Privacy Policy

The Midland Basketball Association ("MBA", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who interact with our digital platforms, attend our fixtures, or subscribe to our services.

This Privacy Policy is developed in accordance with the Data Protection Act No. 3 of 2021 of the Republic of Zambia, which regulates the collection, use, transmission, storage, and processing of personal data, and establishes the rights of data subjects and the duties of data controllers and data processors.

By using the MBA platform, purchasing tickets, subscribing to notifications, or registering an account, you acknowledge and consent to the practices described in this policy.

We collect personal data that is necessary for the operation of our league and services, including:

• Identity data: full name, email address, phone number, and profile photo.

• Account data: login credentials, role assignment (admin, editor, scheduler, statistician), and activity logs.

• Transaction data: ticket purchases, merchandise orders, and payment method information (mobile money provider details for Airtel, MTN, and Zamtel).

• Subscription data: preferred leagues, notification types, and opt-in preferences for fixture, result, and news alerts.

• Device and usage data: IP address, browser type, and pages visited, collected through standard analytics tools.

We process personal data for the following specific and lawful purposes:

• To register and manage user accounts for team representatives, staff, and administrators.

• To process ticket sales, generate digital tickets with QR codes, and verify entry at venues.

• To fulfil merchandise orders and manage payments through approved mobile money platforms.

• To send fixture notifications, results, and news to fans who have opted in via the FanSubscription system.

• To maintain league records, including player statistics, team rosters, coaching staff, and officiating personnel.

• To comply with legal obligations under Zambian law, including record-keeping and reporting requirements.

We implement appropriate technical and organisational measures to safeguard personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission, access controls limited to authorised personnel, and regular security reviews.

Personal data is stored for as long as it is used for the specific purpose for which it was collected, and for a period of at least one year thereafter, or other period as may be prescribed under the Data Protection Act.

Payment credentials are not stored on our systems; transaction processing is handled by licensed payment providers operating under their own security standards.

We do not sell personal data to third parties. We may share personal data only in the following circumstances:

• With team representatives and subordinate team sites, for the purpose of synchronising rosters, fixtures, and results, where a data-sharing agreement is in place.

• With licensed mobile money providers (Airtel, MTN, Zamtel) for the sole purpose of processing authorised payments.

• With the Office of the Data Protection Commissioner or other lawful authorities when required by law or regulation.

• With service providers who process data on our behalf under data processing agreements that ensure compliance with the Data Protection Act.

Personal data may be stored or processed on servers located outside Zambia, as our digital infrastructure utilises cloud-based platforms. Where this occurs, we ensure that the receiving jurisdiction provides an adequate level of data protection consistent with the requirements of the Data Protection Act.

Sensitive personal data is not transferred outside Zambia except as permitted by regulations made by the Minister.

Under the Data Protection Act, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.

• Right to rectification: You may request correction of inaccurate or incomplete personal data.

• Right to erasure: You may request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where processing is unlawful.

• Right to object: You may object to the processing of your personal data for direct marketing or other purposes.

• Right to restriction: You may request that we restrict the processing of your data in certain circumstances.

To exercise any of these rights, contact us using the details provided in Section 9 below. We will respond to your request within a reasonable period and in any case within the timeframe prescribed by the Act.

If you believe that we have not complied with our obligations under the Data Protection Act, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of the Republic of Zambia.

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact the MBA administration through the official contact channels available on the Midland Basketball Association platform.