Legal

Privacy Policy

Last updated: 26 July 2026

This policy explains what personal data The Community League, Ltd. collects, why we collect it, and what we do with it. We have kept it short and plain so that players, parents and guardians can read it without a lawyer.

1. Who we are

The Community League, Ltd. is a basketball organisation based in Kigali, Rwanda, established in 2025. Most people know us as TCL or The Community League. We operate only in Rwanda.

We are the data controller for the personal data described here. That means we decide what is collected and what happens to it. We have a data protection officer, and you can reach them at the address below.

This policy covers our website at thecommunityleague.com and all three of our programs: Ukurikira, The REC, and The House League.

2. What we collect and where it comes from

2.1 From the website

Nothing at all. There is no login, no account, no shop, and no online payment on our site. We do not collect your name, email or anything else when you browse. If you use a link on the site to email us or message us, we hold whatever you choose to send.

2.2 From registration

Registration for our organised programs happens off our website, through a Google Form and a WhatsApp group. There we collect your full name, a nickname if you use one, phone number, email address, date of birth, neighbourhood, gender, how you heard about TCL, how often you play, your basketball experience level, the parts of TCL you are interested in, your Instagram and TikTok handles if you choose to share them, and your answer to our media consent question.

2.3 From WhatsApp groups

When you join a TCL WhatsApp group, we and the other members of that group can see your phone number, your WhatsApp display name and picture, and the messages you post there.

2.4 At sessions and in person

Coaches and staff record who attended, game and season results, and notes about any incident, injury or conduct issue. Photos and video are also taken at sessions. See section 10.

2.5 From our staff app

TCL staff use a mobile app to keep the records described above against a player profile. Players do not have accounts or logins in this app. Only TCL staff can open it.

2.6 From signed forms

Players in The REC sign a waiver and release form before each season, and we keep the signed form as a record. It carries your full name, date of birth, phone number, email address, signature and the date you signed. By signing it you also confirm your insurance position and authorise us to seek medical treatment for you in an emergency. The House League will have its own form for parents and guardians, to be signed before the first session.

3. Why we use your data

We use it to run our programs: to register you, put you in the right division or age group, plan sessions, track attendance and results, and contact you about schedules and changes. We use incident and conduct records to keep sessions safe and to make fair decisions when something goes wrong. We use the contact and medical details on a signed form to reach you or get you help in an emergency. We use photos and video to show what TCL is and to promote our programs.

Under Rwanda's Law nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, we rely on the following grounds. We rely on your consent for photos and video where no signed form covers them, and for marketing messages. We rely on the agreement between us, including any form you signed, for running the program you joined and for the media rights that form grants. We rely on our legitimate interest in safe, well-run sessions for attendance, safeguarding and conduct records. We rely on protecting someone's vital interests in a medical emergency. We rely on legal obligation where a law or a competent authority requires us to keep or hand over information.

4. Cookies and analytics

Our website sets no cookies. It runs no analytics, no advertising pixels, and no advertising or profiling trackers. Our hosting provider, GoDaddy, adds its own performance monitoring script to every page, which receives your IP address and browser type. We do not use it to identify you. We do not build a profile of visitors and we cannot tell who you are from a visit.

The schedule on our site comes from a public Google Calendar that our own server reads and displays, so your browser is not passed to Google when you look at it. We do link out to WhatsApp, Instagram, TikTok, LinkedIn and a Google Form. Once you follow one of those links, you are on that company's platform and its own privacy policy applies, not ours.

5. Who we share it with

We share personal data only with the service providers we need to run TCL, and only with the part of the data they need:

Google, for the registration form and our public calendar.
WhatsApp and Meta, for our group chats.
Supabase, the hosted database behind our staff app.
GoDaddy, our website hosting provider, which stores the site itself.
TCL staff, coaches and program leads, on a need-to-know basis.

We may also share data where a law, a court or a competent authority in Rwanda requires it, or where it is needed to protect someone's safety.

We do not sell your personal data, and we do not trade or rent it to anyone for marketing.

6. Where your data is stored

Google, Meta, Supabase and GoDaddy all store data on servers outside Rwanda, so your data leaves the country when we use those services. We choose established providers that publish their own security and data protection commitments, and we take the steps Rwandan law asks of us before personal data is sent abroad. If you would like to know more about this, write to us.

7. How long we keep it

We keep participant records for as long as we need them to run our programs and to meet our legal obligations, and then we delete them or make them anonymous. Incident and conduct records are kept longer than ordinary attendance records, because they can matter for safety decisions later. Signed forms are kept for as long as a claim could reasonably be brought about the season they cover. If you ask us to delete your data and we are able to, we will.

8. How we protect it

Access to our staff app and database is limited to the staff who need it, and each of them has their own protected account. We remove access when someone leaves TCL. Paper forms are kept in a secure place. We do not put player details on public spreadsheets or public groups. No system is perfectly secure, so we do not promise that nothing will ever go wrong, but we will tell you promptly if a breach affects you.

9. Children and young players

The House League is a youth program and every participant is a minor. It has not launched yet. When it does, a parent or guardian must register the child, give consent for the data we collect, and sign the program's form before the first session.

A parent or guardian can ask us at any time to show them what we hold about their child, correct it, or delete it. They can also withdraw consent for photos and video of their child.

Ukurikira is a free open run and anyone can walk up, including young people. If you are a parent or guardian and you do not want your child's data or image recorded at an Ukurikira session, tell a member of TCL staff at the court or message us, and we will act on it.

10. Media and photography

Ukurikira events are filmed and photographed for highlights, social media, and promotions by The Community League. By attending and participating, you consent to the use of your image in photos and videos.

If at any point you want us to take down content that features you, just message us on Instagram, TikTok, or WhatsApp and we will remove it.

For The REC, the waiver and release form you sign each season includes a media release, and that release is what governs our right to use your image from that season. For The House League, media consent will be given by a parent or guardian at registration.

Whatever a signed form says, our practice is simple. If you ask us to take down a photo or video of you from our own channels, we take it down. Ask us on Instagram, TikTok or WhatsApp. We cannot always pull back something that another person has already downloaded or reshared, and content already printed or placed with a partner may take longer to withdraw.

11. Your rights

Under Rwandan data protection law you have the right to:

be told what we hold about you and get a copy of it;
have wrong or incomplete information corrected;
ask us to delete your data;
object to how we are using it, or ask us to pause using it;
receive your data in a usable format so it can be moved elsewhere;
withdraw consent at any time, where we asked for consent;
complain to the National Cyber Security Authority, which supervises data protection in Rwanda.

To use any of these rights, write to our data protection officer at info@thecommunityleague.com or call +250 792 624 805. We may ask you to confirm who you are before we act, so that nobody else can get at your data. We answer as quickly as we can and within the time Rwandan law allows.

If you are visiting our site from the European Union, the GDPR may also give you rights over data we hold about you, and you can raise those with us at the same address.

12. Changes to this policy

We will update this page when what we do changes, and the date at the top will always show the current version. When a change is significant, for example when we start taking registrations or payments on our own website, we will say so on the website and in our WhatsApp groups before it takes effect.

13. Contact us

The Community League, Ltd.
Kigali, Rwanda
Email: info@thecommunityleague.com
Phone: +250 792 624 805