Contents
- 1.About this policy
- 2.Our role, and the organiser’s
- 3.What we collect
- 4.Identity documents and declarations
- 5.How we use it
- 6.What is public
- 7.Children and young people
- 8.Who we share it with
- 9.Where your data is stored
- 10.How long we keep it
- 11.How we protect it
- 12.If something goes wrong
- 13.Your rights
- 14.Cookies and analytics
- 15.Changes to this policy
- 16.Contact us
1.About this policy
HoopersHub is a basketball competition and team management platform operated in Singapore by 2XP Pte. Ltd. (UEN 202444839N), in partnership with Unicomi Pte. Ltd. (“we”, “our”, “us”). This policy explains what personal data we collect, why, who can see it, how long we keep it and what you can ask us to do with it, in line with Singapore’s Personal Data Protection Act 2012 (PDPA).
It covers sg.hoopershub.net, every league and team site on a hoopershub.net address, and the HoopersHub app you can install from those sites (together, the “Service”).
Most of the players on HoopersHub are children, so we have tried to write this in plain language. If anything is unclear, ask our Data Protection Officer at [email protected].
2.Our role, and the organiser’s
HoopersHub holds two kinds of personal data, and responsibility for each sits in a different place.
- Your own account, and any profiles you manage as a parent or guardian: we decide how this data is used, and we are responsible for it under the PDPA.
- Competition data: a competition’s organiser (for example a league, an association, a school sports council or a club) decides what it collects from its teams and players, and what it publishes. Where we have an agreement with an organiser, we process its competition data on its behalf, as a data intermediary, and use it only to run that competition on the Service. The organiser’s own privacy notice applies as well as this one.
You can send any question about a competition’s data to the organiser or to us. If it is the organiser’s to answer, we will pass it on and tell you we have.
3.What we collect
Everyone with an account
- Name, email address and password, or your Google account details if you sign in with Google (name, email address and profile picture)
- Phone number, if you add one
- Your roles on the Service, notification settings and preferences
Players
- Name, date of birth and gender
- School, height, weight, playing position and preferred jersey number
- Profile photo and a short biography, if added
- Emergency contact name and phone number
- Social media handles, if added, and posts from an account you choose to connect
- Teams, competitions, games played, statistics and awards
Parents and guardians
- Your contact details and your relationship to each child you manage
- The profiles you create or claim for your children
Organisers, team staff and officials
- Name, contact details and your role in the league, team or academy
- The rosters, schedules and results you enter
- For table officials and scorers, the games you recorded
- A record of administrative actions you take, kept for accountability
Competitions
- Team registrations, rosters and jersey numbers
- Fixtures, results, box scores, play-by-play, standings and brackets
- Identity documents and signed declarations, where a competition requires them (see section 4)
- Photos and videos taken at a competition, and the Player of the Game cards and highlights made from them
When you use the Service
- IP address, browser and device type, and the pages you visit (see section 14)
- A device token, if you switch on notifications
- Messages you send to our support team
- Limited payment details, if you pay for a feature: we receive confirmation and the last four digits of your card, never the full card number
4.Identity documents and declarations
Some competitions have age or eligibility rules. For those, the organiser may ask each team to upload an identity document for every player, such as a passport, NRIC or birth certificate image. We collect these only to verify age and eligibility for that competition, and we do not use them for anything else.
- They are kept in private storage, never on a public page.
- Only the organiser’s authorised staff and our administrators can view them, through links that expire after a short time.
- The image is deleted 60 days after the competition ends. We keep only the result: that the player was verified, by whom and when.
When a club registers a team, its manager signs a declaration for the competition. In it, the club confirms that each player is fit to play, that their details are accurate, and that it has the consent of each child’s parent or guardian. We keep the signed declaration as the organiser’s record (see section 10).
5.How we use it
- To run competitions: registration, age and eligibility checks, scheduling, live statistics, results, standings and awards
- To run your account and the profiles you manage
- To publish the competition record that organisers choose to make public (see section 6)
- To send the notifications and emails you need, such as game reminders, claim decisions and account messages
- To answer support requests
- To keep the Service secure and prevent fraud and misuse
- To understand how the Service is used, so we can improve it
- To meet our legal obligations
We do not sell personal data, and we do not use it for advertising.
6.What is public
Basketball results are public by nature. When an organiser publishes a competition, anyone can see its schedule, results, standings and brackets, and each game’s box score, statistics and play-by-play. That includes the players’ names, teams and jersey numbers. During a live game, the public page shows the score and play-by-play as they happen. Organisers choose what is shown.
Beyond the competition record, your privacy settings decide what appears on your profile. Children’s profiles are private by default (see section 7).
We never publish identity documents, contact details or emergency contacts.
7.Children and young people
We follow the PDPC’s Advisory Guidelines on the PDPA for Children’s Personal Data in the Digital Environment (March 2024).
Consent
- Under 13: a parent or guardian gives consent for the child.
- 13 to 17: a young person may consent for themselves if they understand what they are agreeing to. If we have reason to think they do not, we ask a parent or guardian.
- 18 and over: you consent for yourself.
Consent reaches us in two ways. A parent can create or claim their child’s profile in the Family Portal and manage it directly. Or a club registering a team for a competition confirms, in its signed declaration, that it has the consent of each player’s parent or guardian. A parent can then claim their child’s profile at any time and take control of it from the club.
Protection by default
- Children’s profiles are private by default: hidden from search and from the player directory, with statistics hidden beyond what the competition itself publishes.
- Teams, leagues and academies need approval before they can contact a child through the Service.
- A guardian link is verified, not simply claimed, and a second guardian needs the first guardian’s approval.
- Parents can view, correct or delete their child’s information, and change their privacy settings, at any time.
- A parent can ask us to stop featuring their child in Player of the Game cards and highlights.
If you think we hold a child’s data without proper consent, tell our Data Protection Officer at [email protected] and we will act on it straight away.
9.Where your data is stored
Our database and uploaded files, including identity documents, are hosted on servers in a Singapore data centre. The providers below handle some data to run parts of the Service, and some of them process it outside Singapore.
- Vodien
- Hosting. Our servers and file storage, in Singapore.
- Zoho ZeptoMail
- Delivers our emails, which can include names. May process data outside Singapore.
- Sign in with Google, if you choose it, and Google Analytics (see section 14). Processes data outside Singapore.
- Cloudflare
- Bot protection on public forms. Runs on a global network.
- Apple, Google and Mozilla push services
- Deliver the notifications you switch on. They receive a device token, not your profile.
- Stripe
- Processes card payments, if you pay for a feature. Your full card details go to Stripe, never to us.
When personal data leaves Singapore, we make sure it is protected to a standard comparable to the PDPA, through the provider’s contractual commitments, as the PDPA’s transfer limitation obligation requires.
10.How long we keep it
We keep each kind of data only as long as its purpose lasts. A result is the permanent record of a game. An identity document is needed only until a competition’s results stand.
- Competition records
- Fixtures, results, box scores, play-by-play, standings, awards, and who played for which team: kept permanently as the sporting record. You can ask for a record to be removed from public view.
- Your account and profile
- Kept while your account, or your guardian relationship, is active. Deleted within 30 days of a verified request.
- Identity documents
- The image is deleted 60 days after the competition ends. The record that the player was verified is kept.
- Signed declarations
- Kept as long as they may be needed to respond to a legal claim about the competition. For a child, that can be some years after they turn 18.
- Notifications
- Deleted after up to 90 days.
When you ask us to delete your data, we remove your name, photo and personal details, and the games you played stay in the record without them. Deleted data can remain in our backups until they are overwritten in the normal backup cycle, and we never use a backup to bring back data you asked us to delete.
11.How we protect it
- All data travels between your device and our servers encrypted (TLS).
- Passwords are stored as one-way hashes, never as plain text.
- Access is role-based: organisers, team staff and administrators see only what their role needs.
- Administrative actions are recorded in an audit log.
- Identity documents sit in private storage, reachable only through links that expire.
- Public forms are protected against bots.
No system can be made completely secure, but we work to protect your data against unauthorised access, use, disclosure, copying, change or loss.
12.If something goes wrong
We have a written procedure for data breaches, in line with the PDPA.
- We assess any suspected breach promptly to decide whether it is notifiable.
- If it is likely to cause significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within 3 calendar days of making that decision.
- We tell the people affected as soon as practicable, so they can protect themselves. For a child, we tell the parent or guardian.
- Where we hold competition data for an organiser, we tell the organiser without undue delay.
- We act straight away to contain the breach and stop it happening again.
If you suspect someone has accessed your account or your data without permission, contact [email protected] immediately.
13.Your rights
Under the PDPA you can ask us to:
- Give you access to the personal data we hold about you, and tell you how it has been used or disclosed in the past year.
- Correct data that is wrong or incomplete. You can change most of it yourself in your account settings.
- Stop using your data by withdrawing your consent. We will explain what that means for your use of the Service.
- Delete your account and personal data, as described in section 10.
- Give you a copy of your data in a common machine-readable format, where that applies.
Parents and guardians can do all of this for the children they manage. Write to our Data Protection Officer at [email protected]. We will confirm who you are before acting, and reply within 30 days, or tell you when we will if we need longer. We may charge a reasonable fee for an access request, and will tell you before we do.
15.Changes to this policy
We will post any update here and change the date at the top of this page. If a change is material, we will also tell you by email or in the Service before it takes effect.
16.Contact us
Data Protection Officer, 2XP Pte. Ltd. (UEN 202444839N): [email protected]
General enquiries: [email protected]
Company website: 2xp.sg
If you are not satisfied with our reply, you can contact the Personal Data Protection Commission. This policy is part of our Terms of Use.
Read this together with our Terms of Use.