Privacy Policy

1. Who We Are (Controller)

iHandball LLC (“iHandball”, “we”, “us”) operates a professional networking and scouting platform for handball players, coaches, and clubs at ihandball.com (the “Platform”). We are the data controller for the personal data described in this policy.

• Controller: iHandball LLC, 3470 Snouffer Rd., Columbus, Ohio 43235, United States
• Contact: info@ihandball.com (put “Data Subject Request” in the subject line for privacy requests)
• EU representative (Art. 27 GDPR): [EU representative appointment pending] — once appointed, you may contact our EU representative in addition to, or instead of, contacting us directly.

We have not appointed a Data Protection Officer; based on our current scale and processing, we do not believe one is required under Art. 37 GDPR.

2. What This Policy Covers

This policy applies to all visitors and registered users of the Platform, wherever they live. It supplements the rights granted by applicable law, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA). Where local law grants you stronger rights, those rights apply.

3. Personal Data We Collect

We do not collect special-category data (Art. 9 GDPR) by design. Some profile fields you choose to publish (e.g., nationality, photos) may indirectly suggest such data; publishing them is entirely your choice.

4. Purposes and Lawful Bases (Art. 6 GDPR)

Where we rely on legitimate interest, you may object at any time (Section 10). We do not use your data for third-party advertising, we do not sell personal data, and we do not use your data to train third-party AI models.

5. Who Can See Your Profile

The Platform is a scouting network: your profile (including career data, photos, and videos you add) is visible to other registered users and, depending on features and settings, may appear in search results, watchlists, and “who viewed your profile” (a Pro feature that shows profile owners who viewed them). Treat your profile like a public sports CV — publish only what you are comfortable sharing. Your date of birth is never shown on your profile. Message content is private to the participants, except where a message is reported and reviewed by our moderation team.

6. Processors (Service Providers)

We use the following processors under data-processing agreements. Each processes personal data only on our instructions.

We may disclose personal data when required by law, to comply with valid legal process, or to protect the rights, property, or safety of iHandball, our users, or the public. If iHandball is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction; we will notify you before your data becomes subject to a different privacy policy.

7. International Transfers

iHandball LLC is established in the United States. Analytics and error-monitoring data are stored in the EU (PostHog and Sentry EU regions); most other processors above store data in the US. When we transfer personal data of EEA/UK users to the US, we rely on:

• the EU–US Data Privacy Framework (DPF) for processors holding an active DPF certification, and
• the EU Standard Contractual Clauses (SCCs) (with the UK Addendum/IDTA where applicable), supplemented by technical measures (TLS in transit, AES-256 at rest, row-level access controls),

in each case as incorporated into our data-processing agreements with those processors. You may request a summary of the safeguards applicable to a given processor via info@ihandball.com.

8. Cookies and Similar Technologies

We use first-party cookies and local storage only:

• Strictly necessary — authentication session (Supabase Auth), security/anti-abuse, language and theme preference, and your consent choice itself. No consent required (ePrivacy strictly-necessary exemption).
• Analytics — PostHog product analytics. Off by default: nothing is captured until you accept the consent banner shown on your first visit, and we honor your browser's Do Not Track setting regardless of your banner choice. Analytics are keyed to a pseudonymous user ID; your email address is never sent to PostHog or Sentry.

We do not use advertising cookies or third-party tracking cookies. You can withdraw analytics consent at any time by emailing us or by clearing the Platform's site data in your browser, which resets the consent banner (clearing all cookies will also sign you out).

9. How Long We Keep Data (Retention)

The following periods are our targets pending final legal review:

You can delete your account at any time in account settings or by emailing us; deletion removes your profile from the Platform immediately and triggers the purge schedule above. Aggregated, anonymized statistics that no longer identify you may be retained.

10. Your Rights

If you are in the EEA or UK, you have the right to:

• Access your personal data and receive a copy (Art. 15);
• Rectify inaccurate data (Art. 16) — most profile fields are directly editable in the Platform;
• Erase your data (“right to be forgotten”, Art. 17) — use in-app account deletion or email us;
• Restrict processing (Art. 18);
• Data portability — a machine-readable export of the data you provided (Art. 20), currently fulfilled by email request;
• Object to processing based on legitimate interest (Art. 21);
• Withdraw consent at any time (analytics, push) without affecting the lawfulness of prior processing;
• Complain to a supervisory authority — you may lodge a complaint with the data-protection authority of your EU member state of residence or workplace, for example: Denmark — Datatilsynet (datatilsynet.dk); Germany — the authority of your Land (e.g., BayLDA, LDI NRW); France — CNIL (cnil.fr); Spain — AEPD (aepd.es); Portugal — CNPD (cnpd.pt); UK — ICO (ico.org.uk).

To exercise any right, email info@ihandball.comwith “Data Subject Request” in the subject line. We respond within one month (Art. 12(3)) and may ask you to verify your identity first. Exercising your rights is free of charge.

California residents have analogous rights under the CCPA/CPRA, including the right to opt out of “sale” or “sharing” of personal information — we do neither.

11. No Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). Search rankings and feature ordering are functional sorting, not automated decision-making in that sense; verification decisions are made by a human administrator.

12. Minors

The Platform is not directed at children under 16, and you must be at least 16 years old to create an account. We verify this with a date-of-birth check at registration; the date of birth you provide is used only for age verification and is never displayed publicly. We do not operate a parental-consent regime because we do not offer accounts to anyone under 16. If we learn we hold personal data of a child under 16, we will delete it promptly. Parents and guardians: contact info@ihandball.com.

13. Security

Personal data is encrypted in transit (TLS) and at rest (AES-256 via Supabase). The Platform enforces row-level security on every database table, per-user storage isolation for uploads, least-privilege service credentials, hashed passwords (bcrypt, checked against known-breach lists at signup), a nonce-based Content-Security-Policy, and an audited admin console. If we become aware of a personal-data breach that risks your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33) and affected users without undue delay (Art. 34).

14. Changes to This Policy

We may update this policy from time to time. Material changes will be announced by email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top reflects the latest revision.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

For GDPR or UK-GDPR requests, please put “Data Subject Request” in the subject line. We will respond within the statutory time limits.