1. About this notice
OFA Sports ("OFA", "we", "us") runs the OFA Tungku and OFA Jerudong sports venues and this booking app. This notice explains how we collect, use, share and protect your personal data when you use the app, book a court, visit our venues or contact us. It follows the Personal Data Protection Order of Brunei Darussalam (PDPO).
Personal data means any information that identifies you, on its own or together with other information we hold, such as your name, phone number or email address.
2. What personal data we collect
- Contact details: your name, phone number and email address.
- Account details: your sign-in email and password. Your password is stored only in a scrambled (hashed) form, and we can never see it.
- Booking details: the venue, court, sport, dates and times you book, and any cancellations or reschedules.
- Payment records: amounts paid, deposits, balances, refunds, the payment method, and the transfer screenshots you upload. These screenshots may show your name and part of your bank account details.
- Messages: what you tell us by WhatsApp, phone or email.
- Technical data: a sign-in cookie that keeps you logged in, and a scrambled form of your internet (IP) address used to prevent abuse. We do not use advertising or tracking cookies.
We do not ask for your IC or passport number, date of birth, home address or bank card details.
3. Whose personal data we collect
- Customers who create an account or book as a guest.
- People who book on behalf of a team, club or group, and the contact person they name.
- Sponsored teams and partners whose sessions we arrange.
- Our staff and partners who use the app to run the venues.
If you give us someone else's details (for example, a team captain's phone number), please make sure they are happy for you to do so.
4. How we collect personal data
- Directly from you, when you sign up, book, pay or upload a transfer screenshot in the app.
- When you contact us by WhatsApp, phone or email, or speak to our staff at the venue.
- When our staff record a booking or payment for you.
- Automatically, through the sign-in cookie and security logs described above.
5. Why we use your personal data
- To take, confirm, change and cancel your bookings, and to hold your slot while you pay.
- To check your payment, keep track of deposits and balances, and process refunds.
- To send your booking confirmation and receipt, and to contact you about your booking (including changes due to weather or court conditions).
- To run our venues: our daily court schedule shows staff who is playing and how to reach them.
- To keep our business, accounting and tax records.
- To prevent fraud and misuse, keep the app secure, and enforce our House Rules.
- To handle questions, complaints and disputes.
- To meet our legal obligations and respond to lawful requests from the authorities.
We do not use your personal data for marketing. If we ever want to, we will ask for your separate consent first.
6. Who we share it with
- OFA staff and partners who need it to run the venues. Each person only sees what their role requires.
- Service providers who host the app and its database, send our emails and alert us to technical errors, strictly on our instructions.
- Banks, to verify transfers and pay refunds.
- Authorities, such as the police or regulators, when the law requires it.
We never sell your personal data.
7. Transfers outside Brunei Darussalam
Our app and database run on established cloud providers' servers in Singapore. Our email, error-monitoring and backup providers may also process your data in other countries, such as Japan and the United States. When your data is stored or processed abroad, we only use providers who protect it to a standard comparable to the PDPO.
8. How long we keep it
- We keep your account and booking records for as long as your account is open and for as long as we need them for the purposes in section 5, including our accounting, tax and legal record-keeping.
- Payment screenshots are deleted 90 days after the booking they relate to has been played or closed. The payment record itself is kept.
- Guest sessions that never lead to a booking are removed after a day.
When we no longer need your personal data, we delete it securely. You can also delete your account at any time (see section 10).
9. How we protect it
- All connections to the app are encrypted (HTTPS).
- Passwords are stored only in hashed form.
- Staff access is limited to what each person's role needs, and staff actions are logged.
- Payment screenshots can only be viewed by you and the staff who check payments.
- Sign-in attempts and other sensitive actions are rate-limited to stop misuse.
No system is completely secure. If a data breach is likely to harm you, we will tell you and the authorities as the PDPO requires.
10. Your rights
Under the PDPO you can:
- Access the personal data we hold about you. You can download a copy below.
- Correct anything that is wrong or out of date by contacting us.
- Withdraw your consent to us using your personal data. We may then be unable to take new bookings for you, and we may still keep records we need for completed bookings or by law.
- Delete your account. Cancel any upcoming bookings first. We keep payment amounts and dates for our accounts, with your name and contact details removed.
We will respond within the time the PDPO requires. If you are not satisfied with our response, you may complain to the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI).
11. Changes to this notice
We may update this notice when the law or our services change. The date at the top shows the latest version. If a change affects how we use your data, we will tell you in the app or by email.
12. Contact us
For privacy questions or to exercise your rights, contact our Data Protection Officer:
