Privacy policy

Note: For better readability, the masculine form is used for references to persons. It applies equally to all genders.

1. Controller

Andrzejewski, Mahnke, Hengelhaupt & Bornholdt Fussball-Performance GbR
Schwarzer Weg 14
21244 Buchholz
Email: [email protected]

1a. External data protection officer

We have appointed an external data protection officer. For all questions about data protection and the exercise of your rights, you can contact him directly and in confidence at any time:

Volker Kruse
radtkePERSONAL GmbH
Vor dem Bardowicker Tore 6a, 21339 Lüneburg
Email: [email protected]
Telephone: +49 4131 9279991
radtkepersonal.com

2. Overview of processing operations

The overview below summarises the types of data processed and the purposes of their processing and refers to the data subjects concerned.

3. Types of data processed

Master data: first and last name, email address, role (coach, player, parent), date of birth, shirt number, position, player status (active, suspended, dual registration).

Performance data: training and match ratings, form curves, match statistics (goals, assists, cards), season statistics, training attendance.

Self-submitted training values: running distance, average and top speed, and uploaded heatmap images. These values are not measured by the platform. The player takes them from an app or device of his choice and enters them himself or uploads the image himself. Providing them is voluntary; anyone who enters nothing suffers no disadvantage. The operator is not responsible for the measurement or for the data protection practices of the provider used there. The values can be viewed by the player himself and by the coaches of his team. Health and metabolic values such as pulse, blood pressure, weight or calorie consumption are not recorded and cannot be entered.

Absence data: Solely the period during which a player is unavailable — without any indication of the reason. Neither in the interface nor in the database, in interfaces (APIs) or in notifications is it recorded or displayed why someone is absent (see item 4a).

Communication data: chat messages (coach, team and parent channels), news items, poll answers, contact form and deletion requests.

Usage data: login times, device type (for push notifications), push subscription endpoints.

Financial data of the team: team kitty transactions, fines, monthly contributions (no bank details or credit card numbers).

Order and contract data (only for orders placed via the website): first and last name, email address, name of club and team, for an order on behalf of a club its address, chosen plan, time of the order and of the consent to the Terms and Conditions and the privacy policy including the version of the text, start of the contract, end of the trial phase, payment status, invoices, and declarations of termination and withdrawal with date and time. In addition, the identifiers under which Stripe keeps the customer and the contract.

Payment data: You enter your card number or IBAN on the order page directly into a form of the payment service provider Stripe. This data is not stored on our server (see item 7).

Availability data: confirmations and declines for training sessions and matches, and a reason for absence chosen from a fixed list (prevented, school/work, family, holiday, other). There is no free-text field for this; a health reason is not offered as an option and cannot be entered.

Parents' feedback after a match: Legal guardians can state what mood their child was in after a match — on a scale of 1 to 5, without free text. The entry is stored linked to the parent and the child, but is shown to the coaching team only in aggregated form and without names, and only once a minimum number of responses has been reached. Not to be confused with the mood check (item 4a), which is collected completely anonymously.

Location data: No automatic collection. Neither the web application nor the app requests location permission or accesses the location services of the end device. Match venue addresses are entered manually.

4. Legal bases

Personal data is processed on the following legal bases:

Art. 6(1)(b) GDPR (performance of a contract): Provision of the platform's functions in accordance with the terms of use, as well as ordering, billing and payment processing for contracts concluded via the website.

Art. 6(1)(a) GDPR (consent): Push notifications, photos. Consent can be withdrawn at any time.

Art. 6(1)(c) GDPR (legal obligation): Retention of invoices and accounting records under commercial and tax law; confirmation of declarations of termination and withdrawal.

Art. 6(1)(f) GDPR (legitimate interest): Ensuring operation, protection against misuse, technical logs, and protection against payment fraud for online orders.

Minors (Art. 8 GDPR): The processing of personal data of minors under 16 requires the consent of a legal guardian. Consent is obtained by means of a confirmation link sent to the legal guardian's email address (double opt-in) before the child's account is activated.

4a. Special categories of personal data (Art. 9 GDPR)

We do not process health data. The platform never records whether someone is ill or injured. Absences are recorded solely as a period (“not available from–to”), without a reason and without any connection to a person's state of health.

This has not always been the case: until August 2026 there were the attendance statuses “ill” and “injured” as well as a module for injury-related absences. Even without diagnostic detail, the statement that someone is injured or ill is health data under Art. 4(15) GDPR and Recital 35 — our earlier assessment was wrong. On the recommendation of our external data protection officer, we have therefore neutralised the field completely instead of obtaining consent for it. Existing entries were converted at the changeover; the old status designations no longer exist anywhere.

Mood check: is deliberately collected completely anonymously — without any link to a user or player account. Since this makes it impossible to draw conclusions about any person, it is not personal data (Recital 26 GDPR); separate consent is therefore not required. The comment field that existed previously was removed in August 2026 on the recommendation of our external data protection officer: in a free-text field, children can identify themselves or write about others, which would mean that anonymity could no longer be ensured. Only answers to predefined questions on a scale are collected.

Reasons for declining: Until August 2026, the reason for declining was a mandatory free-text field. This meant that information about a person's state of health could be entered there without explicit consent having been given. The field was replaced by a fixed selection with no health reference; the existing free texts were not carried over at the changeover but deleted and replaced with the corresponding neutral category.

5. Push notifications

When push notifications are activated, a device-bound endpoint (push subscription) is stored on our server. This endpoint is assigned to your device and account and is therefore personal data; it allows notifications to be sent to the respective device only. Consent is given actively via the browser or app dialogue and can be withdrawn at any time in the device settings. The web app (PWA) uses VAPID keys — an anonymous server-to-browser authentication without third-party providers. In the native app (iOS/Android), delivery runs via Firebase Cloud Messaging (Google LLC, USA), see item 7.

6. Cookies and local storage

Session cookie: A technically necessary cookie for authentication (NextAuth.js). Without this cookie, login is not possible.

CSRF token: Protection against cross-site request forgery attacks.

Service worker: As a progressive web app (PWA), the platform uses a service worker for offline functionality and caching. Pages and assets are cached locally on the device in the process.

No tracking cookies: No analytics or advertising cookies whatsoever are used. No Google Analytics, no Facebook Pixel, no comparable service.

Order page (Stripe): Stripe's payment form is loaded only on the order page, and there only once you click “Continue to payment”. Stripe then sets two cookies to detect payment fraud: __stripe_mid (lifetime one year) and __stripe_sid (30 minutes), and collects device and connection data for this purpose. In its form, Stripe also embeds the bot protection hCaptcha. Stripe classifies these cookies as strictly necessary. Nothing from Stripe is loaded on any other page of the website or in the platform.

IP addresses on login attempts: To protect against brute-force attacks, the IP address of the requesting device is stored temporarily with every login attempt. This data serves exclusively for rate limiting (limiting login attempts) and is deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the system).

6a. Internal system logs and operational security

To ensure the secure and trouble-free operation of the platform, the operator internally records the following data, which can be viewed exclusively in the password-protected super-admin area:

Audit log: For security-relevant actions (including login, logout, failed login attempts, changes to teams, users and settings, data exports, bulk email sending), the time, the executing user, the type of action and the IP address are logged. These logs serve traceability, detection of misuse and error analysis and are deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and integrity of the system).

Online status: The time of the last activity of a logged-in user is updated continuously in order to show in the super-admin area which users are currently active. No history is stored; only the current time is overwritten each time. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operation and system monitoring).

Server and error logs: For troubleshooting, technical events and error messages of the server are logged. These logs are not kept permanently but only to a limited extent and are automatically overwritten by new entries. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in error analysis and system stability).

Email delivery log: For every email sent by the platform, the time, recipient address, subject, type of message and delivery result are logged. This serves exclusively error analysis — so that a welcome or consent email that has not arrived is noticed instead of disappearing unnoticed — and the monitoring of the sending limits of our email provider. The entries are deleted automatically after 30 days. On a request for deletion, they are removed immediately. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in reliable delivery and in error analysis).

Incident log for online purchases: If something goes wrong technically with an order, a charge, a termination, a withdrawal or the sending of an email, the time, type of incident, error message, affected team and the customer's email address are logged. This serves exclusively to resolve the incident and to inform the customer on our own initiative instead of the customer having to ask. Resolved entries are deleted automatically 90 days after they have been resolved. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable ordering and payment process).

Page views (prepared, currently not active): A technical basis has been prepared for an evaluation of the pages used within the platform (storage of the page path accessed, user and IP address), which is currently not in active use. Should this function be activated, this privacy policy will be updated accordingly beforehand.

The data named in this section is used by the operator exclusively for internal purposes of system security, error analysis and technical support. There is no use for advertising purposes, no behavioural analysis of individual users beyond these purposes and no disclosure to third parties.

7. Recipients and processors

No data is disclosed for advertising or analytics purposes. For technical operation we use the following service providers under a data processing agreement pursuant to Art. 28 GDPR. Where a transfer to a third country takes place, the basis is stated in each case:

Hostinger International Limited (Larnaca, Cyprus) — hosting of the entire platform including the database. The server used is located in Frankfurt am Main. The basis is the provider's data processing agreement; access by group companies or sub-processors outside the EU cannot be ruled out and is safeguarded by standard contractual clauses.

Firebase Cloud Messaging — Google LLC (Mountain View, USA) — push notifications in the native app. The contracting party is the US company, not the Irish establishment; the storage location cannot be chosen. The basis is the Firebase Data Processing and Security Terms as a data processing agreement under Art. 28 GDPR together with standard contractual clauses; in addition, there is a certification under the EU-US Data Privacy Framework. Undelivered notifications are cached for up to 28 days; we therefore do not send sensitive content by push.

checkdomain GmbH (Große Burgstraße 27/29, 23552 Lübeck) — sending of our emails (welcome, consent confirmation, reminders, messages to clubs). The recipient address and the content of the message are transmitted. According to the provider, the data centres are without exception located in Germany; Hetzner Online GmbH (Gunzenhausen) and OVH GmbH (Saarbrücken) are named as sub-processors. The basis is a data processing agreement under Art. 28 GDPR. No third-country transfer takes place here.

Cloudflare, Inc. (San Francisco, USA) — reverse proxy and protection against overload attacks in front of the server, and storage of the encrypted off-site backups (Cloudflare R2). The contracting party is the US company even on the free plans. For technical reasons, Cloudflare processes IP addresses and connection data in accordance with its privacy policy. The basis is Cloudflare's Data Processing Addendum under Art. 28 GDPR together with standard contractual clauses; the storage region for the backups is fixed to the EU. The actual application data (database, files) remains on the server at Hostinger during live operation.

Stripe Payments Europe, Limited (Dublin, Ireland) — payment processing for contracts concluded via the website: card payment and SEPA direct debit, recurring charges, payment reminders. Name, email address, address where applicable, plan and amount are transmitted; you enter your card number or IBAN directly with Stripe. Stripe processes this data partly on our behalf (carrying out the payment) on the basis of Stripe's data processing agreement under Art. 28 GDPR, and partly under its own responsibility — in particular for fraud prevention, for cooperation with banks and card networks and to meet its own legal obligations (for example on the prevention of money laundering). In doing so, data is also transferred to Stripe, LLC in the USA and to other affiliated companies and service providers outside the EU. The basis for this is the standard contractual clauses of the EU Commission and, where applicable, the EU-US Data Privacy Framework. Further details in Stripe's privacy policy.

Not a processor, but worth mentioning: Until August 2026, the additional off-site backup was stored on a private Microsoft OneDrive account. With a private consumer account, Microsoft is its own controller; a data processing agreement under Art. 28 GDPR is not possible there. Although the backups were encrypted before upload throughout, we switched the backup to a provider with a data processing agreement on the recommendation of our external data protection officer. Nothing is stored at Microsoft any more.

8. Hosting and data location

The platform is operated on a server rented from Hostinger and can be reached via HTTPS through Cloudflare as a reverse proxy. The server is hardened (restricted SSH access, firewall, automatic security updates, no open database port) and is backed up automatically every day, including regular restore tests.

9. Retention periods

We store data only for as long as it is needed for its purpose. The following periods are applied automatically by the platform — nobody has to submit a request for this. Before any deletion of a team or an access, advance notice is given by email.

Team in the trial phase: If no contract is concluded after the trial phase, all data of the team is deleted 3 months after the end of the trial phase. The coach receives a message at the end of the trial phase and 14 days before deletion.

Team after the end of the contract: All data of the team is deleted 4 months after the end of the contract (§ 10(6) of the Terms and Conditions). The coach receives a message 30 and 7 days beforehand. After withdrawal from an online order, the team's data is deleted as early as 28 days after receipt of the withdrawal; the message comes 7 days beforehand. Invoices are retained, without any link to the team, because of the statutory retention obligation (Section 147 of the German Fiscal Code (AO), 8 years).

Unused access: Anyone who has not logged in for 12 months receives a notice; 30 days later the access is removed. For accesses without their own email address (e.g. those of children), the notice goes to the coach. The player profile in an active team remains in place — only the login is affected.

Players who have left the team: The player profile with all individual data (ratings, attendance, statistics, photos) is deleted 12 months after leaving, following a notice to the coach 30 days in advance.

Parents' feedback on mood after a match: 14 days after the match, the individual feedback is aggregated into count, average and distribution. After that, no feedback can be attributed to a parent or child any more.

Your own data in an active team: Stored for as long as the team uses the app and you are part of it. On request via the deletion page, personal data is deleted at any time within one month (see item 9a).

Files: Photos and other files of a deleted team or a deleted player remain for another 14 days in a protected recycle bin in the same secured storage and are then permanently removed — the same time window as for backups.

Backups: The database and the team files are backed up automatically every day, the rarely changing file stocks additionally every week. The backups are stored on the server itself and additionally, encrypted, with a second provider (Cloudflare R2, EU storage region) — encryption takes place before upload, so the provider cannot read the contents. They are kept for 14 days. Whether a backup can actually be restored is checked automatically every week against a disposable database. Data that has already been deleted may still be contained in backup copies until the end of the retention period — this is technically unavoidable and customary.

Contact and deletion requests: Stored until they have been answered; the record of deletions carried out is archived with restricted access for 3 years from the date of the deletion as proof of accountability (Art. 5(2) GDPR) and is then removed automatically. This also applies to the log of the automatic retention periods; it contains no names, only team, occasion and numbers.

Order and contract data: For the duration of the contract; they are deleted together with the team according to the periods above. Invoices and accounting records are retained afterwards because of the statutory retention obligation (Section 147 of the German Fiscal Code (AO), 8 years). The order with the declarations on the right of withdrawal and the receipt of a termination are kept as evidence for 6 months after termination or the end of the contract; after a withdrawal for 28 days from receipt.

Abandoned orders: If you fill in the order page but do not complete the order, your details are deleted 28 days after the last change.

Incident log for online purchases: Resolved entries are deleted after 90 days, the technical logs of the payment service provider's notifications likewise after 90 days.

Server/login logs: IP addresses and log data of login attempts are stored for 30 days and then deleted automatically.

Email delivery log: 30 days, then automatic deletion (see item 6a).

9a. Account deletion and anonymisation

Would you like your data or your child's data to be deleted? Use our deletion page. The complete player profile is deleted, with all individual data attached to it: login and contact data, profile photo, messages, mood check participations, parents' feedback after matches, absences, device assignments and all ratings, attendance records and personal statistics. In the team and season statistics, only the team's figures remain — for example the results and total goals of a season. After deletion they are no longer assigned to any person and cannot be traced back to you.

Until August 2026, we instead replaced the name with initials and kept the personal statistics. That was not a deletion: together with the shirt number and season, initials in a youth team are easily traceable and therefore remain personal data. On the recommendation of our external data protection officer, we changed this; the affected legacy records were cleaned up at the changeover.

10. Your rights

You have the following rights regarding your personal data at any time:

Access (Art. 15 GDPR): You can request information about the data we process.

Rectification (Art. 16 GDPR): You can request the rectification of inaccurate data.

Erasure (Art. 17 GDPR): You can request the deletion of your data, provided there is no statutory retention obligation — see our deletion page.

Restriction (Art. 18 GDPR): You can request the restriction of processing.

Data portability (Art. 20 GDPR): You can export your data in a structured, commonly used and machine-readable format (JSON). The platform offers an integrated export function for this.

Objection (Art. 21 GDPR): You can object to the processing of your data at any time.

Withdrawal of consent (Art. 7(3) GDPR): Consents given can be withdrawn at any time with effect for the future — just as easily as they were given.

For requests for access, rectification, restriction or objection, please contact: [email protected]. For deletion requests, please use the deletion page.

11. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de. You can also contact any other supervisory authority, in particular at your place of residence.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to reflect changes to our services in the privacy policy.

Version as of: 12 October 2026