Privacy Policy

Last updated: 25 September 2026

1. Who we are

KINTRA is operated by PEDL Labs SA, a company established in Switzerland. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, PEDL Labs SA is the data controller. For the purposes of South Africa's Protection of Personal Information Act (POPIA), PEDL Labs SA is the responsible party.

PEDL Labs SA, Rue du Grand-Pont 12, 1003 Lausanne, Switzerland. Company number CHE-132.000.482. Email: legal@pedllabs.com

2. What this policy covers

This policy covers the KINTRA website, including the early access request form. The site has no user accounts, takes no payments, and does not track visitors.

This policy is written to meet the Swiss Federal Act on Data Protection, the GDPR, the UK GDPR and POPIA. Where these laws differ, we apply the standard that gives you the greater protection.

The site links to the KINTRA platform, which is governed by its own privacy policy. When the platform, wallet and campaign features become available to the public, this policy will be extended to cover them and the date at the top will change.

3. What we collect

When you request early access, you give us: your name, your email address, the type of person you are (fan, rights holder, brand, athlete, investor or other), your country, your favourite sport, and optionally your age bracket, favourite team and organisation.

If you contact us directly to request access to our investor materials, we use the details you give us in that correspondence, typically your name, your email address and your organisation.

We also record, without asking you to type it: campaign details from the link you arrived through where present, the page that referred you where your browser provides one, the date and time you submitted the form, and your IP address at the time of submission.

We do not ask for a phone number or a date of birth. We do not ask for, and do not want, any special category personal data (such as health, religion, political opinion, race or ethnicity, biometric data or sexual orientation) or, under POPIA, any special personal information. Please do not put any into a free text field.

4. Why we collect it and our legal basis

Early access requests. We use your details to email you about KINTRA early access, product updates and launch news, and to understand which channels people arrive through when they sign up. The wording shown when you sign up is: We will email you about KINTRA early access, product updates and launch news. You can unsubscribe at any time. See our Privacy Policy.

Our legal basis for emailing you is your consent (GDPR Article 6(1)(a); POPIA section 11(1)(a) and section 69). You give it by submitting the form. You can withdraw it at any time; see section 10.

Investor access requests. We use your details to respond to your enquiry and to decide whether to share investor materials with you. Our legal basis is our legitimate interest in responding to enquiries about the company and in raising capital (GDPR Article 6(1)(f); POPIA section 11(1)(f)).

Technical details. Our legal basis for the campaign details, referring page, IP address and time of submission is our legitimate interest in understanding how people find us and in keeping our forms secure and free from abuse (GDPR Article 6(1)(f); POPIA section 11(1)(f)). We have assessed that this does not override your interests, because the data is minimal, expected, and used only for these purposes.

Direct marketing under POPIA. Under POPIA section 69, we may send you electronic direct marketing only with your consent, which we ask for once when you sign up. Every email we send carries an unsubscribe link and you may also opt out at any time by emailing legal@pedllabs.com. We will not pass your details to anyone else for their own marketing.

Giving us these details is voluntary. If you choose not to, nothing else on the site is affected; we simply will not add you to the list or respond to the request.

5. Automated decisions and profiling

We do not make decisions about you by automated means, and we do not profile you. If this changes, we will update this policy and tell you what the decision is, how it is made and how to challenge it.

6. Cookies and tracking

This site sets no cookies of its own. Cloudflare, which protects the site from automated traffic, sets one strictly necessary security cookie (__cf_bm) to detect bots; it expires after 30 minutes of inactivity. It runs no analytics, no tag manager and no advertising or tracking pixels.

When a page loads, your browser fetches files from three other companies, which necessarily see your IP address and browser details: Lovable, which hosts the site; Google Fonts, for the typefaces; and Cloudflare, through its public cdnjs service, for an animation used in the background. These requests are needed for the page to display. We do not use them to identify or track you.

If we add analytics or tracking cookies later, we will update this policy and ask for your consent first.

7. Who we share it with

We do not sell your personal data and we do not give it to anyone for their own marketing.

We use these providers, who act only on our instructions as processors (GDPR) and operators (POPIA), under written contracts that require them to protect your data:

Lovable (Lovable Labs Incorporated, United States): hosts the site and provides the database your details are stored in. Lovable uses Supabase as a sub processor.

Resend (United States): sends our emails.

Cloud hosting and platform operation and support providers: host and operate the KINTRA platform in the AWS Asia Pacific (Singapore) Region, where your early access details are also recorded.

We may also share personal data with our professional advisers where necessary, with courts, regulators or law enforcement where the law requires it, and with a buyer or successor if PEDL Labs SA is sold, merged or reorganised, subject to appropriate protection and to this policy continuing to apply.

8. Where your data is stored and international transfers

Your details are stored in the United States and Singapore. PEDL Labs SA is established in Switzerland, which the European Commission and the United Kingdom recognise as providing adequate protection.

Lovable is a United States company, so we rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum, to cover its access to and storage of your data there. Resend, which sends our emails, is also a United States company; we rely on the same safeguards to cover its access to that data. For the KINTRA platform in Singapore, we rely on applicable Standard Contractual Clauses, adequacy mechanisms, certifications or other lawful safeguards. You can ask for a copy of these safeguards by emailing legal@pedllabs.com.

For people in South Africa: under POPIA section 72, we transfer your personal information outside South Africa to Switzerland, the United States and Singapore. Switzerland has data protection laws that provide substantially similar protection to POPIA. Transfers to our United States and Singapore providers are covered by binding contractual terms that require a level of protection substantially similar to POPIA, and you consent to these transfers when you submit the form.

9. How long we keep it

We keep early access details for 24 months after you submit the form or last contact us, whichever is later, after which we delete them. We keep investor request details for 24 months after our last correspondence with you.

If you unsubscribe, we stop emailing you and keep only the minimum needed (your email address on a suppression list) to make sure we do not email you again.

If we close the early access programme, or KINTRA does not launch, we delete the list.

We may keep information for longer where the law requires it, or to establish, exercise or defend a legal claim.

10. Your rights

Under the GDPR and UK GDPR (Articles 15 to 22) and POPIA (sections 23 to 25), you have the right to:

Be told what personal data we hold about you and receive a copy (access).

Have inaccurate data corrected and incomplete data completed (rectification).

Have your data deleted (erasure), subject to legal exceptions.

Restrict how we use your data in certain circumstances.

Receive your data in a structured, commonly used, machine readable format and have it transmitted to another controller (portability), where we rely on your consent.

Object to processing based on our legitimate interests, including the campaign, referrer and technical details described in section 3. If you object, we will stop unless we have compelling legitimate grounds that override your interests.

Object at any time to direct marketing, in which case we will stop.

Withdraw consent at any time, without affecting the lawfulness of what we did before you withdrew it.

To exercise any right, email legal@pedllabs.com. We will respond within one month under the GDPR and UK GDPR, and within a reasonable time under POPIA, and we may ask you to verify your identity first. We will not charge you unless a request is manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority: the Federal Data Protection and Information Commissioner in Switzerland; your local supervisory authority in the European Economic Area; the Information Commissioner's Office in the United Kingdom; or the Information Regulator in South Africa (complaints@inforegulator.org.za). We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

11. Age

KINTRA early access is for people aged 18 and over. Please do not sign up if you are under 18. We do not knowingly collect personal data from anyone under 18, and under POPIA we do not process the personal information of children. If we learn that we hold data from someone under 18, we will delete it.

12. Security

We protect your data with measures appropriate to the risk, including encryption in transit (TLS) for everything sent to us, encryption at rest in our database provider's infrastructure, access restricted to the people who need it, and audit logging of access to the stored data. Our providers are contractually required to apply equivalent measures.

No system is completely secure, so we cannot promise absolute security.

13. Data breaches

If a personal data breach occurs that is likely to result in a risk to you, we will notify the relevant supervisory authority within 72 hours where required by the GDPR or UK GDPR, notify the Information Regulator as soon as reasonably possible where required by POPIA section 22, and tell you without undue delay where the risk to you is high, explaining what happened and what we are doing about it.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a significant change, we will take reasonable steps to bring it to your attention, including emailing the early access list where appropriate.

15. Contact

PEDL Labs SA, Rue du Grand-Pont 12, 1003 Lausanne, Switzerland. CHE-132.000.482. legal@pedllabs.com