them regularly (POPIA section 19);
5. not use the personal information for its own purposes, except in aggregated form after it has been de-identified, as clause 8.3 of the Subscription Terms allows;
6. help the Club, as reasonably required, to meet its own POPIA obligations, as clauses 5, 6 and 7 describe, including by giving the Club the information it reasonably needs for a personal information impact assessment.

3. The Club's obligations as responsible party

The Club will:

1. have a lawful basis under POPIA sections 9–11 for all personal information it puts into the Service;
2. obtain the consent of a competent person (a parent or guardian) before processing a child's personal information, as POPIA sections 34 and 35 require, and have a ground under POPIA section 27 (in practice, consent) for health information. The enrolment forms in the Service record these consents and come with default wording; the Club decides the final wording and is responsible for it;
3. tell its data subjects what it collects and why (POPIA section 18);
4. decide the retention period for its data (the Service has a per-club retention setting), and give Pylos only lawful instructions;
5. collect only the health information it needs, and keep it in the fields made for it rather than in messages, notes or free-text fields;
6. link each child's account to the child's parent or guardian;
7. notify the Information Regulator and data subjects of any security compromise, as POPIA section 22 requires, and keep the details of its information officer up to date in its workspace settings.

4. Sub-operators

4.1 The Club authorises Pylos to use the sub-operators in Annex B.

4.2 Pylos binds each sub-operator to written terms that protect personal information at least as well as this agreement, and remains responsible to the Club for them.

4.3 Pylos will email the Club's owner at least 30 days' notice before adding or replacing a sub-operator that processes Club personal information, or changing the country where an existing sub-operator processes it. If the Club objects on reasonable data-protection grounds, the parties will discuss it in good faith; if they cannot resolve it, the Club may cancel before the change takes effect, without further charge and with a pro-rata refund of fees paid for any period after that.

4.4 Pylos checks each sub-operator's security and transfer terms before using it and at least once a year.

5. Security compromises (POPIA sections 21(2) and 22)

5.1 If Pylos has reasonable grounds to believe that the Club's personal information has been accessed or acquired by an unauthorised person, Pylos will notify the Club immediately, without waiting to finish its investigation, and in any event within 48 hours of becoming aware of it. This applies to suspected as well as confirmed compromises, however minor they seem.

5.2 The notice will give, as far as Pylos then knows, what the Club needs to report the compromise to the Information Regulator: when it happened and was discovered; whether it is confirmed or suspected and what kind; the categories and approximate number of data subjects and records affected, and whether children's or health information is involved; the possible consequences for data subjects; what Pylos has done and will do; what data subjects can do to protect themselves; the identity of the unauthorised person, if known; and a contact person at Pylos.

5.3 Pylos will update the Club as it learns more, and at least every 48 hours until the matter is closed.

5.4 Pylos will help the Club notify the Information Regulator and affected data subjects, as POPIA section 22 requires the Club to do, and may prepare draft notices for the Club. Pylos will not notify the Club's data subjects or the Regulator on the Club's behalf unless the Club asks it to or a law requires it.

5.5 If a compromise is caused by Pylos's breach of this agreement, Pylos bears its own costs of dealing with it and pays the Club's reasonable costs of notification, subject to clause 10.

5.6 Pylos keeps a record of every security compromise affecting Club personal information and the steps taken.

6. Requests from data subjects

6.1 If a data subject contacts Pylos directly about the Club's information, Pylos will pass the request to the Club and will not answer it without the Club's instruction, unless the law requires otherwise.

6.2 The Service lets the Club answer requests itself: it can view and correct records, export them, and process a section 24 erasure request, which anonymises the athlete's record and issues a downloadable audit certificate. Pylos will help with a request the tools cannot handle.

6.3 Before using the erasure tool, the Club should consider whether it must keep any of the records for a legal reason, such as invoices it must keep for tax purposes.

7. Transfers outside South Africa (POPIA sections 57 and 72)

7.1 Some sub-operators process personal information outside South Africa, as Annex B shows. The Club's database, files and application servers are hosted in the European Union (Ireland).

7.2 Pylos transfers personal information outside South Africa only to recipients that are subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection, effectively upholding principles substantially similar to POPIA's conditions for lawful processing, and that includes provisions on onward transfer substantially similar to section 72, as section 72(1)(a) requires. Annex B shows the basis for each sub-operator.

7.3 Pylos keeps personal information that leaves South Africa to a minimum. Emails and SMS messages sent by the Service never contain health information, and contain only what is needed to deliver the message.

7.4 Pylos will not move the Club's database, files or application servers to another country without the notice in clause 4.3.

7.5 Pylos will give the Club the information it reasonably needs to decide whether it must apply to the Information Regulator for prior authorisation under section 57(1)(d) for transferring children's or special personal information, and will help with any application.

8. Audits and information

8.1 Pylos will give the Club the information reasonably needed to show that it meets this agreement, including a summary of its security controls (published at pylossystems.com/trust).

8.2 No more than once a year, on at least 30 days' written notice and at the Club's cost, the Club may carry out, or have an independent auditor carry out, a reasonable audit limited to Pylos's compliance with this agreement. The audit must not give access to other clubs' data. The Information Regulator may audit at any time the law allows.

9. Return and deletion at the end

9.1 While the agreement is in force the Club can export its data using the tools in the Service.

9.2 When the agreement ends, Pylos keeps the Club's personal information for 30 days so the Club can export it or ask for an export, then deletes it from the live system, including uploaded files. Database backup copies are overwritten as backups roll over, within 7 days after that. On request, Pylos will confirm the deletion in writing.

9.3 Pylos may keep information for longer only where a law requires it, and then only that information, only for that time, and still protected under this agreement.

10. Liability

Pylos's liability under this agreement is subject to the data-protection cap in clause 13.2 of the Subscription Terms, and the Club's to the cap in clause 13.1. Neither cap applies in the cases listed in clause 13.4 of the Subscription Terms.

11. Information officers

Pylos's information officer: Jason Holshausen. Registration with the Information Regulator is in progress; the registration number will be published here once issued. Contact: pylossystems@gmail.com.

The Club's information officer: the person the Club names in its workspace settings or on the Acceptance Form, or otherwise the Club's head, as POPIA section 1 provides.

12. Survival and transfer

12.1 Pylos's obligations under clauses 2, 5, 7 and 9 continue for as long as Pylos holds any of the Club's personal information.

12.2 If this agreement is transferred under clause 19 of the Subscription Terms, the new party becomes the Club's operator on the same terms.

Annex A — Security measures

These are the measures in place when this edition comes into force; each is described at pylossystems.com/trust. They are commitments, so this annex is updated before any of them changes.

1. Separation between clubs. Postgres row-level security on every table keys each row to its club and to the person reading it. An automated test matrix checks it on every change.
2. Encryption of health information. Medical details are encrypted with AES-256-GCM, using a key derived per club from a master secret held only in the hosting environment in the European Union. They are decrypted only for authorised staff, and access is logged.
3. Encryption in transit. All traffic uses HTTPS (TLS), with HTTP Strict Transport Security.
4. Authentication. Logins are handled by Supabase Auth (hashed passwords, email verification, password reset). Each person's role limits what they can see. Children's accounts are linked to a parent or guardian.
5. Keys and secrets. API keys are stored only as a SHA-256 hash and shown once. Webhooks are signed with HMAC-SHA256 and a timestamp. Payment card details are held by the payment provider, never by Pylos.
6. Access by Pylos. Only the founder, and any contractor bound by a confidentiality undertaking, can access production systems.
7. Change control. Every change passes automated checks, including a database security matrix and a browser test suite for each role, before release. Test systems use synthetic data only; production data is never copied to them.
8. Monitoring. Errors are reported to Sentry with cookies, headers, request bodies, IP addresses and user identifiers removed. External uptime monitors alert Pylos when the Service is down.
9. Backups and recovery. The database is captured in a nightly logical snapshot and a restore is rehearsed automatically every month.
10. Messages. Email and SMS templates never include health information.
11. POPIA tooling. Consent recorded with each enrolment; section 24 erasure with an audit certificate; a retention setting per club.
12. Incident response. A written incident-response checklist sets out how Pylos detects, contains, records and reports security compromises, and is reviewed at least once a year.

Annex B — Authorised sub-operators

Sub-operator	What it does	Personal information	Where	Transfer basis (s72)
Supabase	Database, authentication, file storage	All Club Data	European Union (Ireland)	EU law (GDPR) and Supabase's data processing agreement
Vercel	Application servers and hosting	All Club Data, in transit and while a request is handled	European Union (Ireland)	EU law (GDPR) and Vercel's data processing agreement
Sentry	Error monitoring	Minimal: cookies, headers, request bodies, IP addresses and user identifiers are removed	European Union	EU law (GDPR) and Sentry's data processing agreement
Paystack South Africa (Pty) Ltd	Card, debit-order and EFT payments for Pylos subscriptions	Payer name, email, amount; card details held by Paystack	South Africa	South African company subject to POPIA; any onward transfer under Paystack's own terms
Resend	Email delivery	Recipient name and email, message content (never health information)	Emails sent from Ireland; account data, logs and message metadata stored in the United States	Binding agreement: Resend's data processing agreement
BulkSMS	SMS delivery	Recipient phone number, message content (never health information)	European Union (Ireland); support staff in South Africa may access it; messages delivered through mobile networks	EU law (GDPR) and BulkSMS's Data Processing Addendum
Xero or Sage	Accounting sync — only when the Club connects its own account	Invoice and payment records	Under the Club's own agreement with that provider	The Club's own choice and agreement

---

Part 3 — Privacy Notice

Interim Edition 1.0 · effective 15 October 2026

This notice explains how Jason Holshausen, trading as Pylos Systems ("Pylos", "we"), handles personal information as a responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA): when you visit our website, register a club, manage a club's subscription, or log in to a club's workspace.

Who we are and how to contact us

Jason Holshausen, an individual (sole proprietor) trading as Pylos Systems, Durbanville, Western Cape (full street address to follow). Information officer: Jason Holshausen, pylossystems@gmail.com, 084 887 9952. Our PAIA manual, which explains how to ask for records we hold, is at pylossystems.com/legal/paia.

If you are a parent, guardian or athlete

Your club decides what information it collects about you and your family, and why. Pylos stores and processes that information on your club's behalf, as its operator, under a written Operator Agreement. To see, correct or delete your information, or to ask about consent, contact your club. If you contact us instead, we will pass your request to your club.

We never include health information in the emails and text messages the Service sends, and we never sell your information or use it for advertising.

If you are under 18

If your club gave you your own login, your parent or guardian agreed to it, and your account is linked to theirs. We use your information only so that you can use your club's workspace, and to keep it safe. We do not show you adverts and we do not sell your information. If you have a question or something worries you, talk to your parent or guardian or your club, or email us at pylossystems@gmail.com.

What we collect about club owners, staff, users and visitors

• Account details: name, email address, role and club, when you register a club or are invited to one.
• Billing details: the club's plan, invoices and payment status. Card details are held by our payment provider (Paystack), not by us.
• Acceptance records: which version of our terms was accepted, by whom and when, and the signed Acceptance Form.
• Messages to us: what you send us by email or through support.
• Survey answers: if you answer an in-app satisfaction survey, your score and comments.
• Marketing preferences: whether you want product news from us.
• Technical information: security and error logs, and anonymous timing measurements of how fast pages load. Error reports have cookies, headers, request bodies, IP addresses and user identifiers removed.

Where we get it, and whether you have to give it

We get most of this information from you. If your club invited you, the club gave us your name and email address. Our payment provider tells us whether a payment succeeded.

You must give us your account details to register or use a workspace, and billing details to subscribe; without them we cannot provide the Service. Survey answers and marketing preferences are optional.

Why we use it

• To provide and secure the Service, and to support you (performing our contract with the club).
• To bill the club's subscription (contract, and our legal obligation to keep financial records).
• To prove what was agreed, if there is ever a dispute (our legitimate interest).
• To improve the Service, using survey answers and aggregated measurements (our legitimate interest in a working product).
• To tell you about changes to the Service or our terms.
• To send club owners product news about similar services. We do this only for customers, or with your consent, and every message lets you opt out (POPIA section 69).

We do not sell personal information, and we do not use it for third-party advertising.

Cookies

We use only the cookies needed to keep you signed in and the Service secure. We do not use advertising or cross-site tracking cookies, and our page-speed measurements do not use cookies.

Who we share it with

Only the service providers who help us run the Service — hosting, database, email, SMS, payments and error monitoring — under written agreements that protect it. Our database and application servers are in the European Union (Ireland). Our email provider stores account data and logs in the United States. Each of these transfers is covered by a law or a binding agreement giving the protection POPIA section 72 requires. The current list, with locations, is Annex B of our Operator Agreement.

If Pylos forms a company to run the Service, or sells the business, we will transfer this information to that company or buyer, which will be bound by this notice.

How long we keep it

• Account details: while the club's account is open, then for 30 days so the club can export its data, then deleted.
• Billing and tax records: 5 years, as tax law requires.
• Acceptance records: while the agreement lasts and for 3 years after it ends.
• Support messages: 2 years.
• Security and error logs: 90 days.

How we protect it

We protect personal information with the measures described at pylossystems.com/trust, including encryption in transit, strict separation between clubs and logging of access to sensitive data. If we have reasonable grounds to believe your information has been accessed by someone without authority, we will tell you and the Information Regulator, as POPIA section 22 requires.

Your rights

You may ask to see the personal information we hold about you, ask us to correct or delete it, object to our processing it (including for direct marketing, at any time), or withdraw consent where we rely on consent. Contact our information officer at pylossystems@gmail.com.

If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa), 54 Maxwell Drive, Woodmead North Office Park, Johannesburg, through the complaints system on its website: inforegulator.org.za.

Changes

We will post any change to this notice at pylossystems.com/legal with a new version number and date, and tell club owners about material changes.

---

Part 4 — End-User Terms

Interim Edition 1.0 · effective 15 October 2026

These terms apply to everyone who logs in to a club's Pylos workspace: parents and guardians, athletes, coaches and club staff ("you"). They are between you and Jason Holshausen, trading as Pylos Systems ("Pylos", "we"). By logging in, you accept them. Your club's invitation links to them, and they are always available at pylossystems.com/legal.

1. How Pylos, your club and you fit together

1.1 Your club subscribes to Pylos and invited you to its workspace. The club decides what information it keeps about you and your family, and why. Pylos stores and processes that information for the club, under a written agreement with the club.

1.2 For questions about your information, consent, fees or anything the club does, contact your club. How Pylos handles its own information about you is explained in our Privacy Notice.

2. Your account

2.1 Give accurate details, and keep them up to date.

2.2 Keep your password to yourself. Each login is for one person.

2.3 Tell your club, or us at pylossystems@gmail.com, straight away if you think someone else has used your account.

3. Children

3.1 A person under 18 may use a workspace only with an account that their club created with the consent of their parent or guardian and linked to that parent's or guardian's account.

3.2 The parent or guardian accepts these terms for the child, and is responsible for supervising how the child uses the account.

4. Using the workspace properly

You must not:

1. look at, copy or share information about other people except as your role in the club needs;
2. use anyone's health or contact information for anything other than the club's activities;
3. harass, threaten or embarrass anyone through the workspace;
4. upload anything unlawful, or anything you do not have the right to share; or
5. try to get around the workspace's security or get into parts of it you are not meant to see.

If you find a security problem, please report it to pylossystems@gmail.com and do not test it further.

5. Payments to your club

Fees you pay to your club are between you and the club. Your payments go directly to the club's own payment provider. Pylos does not collect, hold or refund them. Please contact your club about invoices and refunds.

6. Messages

Your club uses the workspace to send you messages about its activities. Messages from Pylos or your club that promote products or services are sent only with the consent the law requires, and you can opt out at any time. Emails and text messages from the workspace never contain health information.

7. Our responsibility

7.1 We provide the workspace with reasonable skill and care, but we cannot promise that it will always be available or free of errors.

7.2 Nothing in these terms limits liability for fraud, wilful misconduct or gross negligence, or any right you have under the Consumer Protection Act 68 of 2008, the Protection of Personal Information Act 4 of 2013 or any other law that cannot be excluded by agreement.

8. When access ends

8.1 Your club decides who has access to its workspace, and may remove your access.

8.2 We may suspend your account if you break these terms or if it is needed to protect other people or the Service. We will tell you and your club why, unless that would put someone at risk.

8.3 What happens to your information after that is decided by your club, under its retention policy.

9. Changes and contact

9.1 If we change these terms in a way that matters, we will publish the new version at pylossystems.com/legal and tell your club, and where the Service allows we will show it to you the next time you log in.

9.2 These terms are governed by the law of the Republic of South Africa.

9.3 Contact: pylossystems@gmail.com. Our full details are in clause 1 of our Subscription Terms.

---

Part 5 — Acceptance Form

Interim Edition 1.0 · effective 15 October 2026

Clubs sign up with a completed Acceptance Form (legal name, plan, information officer, and initialled confirmation of the important terms), sent by email and countersigned by Pylos. To start, email pylossystems@gmail.com and we'll send you the form.