SECURITY & COMPLIANCE

Built for trust, designed for minors

FutureXV holds data on developing rugby players — many of them minors. Every decision in the platform is shaped by that responsibility.

Encryption in transit

All API and web traffic is TLS-encrypted end-to-end.

POPIA-compliant storage

Personal information is stored with role-based access controls.

Minor data protection

U18 player data requires verified parental/guardian consent before activation.

Granular access control

Scouts, coaches, schools and admins see only what their role permits.

Multi-tier verification

Every player, coach, school, club and union goes through tiered identity verification.

Immutable audit log

Every admin and verification action is timestamped, IP-logged, and retained.

Two-stage scout approval

Scouts undergo a two-stage approval before full database access is granted.

Incident response

Documented breach notification procedure aligned to POPIA timelines.

POPIA

South Africa's POPI Act compliance

The Protection of Personal Information Act (POPIA) sets out how personal data must be collected, stored, processed and shared in South Africa. FutureXV is built to those standards as a non-negotiable foundation.

  • Explicit consent captured at signup (Terms + Privacy + marketing communication preferences).
  • Each user can view, export and request deletion of their data from their profile settings.
  • Sensitive fields (DOB, home address, contact numbers) are never shown on public profiles.
  • Public-facing pages show first name + surname initial only for U18 players.
  • All consent decisions are stored with timestamp, IP address and user-agent for auditability.
  • Data is hosted within South African / EU regional infrastructure where feasible.

VERIFICATION SYSTEM

Multi-tier verification (Spec §34)

Every registrant goes through a tiered, email-based verification chain before their account is activated:

  • Senior players → verified by their nominated coach.
  • U18 players → dual approval required: both the coach and a parent/guardian must consent.
  • Club coaches → verified by the registered club manager.
  • School coaches → verified by the school's principal or headmaster.
  • Union coaches → verified by a union administrator.
  • Verification links are single-use and expire after 7 days.
  • Decisions capture IP address and user-agent, and are written to an immutable audit log.

DOCUMENTS

Legal documents

Privacy PolicyTerms of ServiceRequest my data