Privacy Policy

1. Controller

• Name: [ADATKEZELŐ NEVE]
• Registered address: [CÍM]
• Tax number: [ADÓSZÁM]
• Company registration number: [CÉGJEGYZÉKSZÁM]
• Data protection contact: adatvedelem@handballconnect.eu
• Data protection officer: [ADATVÉDELMI TISZTVISELŐ, HA KIJELÖLÉSRE KERÜL]

2. About the platform

Handball Connect is a closed, invitation-only professional platform for handball clubs, player agents and adult (18+) professional players. Player data is disclosed progressively, level by level: confidential data only reaches a club once the player (or their mandated agent) explicitly allows it.

3. Data we process, purposes and legal bases

• Account and identity data (name, email address, phone number, role, organisation membership, language setting, two-factor authentication data) — to create your account and grant access. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Player profile (name, year of birth, nationality, position, physical data, current club and league, career, profile photo or generated avatar) — to match players and clubs. Legal basis: performance of a contract; where an agent creates the profile, the player's consent (Art. 6(1)(a)), recorded on form HC-JATE-01.
• Confidential player data (passport / eligibility, salary expectation, contract expiry, transfer intent, representation mandate) — shown only to selected clubs at the disclosure level the player allows. Legal basis: performance of a contract and the player's consent.
• Club and agent data (organisation details, contact persons' names, email addresses and phone numbers, licence number, documents uploaded for verification) — to verify organisations and operate the platform. Legal basis: performance of a contract; for verification, legitimate interest (Art. 6(1)(f)) in preventing abuse.
• Transfer workflow data (interests, deal-room messages, documents, deadlines, notifications) — to run communication between the parties. Legal basis: performance of a contract.
• Waitlist / access requests (name, email address, role, organisation, message, internal outreach notes) — to assess the request and get in touch. Legal basis: steps prior to entering into a contract (Art. 6(1)(b)).
• Access and security logs (who viewed which player profile and when; an audit log of significant actions; sign-in events; IP address and browser data in server and authentication logs) — for security, investigating abuse, and so players can see who accessed their data. Legal basis: legitimate interest.
• Moderation data (reports, verification events, suspensions) — to enforce platform rules. Legal basis: legitimate interest.

We do not ask for special-category data (e.g. health data). Please do not enter any in free-text fields or messages.

4. Cookies

We only use strictly necessary cookies: the signed-in session cookies and a cookie storing your chosen language. We use no analytics or marketing cookies and no third-party trackers.

5. Processors

The following providers process data on the controller's behalf and under its instructions:

• Supabase (Supabase Inc.) — database, authentication and file storage. Data location: European Union, Frankfurt (AWS eu-central-1).
• Resend — transactional email (e.g. notifications, invitations, password resets) sent from noreply@handballconnect.eu. Processing location: European Union, Ireland (AWS eu-west-1).
• Hostinger (Hostinger International Ltd.) — the virtual private server (VPS) running the application. Data centre: [ADATKÖZPONT HELYE].
• fal.ai (Features & Labels, Inc., United States) — profile avatar image generation. We only send a fixed style description — no name, photo or other personal data. The request may nevertheless count as a transfer to a third country (see section 7).

Where a provider using an EU data centre has a parent company outside the EU, any access is covered by the European Commission's Standard Contractual Clauses (SCC): [TO BE VERIFIED PER PROVIDER].

6. Who can see your data

Other platform users can only see your data in line with the disclosure levels and their role (for example, a club sees confidential player data only with the player's permission). We do not sell data or share it for advertising. We disclose data to authorities only where legally required.

7. Transfers to third countries

Avatar generation uses the US provider fal.ai. Transfer mechanism: [EU–US DATA PRIVACY FRAMEWORK (DPF) CERTIFICATION OR SCC — TO BE VERIFIED]. Avatar generation is optional; you can set a profile picture without it or leave it out.

8. Retention

• Account and profile data: for as long as the account exists. After a deletion request it is anonymised within one month at the latest (see section 10).
• Contract, transaction and audit records: kept after deletion in a form that no longer identifies you (anonymised), for the accountability of the platform and the parties.
• Waitlist data: at most [12 MONTHS — PROPOSED] after the request is decided.
• Access and security logs: at most [12 MONTHS — PROPOSED], or until an ongoing investigation is closed.

9. Your rights

• Access (Art. 15): ask what data we hold about you.
• Rectification (Art. 16): you can correct most data yourself in your profile.
• Erasure (Art. 17): see section 10.
• Restriction of processing (Art. 18).
• Data portability (Art. 20): download your data in machine-readable (JSON) form under Settings → Privacy.
• Objection (Art. 21) to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)) at any time, without affecting the lawfulness of prior processing.

Send requests to adatvedelem@handballconnect.eu; we reply within one month (extendable by two further months where justified, in which case we will tell you). You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, www.naih.hu) or the supervisory authority of your country of residence, or go to court.

10. Deleting your account

You can request deletion of your account under Settings → Privacy. A moderator processes the request within one month at the latest. Processing is done by anonymisation: we delete or redact your name, email address, phone number, photos and avatar, free-text entries and contact details, and disable sign-in. Contract and audit records remain in a non-identifying form. The processing is recorded in the audit log.

11. Security

We use encrypted (HTTPS) connections, row-level access control in the database, two-factor authentication, least-privilege permissions and access logging. In the event of a personal data breach we act in accordance with GDPR Articles 33–34.

12. Minors

The platform does not process data of players under 18; the system rejects such profiles.

13. Changes to this policy

We update this policy when the service or the law changes; we notify users of material changes in advance.