PAIA manual

The manual Devroom SA (Pty) Ltd keeps for SoccerGhost under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), with what the Protection of Personal Information Act 4 of 2013 (POPIA) adds to it: what records we hold, how we handle personal information, and how to ask for a record.

Last updated 12 October 2026.

1. The company and its Information Officer

SoccerGhost (soccerghost.com and the SoccerGhost app) is run by Devroom SA (Pty) Ltd, a private company registered in South Africa, registration number 2018/281366/07.

• Information Officer: the Managing Director of Devroom SA (Pty) Ltd, registered with the Information Regulator on 12 October 2026.
• Postal and street address:
  102 4th Road, Brentwood Park, Kempton Park, 1619, South Africa
• Telephone: 067 253 9158
• Email: hello@soccerghost.com

2. The Regulator's guide to PAIA

The Information Regulator publishes a guide on how to use PAIA, and how to ask for your own personal information under POPIA, in each of South Africa's official languages. It is at inforegulator.org.za/paia-guidelines, and can be asked for from the Regulator.

3. Records anyone can read without asking

We have published no notice under section 52 of PAIA. These are on soccerghost.com for anyone to read: the privacy page, the terms, the methodology, every prediction, and the Ghost Record of each published call and its result.

4. Records kept under other laws

• Company records, under the Companies Act 71 of 2008.
• Tax records, under the Tax Administration Act 28 of 2011.
• Personal information, under the Protection of Personal Information Act 4 of 2013.

5. Subjects and categories of records

• The company: incorporation documents, directors, financial statements and tax returns.
• Suppliers: agreements with the football data provider and the hosting, network, backup and advertising providers.
• The service: match data, predictions and the Ghost Record, all public.
• Football: footballers', coaches' and referees' names and what the football data provider publishes about them (below).
• Readers with an account: account records, kept slips, follows, league entries and alert subscriptions.
• Daily pick subscribers: phone number, channel, hour, time-zone offset, language and country.
• Operations: a line for each request answered and reports of errors in readers' browsers, without IP addresses, kept for fourteen days.

6. How we handle personal information

Why we process it: to sign readers in and keep their account the same on every device; to keep their slips and league tables; to send the alerts and the daily pick they ask for; to publish football statistics and the predictions made from them; to find faults; and to meet our legal duties.

Whose, and what:

• Readers with an account: the identifier Google or Apple issues and which of them issued it, the name the provider gives, when they confirmed they are 18 or over, the two-letter country their connection appears to come from, kept slips, followed teams and tipsters, pinned competitions, private league codes, a public name only if they choose one, a recovery phrase only as a one-way hash, and when they last signed in.
• Readers who turn on alerts: the address their push service issued and its key.
• Daily pick subscribers: as in section 5. No account is involved.
• Footballers, coaches and referees: names; for footballers, birth year, nationality, height, weight, a link to a photograph, clubs, match statistics, and injuries and suspensions; for referees, country and the matches, cards, fouls and penalties they have given. All of it as the football data provider publishes it.

We keep no email addresses, no IP addresses and no locations.

Who it may go to: Google and Apple, for signing in; our hosting provider and content network, which handle every request; Backblaze, which stores our encrypted backups; the football data provider's image service, which sees a browser's IP address when it sends a crest or a photograph; Google AdSense and the ad networks it works with, under their own cookies, where ads are shown; a reader's browser push service, which delivers alerts it cannot read; and, once the daily pick by WhatsApp or SMS is switched on, the service that delivers it: neither channel is switched on today.

Across borders: Backblaze stores our encrypted backups in the United States. Google, Apple, Cloudflare and the image service handle what they see outside South Africa, under their own data-protection terms.

How we protect it: encrypted connections only; a sign-in cookie that no script on the page can read; a database that cannot be reached from the internet; backups encrypted and locked against change for their first 30 days; recovery phrases stored only as one-way hashes; sessions a reader can end on every device; and logs that hold no IP address. The privacy page says more.

7. How to ask for a record

Fill in Form 02, Request for Access to Record, of the PAIA Regulations, and send it to hello@soccerghost.com or by post to the address in section 1. The fees are those the regulations prescribe. You can ask about your own personal information the same way, under POPIA, or write to privacy@soccerghost.com.

If you are unhappy with how a request was handled, you can complain to the Information Regulator, at inforegulator.org.za, enquiries@inforegulator.org.za or 010 023 5200.

8. Where this manual is kept

This manual is on soccerghost.com and at the address in section 1, and a copy is given to anyone who asks for one. It is reviewed at least once a year, and whenever what we hold changes.