HandballArena Privacy Notice

Last updated: 22 October 2026.

1. Scope and responsible organisations

HandballArena is operated by PSG, Borut Grauf s.p., Pod gonjami 85, 2391 Prevalje, Slovenia, business registration number 8519471000, tax/VAT number SI54246679, under the Fimula brand. Contact us at support@handballarena.app.

This notice explains personal-data processing associated with the HandballArena product website, app and hosted club websites. SportHQ enquiries and JoinSport directory services have their own notices. Sharing a provider or operator does not mean information is automatically shared between clubs or products for every purpose.

Your Club normally controls the purposes for its membership records, teams, training, attendance, evaluations, messages, participation fees and published club content. We provide the system and process those records on its instructions under our Data-Processing Agreement. The Club must identify itself and explain its own purposes, legal bases and retention practices to you.

We control our supplier relationship with club representatives, enquiries addressed to us, our own billing and legal records, and the account, security and support processing for which we determine the purposes. Where the same technical service operates on Club instructions, we act as processor for that activity. Our technical ability to administer the system does not make us the controller of all Club information.

2. Information and sources

Depending on the features used, we process:

• identity and contact details, such as names, email addresses, dates of birth and profile photos;
• sign-in credentials in protected form, account status, roles and club associations;
• membership, team assignments, jersey details and guardian relationships;
• training schedules, attendance, match participation, results and responses;
• coaching evaluations, development goals and authorised staff notes;
• club communications, uploaded files, website enquiries and membership applications;
• participation-fee records entered by the Club, and our separate subscription billing records;
• technical data such as IP addresses, request and sign-in times, device/browser information, security events and diagnostic reports; and
• support messages and records of privacy requests and their handling.

We receive data from you, your Club's authorised staff, guardians and other authorised people, and through use of the Service. Public content is supplied or published by the Club. A Club may create or import a member record before that person has an account.

Some enabled features may record limited health-related information, such as an illness or injury absence reason. The Club must establish the required legal conditions, restrict access and avoid collecting unnecessary medical details. HandballArena is not a medical-record service.

3. Purposes and legal bases

For our own controller activities, the relevant purposes and bases are:

Where we rely on legitimate interests, we consider the impact on individuals and the safeguards needed. You may object as explained below. We do not use the Club's contract as a blanket legal basis for every member's data. The Club identifies its own Article 6 basis and, where sensitive information is involved, the applicable additional condition.

Required information is identified when collected. Without necessary account or contact information, we may be unable to provide access or respond. Optional information should be limited to what the relevant feature or Club activity needs.

4. Who can see information

Access within a Club depends on authorised roles and the relevant feature. Guardians receive access to records concerning children they are authorised to manage. Information published on a public club website can be seen by anyone and may be indexed by search engines.

Our authorised personnel access information where needed for support, security, operation or privacy requests. We use the providers listed in Subprocessors for hosting, email delivery, network protection and backups. We may disclose information to advisers, authorities or other recipients where necessary to comply with law or establish or defend rights.

We do not sell personal data. We do not use identifiable Club-controlled content for advertising. Club publication and any optional third-party feature must have their own appropriate basis.

5. Processing locations and transfers

The main hosting and email providers listed for the Service operate in the EU. Cloudflare operates a global network, so routing, security and related information may be processed outside the EEA. EU hosting does not mean that every processing operation occurs exclusively in the EU.

For restricted transfers, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, with supplementary measures where needed. You can request information about the relevant safeguards through our contact. The provider list explains the relevant functions and locations.

6. Retention

We retain personal information only as long as needed for the purpose, relevant instructions and applicable legal requirements. In particular:

• Club records follow the Club's lawful retention instructions during the subscription. Leaving a team does not necessarily erase every record, but does not justify indefinite retention. Ask the Club about its membership and historical-record purposes.
• After a Club's subscription ends, its data is kept in restricted storage for 90 days and then deleted, including copies. Earlier valid deletion instructions are honoured. Data needed for a valid pending return request or legally required retention is restricted to that purpose.
• Account information is kept while needed for active access and related security or legal purposes. Removal from one Club does not necessarily close a shared account used with another.
• Personal-data export files are available for seven days after generation and are then removed by the export-cleanup process. This does not delete the underlying account records.
• Unsuccessful or unanswered club membership applications are removed after 180 days from the relevant decision or last activity. Accepted applications follow the associated member-record process.
• Billing and tax records are retained for applicable statutory record-keeping periods. Support, security and dispute records are retained according to their purpose, risk and any applicable claim or legal-preservation period, with access restricted accordingly.
• Encrypted backup copies expire no later than 90 days after creation. They are protected from ordinary use; after a recovery, applicable deletion instructions are reapplied.

We provide relevant retention details on request. Records that must be retained for a legal reason are restricted to that purpose rather than left available for unrelated use.

7. Children

The Service holds children's player records, but children must not use a separate sign-in account. An authorised guardian accesses the relevant child's records on their behalf, and Club staff access information according to their roles. The Club records the guardian link and permissions and is responsible for the lawful basis for the child's information. Guardian access does not make the records the guardian's personal data or remove the child's privacy rights. Permission to join a Club is separate from permission to publish a child's photo.

Children's information should be limited to what the Club needs. Sensitive information and public photos require particular care. A guardian's ability to act depends on their authority, the child's rights and applicable law. Contact us or the Club if you believe access or use is inappropriate.

8. Your rights and the request process

Depending on the legal basis and applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent without affecting processing already lawfully carried out. These rights have legal conditions and exceptions; they are not all unconditional rights to remove every record.

You can contact us by email or post without signing in. Where available, My Data & Privacy also accepts export and deletion requests. Our platform operations team handles the technical process, which may cover information linked to your account across several Clubs. We verify identity and guardian authority where necessary, establish the request's scope and involve the relevant Club for processing it controls. One Club does not gain access to another Club's records through this process.

For questions about a Club's purposes or decisions, contact that Club; we assist it where we act as processor. You may also send the request to us and we will help direct it appropriately. Central administration does not remove the Club's controller obligations or our own obligations.

We respond without undue delay and within one calendar month where the GDPR requires. If a permitted extension is necessary, we explain it within that initial period. A software workflow or cancellation option does not override legal deadlines. Restrictions affecting account closure are explained, including any action needed to transfer Club administration.

We do not use solely automated decisions with legal or similarly significant effects as part of the processing described in this notice. Coaching evaluations are information for authorised people to consider, not a substitute for their decisions.

9. Cookies, security and complaints

The Cookies and Browser Storage Notice describes sign-in cookies, preferences, navigation storage and relevant external services. Optional technologies are assessed separately and consent is requested where required.

We use measures appropriate to the risks, including access controls, club-data separation, protected credentials, encrypted transport, logging and protected backups. No service can guarantee absolute security. We notify the relevant controller, authorities and affected people of a personal-data breach where and when required by law.

You may complain to the Slovenian Information Commissioner or another competent authority, particularly where you live, work or believe an infringement occurred. You do not have to complain to us first.

We update this notice when the processing changes and communicate material changes appropriately. Questions and requests: support@handballarena.app or the postal address in section 1.