Privacy Policy

1 Who we are

Sport in Denmark ("we", "us", "the platform") is a Danish initiative taken by 7 sports federations that helps international citizens discover and join local sports clubs in Denmark. Our platform is operated from Denmark and the website is available at sportindenmark.dk.

Sport in Denmark is a joint project of seven Danish sports federations: Dansk Cricket-Forbund, Dansk Curling Forbund, Dansk Hockey Union, Dansk Softball Forbund, Dansk Squash Forbund, Floorball Danmark and Rugby Danmark. The platform is operated by Dansk Cricket-Forbund (CVR 11837697), Idrættens Hus, Brøndby Stadion 20, 2605 Brøndby, Denmark, which is the data controller for personal data processed through the platform. Privacy questions: privacy@sportindenmark.dk.

2 Data we collect

Account information

• Name, email address, password (stored as a salted one-way hash — never in plain text)
• City of residence, preferred language, profile photo (optional)
• Date you joined and your role (member, club administrator, federation administrator, etc.)
• Year of birth and gender (optional). You can add them on your account page or leave them empty; the platform works the same either way. Today we use them only for: anonymous statistics that show sports federations how many trial bookings came from each gender and age group, never for a group of fewer than 5 people; and, if you give a year, a check that you are at least 16. Your actual year of birth and gender are not shown to clubs, federations or other members.

Bookings and activities

• Trial sessions you book and the clubs/teams you book with
• Events you register for. If you register without a verified account (as a guest, or before you have confirmed your email), you confirm the registration by clicking a link we email you. Until you click it, we hold your request for up to 48 hours and the organiser is not told.
• Volunteer roles you apply for
• Buddy profile and messages exchanged via our matching feature (if you opt in). If you set a buddy profile to "colleagues only" through your employer's programme and that access ends — because your employer leaves the programme or you leave your employer — the profile is paused: nothing is shown to anyone until you choose a new visibility on your buddy page. We tell you by email and in your notifications.
• Well-being check-ins you choose to answer (WHO-5-based questions about how you have been feeling). These are health-related data — a special category under GDPR Art. 9, so we process them only on your explicit consent, which you give with a tick box before your first check-in. They are stored with your account and kept in anonymous form after your account is deleted.

Sport at work

A club admin, coach or club buddy can host a free Sport at work session — a short session of their club's sport at their own workplace. Each session has a sign-up page that can only be reached through its link; it is not listed anywhere on the platform or in search engines.

• If you sign up, we collect your first name, last name and email address. You confirm your place by clicking a link we email you. Until you click it, we hold your request for up to 48 hours. When you confirm, you get a Sport in Denmark guest account and an event registration — exactly as when you register for any other event on the platform. The host and the club see your first name, the first letter of your last name and how many people have signed up, never your email address.
• We email you the confirmation link, a receipt, a reminder two days before the session (if you signed up in time) and, the day after, one follow-up with the club's next free trial sessions, which you can opt out of in that email (we send it on the basis of our legitimate interest — see section 4). The host can send everyone who signed up at most two messages through us; we deliver them, and the host never sees your address.
• If you host a Sport at work session, your first name and your role in the club are shown on its sign-up page and poster. The name of your workplace, if you add it, is seen only by you, your club's admins and Sport in Denmark. If you ask us to get in touch about our programme for companies — only by clicking "Tell us about your workplace" yourself — we keep what you send us (the company name, its approximate size, who we should talk to and your note) together with your name and email address so we can reply. Nothing is sent to your workplace, and nothing happens automatically.

Club administrator data

If you administer a club, federation, or company on the platform, we additionally process the content you publish (team descriptions, photos, FAQs, events, volunteer postings, marketing materials you generate, etc.).

Club contact persons. When a sports federation or Sport in Denmark invites a club to the platform, the inviter enters the name and e-mail address of the club's contact person(s). We use these details only to send the invitation and one reminder, and to let the inviter see whether the invitation has been accepted. If the invitation is not accepted, we delete the name and e-mail address 90 days after it expires or is withdrawn. The legal basis is our legitimate interest in helping the federations' member clubs join the platform (GDPR Art. 6(1)(f)).

Technical data

• IP address, browser type and version, operating system, screen size
• Pages you visit on the platform and timestamps (kept in server logs)
• Session cookie that keeps you logged in (session, up to 90 days)
• If you submit a bug report: page URL, browser, viewport, timezone, and any recent in-browser JavaScript errors — used solely to reproduce and fix the issue

3 How we use your data

• To create and maintain your account and let you log in
• To register you for trial sessions, events, and volunteer roles, and to communicate those bookings to the relevant club
• To run Sport at work sessions: to confirm your sign-up, remind you two days before the session, send the one follow-up the day after and deliver the host's messages to the people who signed up
• To send transactional emails (booking confirmations, password resets, important account notices)
• To send the platform newsletter, if you have opted in (you can unsubscribe at any time using the link in every email)
• To ask you, after a trial session or an event, how it went — see Follow-up questionnaires below
• To improve the platform, debug issues, and prevent abuse
• To comply with legal obligations

Turning off optional email

Under Account → Email & privacy on your dashboard, "Stop all emails" switches off every optional message in one click: the newsletter, digests, reminders about sessions and events, follow-ups and evaluations, well-being check-ins, buddy messages and club messages. You can switch it back on from the same place, and we restore the exact preferences you had before.

There are three ways to stop optional email in bulk, and they do not reach equally far. Many mail apps show their own "Unsubscribe" button next to the sender; when yours does, using it normally stops every optional email, because it sends us a one-click unsubscribe that we handle as the full opt-out — but not every mail app shows that button, and a few only offer to send us an email instead, so if you want to be certain, use "Stop all emails" under Account → Email & privacy, which always stops everything optional. The "Unsubscribe" link in the text of the email is the narrow one: it opens a page whose button stops the newsletter and the research mailings we send from the administration pages, and leaves reminders and follow-ups running. Two of these emails can also be switched off on their own, under "Notification preferences" on your Messages dashboard page: "Email on new message" (either the reminder we send when a buddy's message is still unread after 20 minutes, or the welcome email your club buddy sends when they take your trial request) and "Email on new connection" (the introduction we send when a club matches you with a club buddy). Turning either off stops that email only — it does not affect your bookings, your event registrations, or any other optional email. The well-being check-ins carry their own unsubscribe link in the invitation. Whichever you use, the emails described just below keep coming, and pressing Subscribe again on the unsubscribe page, or switching "Stop all emails" back off under Account → Email & privacy, lifts a full opt-out again and restores the preferences you had before.

A small set of emails keeps going, because they are part of a service you asked for and you would be left stranded without them: confirmations, changes and cancellations for your own bookings, events and volunteer applications; login codes, password resets, email-change confirmations and the account-deletion link; and messages you receive because you administer a club or a federation. Every other email we send is optional, and "Stop all emails" stops it. A new kind of email counts as optional until we have decided that it belongs in this small set.

Follow-up questionnaires

If you booked a trial session or joined an event, we may email you a short follow-up questionnaire about that experience. We send it on the basis of our legitimate interest (Art. 6(1)(f)) in finding out whether the platform actually helps people join a club — never as advertising.

You can switch these questionnaires off yourself at any time. "Stop all emails" under Account → Email & privacy stops them, and so does your mail app's own "Unsubscribe" button if it shows one. The button on the unsubscribe page that the link in the email opens is the narrow one — it stops newsletters and research mailings, but not the automatic follow-up after a trial session or an event — so use "Stop all emails" if you want all of it to stop.

We do not sell your personal data, and we do not use it for targeted advertising.

4 Legal basis (GDPR Art. 6 and Art. 9)

5 Sharing and third parties

We share the minimum data necessary with:

• Sports clubs and federations on the platform — when you book a trial, register for an event, or apply to volunteer, the relevant club receives your name and the booking details so they can welcome you. Clubs cannot see contact information until you allow them to, as well as members of other clubs.
• Email delivery providers — to send transactional emails and (if you opt in) newsletters.
• Comments on our Facebook and Instagram posts: we read the comments on our own Facebook and Instagram posts so we can answer and moderate them. For this we keep the comment’s text, the name shown with it and Meta’s reference to it for at most 30 days, and a comment we delete for at most 7 days; then it is deleted. Only Sport in Denmark’s site administrators can see them, and they are not used for anything else, nor shared with anyone.
• Comment-to-DM: if you comment one of the keywords shown on a post (for example "LINK"), we also use that comment to send you the post’s link in a private message through Meta and to post a short public reply under your comment. For this we keep nothing but a one-way code of the comment’s id for 7 days, so the same comment is never answered twice. If you do not want a message, simply do not comment the keyword.
• Hosting and infrastructure providers — to operate the servers and databases that run the platform.
• Public authorities — if required by Danish or EU law (e.g. court order, regulatory request).
• Analytics provider — we use Google Analytics 4 (Google Ireland Ltd.) to measure how the platform is used. Before you accept analytics cookies, Google Analytics receives only cookieless, anonymous signals (Google Consent Mode) — the address of the page, the page that referred you and your IP address, with nothing stored in your browser and no identifier that lets Google recognise you across pages or visits. Full analytics cookies, technical identifiers and page-interaction data follow only after you accept. If you decline, this stays the case: the cookieless signals continue on every page, but no cookie is ever set and nothing links your page views together. The one-time tokens in personal links — password resets, account activation, booking cancellation, evaluations, surveys and unsubscribe links — are stripped out of the page address before it is sent to Google, so a personal link of yours is never shared with the analytics provider. Google acts as an independent controller for its part of the processing; details are in Google's own privacy policy. We use no social-media or advertising pixels unless you accept marketing cookies (see section 6). See how Google uses information from sites or apps that use its services: policies.google.com/technologies/partner-sites.
• Meta Platforms Ireland Ltd. — advertising measurement, and only when you accept marketing cookies. If you accept, our Meta pixel sends page views, form events and the sport and city you were browsing or searching for — which form, which sport, which city — to Meta, so we can see whether our ads on Facebook and Instagram lead to trial bookings. It never receives your name, email address or messages. If you decline marketing cookies, the pixel is not loaded and Meta receives nothing at all. See section 6. See Meta’s privacy policy: facebook.com/privacy/policy.
• OpenStreetMap Foundation (United Kingdom) — maps. Event and club pages show a small map image of the venue. That image is made and served by our own server from OpenStreetMap map data, so loading the page sends nothing about you to OpenStreetMap. Only if you press "Open interactive map" (or "Show map") is the interactive map loaded from OpenStreetMap Foundation, which then receives your IP address and the address of the page you are on, so it can send the map back to you. To make the map images, our server downloads map pieces from OpenStreetMap; those requests contain no information about you. We do not embed Google Maps anywhere on the site. The "Get directions" link opens Google Maps in a new tab only when you click it, and it is your own browser that contacts Google at that point, not us.

All processors are bound by data-processing agreements and are required to handle your data in accordance with GDPR.

6 Cookies and tracking technologies

We use cookies and similar technologies (local storage) for the following purposes:

Strictly necessary (always active)

These are required for the platform to work. They cannot be turned off.

Analytics (cookies only with your consent)

We use Google Analytics 4 (Google Ireland Ltd.) to understand how visitors find and use the platform, which pages are popular, and where the experience can be improved. Google Signals and advertising features are switched off, and the property is not linked to a Google Ads account. Before you accept analytics cookies, Google Analytics receives only cookieless, anonymous signals (Google Consent Mode): the address of the page, the page that referred you and your IP address. Nothing is stored in your browser, and Google is given no identifier that lets it recognise you across pages or visits. The cookies in the table below are set — and your page views joined into one session — only after you accept. If you decline, this stays the case: the cookieless signals continue on every page, but no cookie is ever set and nothing links your page views together.

Marketing and advertising (only with your consent)

We use no advertising technology unless you accept marketing cookies. There is no LinkedIn Insight Tag and no TikTok Pixel on this website, and Google Analytics is not linked to Google Ads. We do not run Google’s advertising features or Google Signals, and Google Analytics is never used to build advertising audiences.

The cookie banner offers a Marketing category. Anything in it loads only for visitors who have accepted that category; if you do not accept it, no advertising cookies are set.

Marketing cookies (Meta Pixel). The only advertising technology in this category is Meta's pixel, which we load through Google Tag Manager, only for visitors who have accepted marketing cookies. Because we load it through our tag manager, which itself only runs when statistics cookies are accepted, marketing consent on its own does not load the pixel — statistics cookies have to be accepted too. It measures whether our ads on Facebook and Instagram lead to trial bookings, and shows relevant ads to people who have visited. It sends page views and form events to Meta — never your name, email or messages. Those events carry the sport and the city you were looking at — for example a club page for cricket in Herning, an event, a volunteer role, or a search you ran on the platform — so that we can show our ads to people interested in that sport in that area. Our own events never carry the name of the club, event or role, and a search never carries anything you typed: only the sport and city you picked from the menus. Meta’s pixel does, however, always receive the web address of the page you are on — for a club or event page that address contains the club’s or event’s name, the same text your browser shows in its address bar. We do not upload customer lists to Meta and we do not send it anything from our own servers. You can withdraw this at any time under "Cookie settings" at the bottom of every page. Decline marketing cookies and nothing is loaded.

Campaign codes. Links in our ads — and links that clubs share on their own websites and newsletters — carry a short campaign code in the address. When you book, the code is stored with your booking so we can see which campaigns work. While you are on a page whose address carries such a code, we also add to a daily counter for that campaign — one count for the visit, and one if you start filling in a form — so we can see how many people an ad reached. That counter holds no name, no account and no free text: only the campaign, which of our own campaign pages you landed on (if any), which A/B version of the page you saw, and whether marketing cookies were accepted. It sets no cookie and does not depend on your cookie choices; your IP address is used only in the form of one-way codes — one that changes every day, so that the same visitor is not counted twice, and one kept for up to a week after your most recent visit to limit abuse — and what we keep beyond that is the daily totals, which name no one. It is not a cookie and identifies the campaign, not you. Those daily totals are kept for up to 400 days and then deleted automatically.

Short links and QR codes. When you open a sportin.dk link or scan one of our QR codes, we record the time, how you arrived (for example QR code or social media), the referring website, your browser type, your country and a salted, one-way code made from your IP address, so we can count visits without identifying you.

Club buddy invite links. A club buddy can share a personal link or QR code to their club. When you open it, we count the visit without recording who you are. If you then book a trial, we note on your booking that it came through that buddy's link. The buddy is told that someone booked through their link — not who, unless the club asks them to welcome you — and the club's admins can see which bookings came through which buddy. We keep this note for as long as we keep the booking.

For club buddies. We count how many newcomers you have welcomed, so that we and your club can thank you — for example in a yearly email and on a certificate you can download. Your club's admins can see these counts.

Page views. We also count page views on our own server, on every public page — not only the ones reached through a campaign link. For each page you open we add one to a daily total made up of the date, the address of the page with everything after the question mark removed, a campaign code if the link carried one, whether you were on a phone or a larger screen, and whether you arrived from our own site, from somewhere else, or directly. It sets no cookie, it depends on no cookie choice, and it stores neither your IP address nor any code derived from it — which also means it counts views, not people: if you open three pages, that is three. Addresses that can carry a private link, such as a password reset or an invitation, are shortened to the plain page before anything leaves your browser. Your own dashboard pages and the club kiosk screens are not counted at all. Those daily totals are kept for up to 400 days and then deleted automatically.

Clubs who show Sport in Denmark on their own website. Some clubs place a small Sport in Denmark widget on their own website. The widget sets no cookies and stores nothing in your browser. Loading it makes an ordinary request to our server, which appears in our server logs like any other page request (see "How long we keep technical records"). We have switched on an installation counter: for each visit, we record only which club’s widget was shown, the website address it was shown on, and the date — never your IP address, your device, or the page you were reading.

Managing your choices

The first time you visit, a cookie banner asks for your choice. You can Accept all, Decline, or open View preferences and tick the categories separately — Functional, Preferences, Statistics and Marketing. Preferences and Marketing only do something if you accept them. Nothing beyond the strictly necessary cookies is loaded until you accept it.

You can change or withdraw your choice at any time by clicking "Cookie settings" at the bottom of any page. That brings the banner back so you can choose again, tells Google Analytics to stop, and deletes the analytics cookies from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

If you decline, or simply ignore the banner, no analytics or advertising cookies are set, nothing that can recognise you across visits is stored, and nothing at all is sent to Google.

You can also block cookies entirely in your browser settings, or use browser-level tracking-prevention features.

Club kiosks

Some clubs run the platform on a shared tablet at their venue (the /kiosk/ page). Because that screen is handed from one guest to the next, the cookie banner is not shown there and the page sets no consent cookie and no analytics cookie at all. Since analytics can never be accepted on a kiosk, nothing is sent to Google from that screen either.

7 Data retention

• Account data: kept while your account exists. You can delete your account yourself at any time — see Deleting your account below.
• Bookings, event registrations and volunteer applications: kept as the club's record of who signed up and who turned up. If you delete your account, your name and contact details are removed from them and only the anonymous attendance figures remain.
• Membership outcome: after a trial we may ask whether you joined the club, and the club can mark it. We store only that answer with your booking. The club you tried can see if you told us you joined. Everyone else — partners, federations and our funders — only sees counts in groups of five or more, never your name.
• Spot alerts: if you ask us to tell you when a spot opens in a full session, we store your first name and email (and your account ID if you are logged in) only for that purpose. We delete your name and email when you book, leave the list or booking for the session closes, and remove the entry completely 30 days later. Every alert has a link to take you off the list.
• Club contact person invitations: the name and e-mail address entered for a club's contact person are deleted 90 days after the invitation expires or is withdrawn, if it was not accepted.
• Sport at work: a confirmed sign-up is an event registration on your guest account and follows the same rules as any other event registration: it is kept while your account exists, and if your account is deleted, your name and contact details are removed and only the anonymous count remains. A guest account has no password — to delete it, set one with "Forgot password" and choose "Delete my account", or write to privacy@sportindenmark.dk. A sign-up you never confirm is emptied after 48 hours and removed 30 days later. A host's workplace name and request to contact their workplace are kept while the host's account exists and deleted with it.
• Email delivery log: which account a message went to, the template name, the subject and the delivery status — no address and no message content — kept for up to 24 months as proof of what we sent.
• Server logs: typically up to 12 months, then deleted.
• Bug reports: kept until the issue is resolved, and then up to 12 months for quality assurance.

How long we keep technical records

These are cleaned up automatically every night:

When an administrator deletes something

When an administrator deletes a club, an account, an event, an email template or a campaign, the data is kept in a trash bin for 30 days so the deletion can be undone, then permanently deleted by the nightly cleanup. As with sent email, a technical backup copy is kept outside the website for up to 30 more days and then deleted.

Deleting your account

You can delete your account yourself: open Account → Email & privacy on your dashboard and choose "Delete my account". We ask for your current password and then email you a one-time confirmation link, so that nobody else can delete your account on your behalf. The deletion happens when you follow that link, and you are logged out immediately afterwards.

Clubs have to be able to say honestly how many people came to their sessions, so deleting your account does not erase those attendance rows — it removes you from them. Your account becomes an anonymous "Deleted user":

• Your name, email address, password, phone number, year of birth, gender, nationality, city, languages, biography and profile photo are erased, and the photo file is removed from our servers.
• Your buddy profile, your private messages, your connections, blocks and bookmarks, your saved preferences and notifications, and any mobile devices registered to you are permanently deleted.
• Free text you wrote elsewhere — volunteer applications, support messages, bug reports, notes on an event registration, evaluation comments — is stripped of your name and contact details.
• Your name is also removed from other people's notifications about you, and from any email still waiting in the queue that mentions you.
• What remains are bookings, registrations and evaluation scores with no person attached, so clubs keep their attendance and quality figures.

Three records are deliberately kept. None of them is used to contact you or to build a profile of you:

• The administrator access log. A record of when a site administrator viewed the platform as your account. It is an audit trail that exists to protect you, and we keep it on the basis of our legitimate interest (Art. 6(1)(f)).
• Moderation reports. Reports made about you, and reports you made about someone else, kept as the evidence behind a moderation decision.
• The deletion request itself. Your former user number, a one-way hash of the confirmation link, and three timestamps. It holds no personal details; it is what lets a re-opened link answer "already used" instead of "not valid".

Your deleted account keeps the "no email" setting switched on, and its address is replaced by an address that cannot receive mail, so nothing can ever be sent to it again. We do not keep a copy of your old email address for this.

Deletion is not available while you hold an administrator role (club, team, federation, company or site administrator) or an active club-buddy profile, because someone else would be left without an owner for that role. Hand the role over or stand down as a club buddy first, or contact us and we will help.

8 Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data ("right to be forgotten"), or delete your account yourself under Account → Email & privacy (see Data retention)
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest, including the follow-up questionnaires described in How we use your data, which you can also switch off yourself at any time
• Withdraw consent — for anything we do on the basis of your consent (e.g. newsletter)

To exercise any of these rights, email privacy@sportindenmark.dk (see Contact us). We respond within 30 days.

You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.

9 Security

We protect your data with industry-standard measures, including:

• TLS/HTTPS encryption for all traffic between your browser and our servers
• Salted one-way password hashing — we cannot read your password
• Role-based access controls — administrators can only see data for the clubs and federations they belong to
• Server-side input validation and protection against common web attacks (SQL injection, XSS, CSRF)
• Regular software updates and security reviews

No method of transmission over the Internet is 100% secure. If we ever experience a breach affecting your personal data, we will notify you and the Danish Data Protection Authority as required by GDPR Art. 33–34.

10 Children

Sport in Denmark is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16 without verified parental or guardian consent. If a parent or guardian becomes aware that their child has provided us with personal data without consent, please contact us and we will delete it.

11 International data transfers

Our servers are hosted within the European Union. Google Analytics is the only third-party analytics service we use, and it may transfer data to the United States — but only if you accept analytics cookies. If you do not accept, no analytics data is transferred at all: the Google Analytics script is not loaded, so there is no transfer to consider. If you do accept, cookies are set, measurement runs, and the one-time tokens in personal links are removed from the page address before it is sent. Such transfers are protected by appropriate safeguards, including the EU–U.S. Data Privacy Framework (where the provider is certified) and/or the European Commission's Standard Contractual Clauses (SCCs), with supplementary technical and organisational measures where applicable. If you press "Open interactive map" on an event or club page, the map is fetched from OpenStreetMap Foundation in the United Kingdom, a country the EU recognises as providing adequate data protection; nothing is fetched unless you press the button.

12 Changes to this policy

We may update this policy from time to time to reflect changes in the platform or in the law. The "Last updated" date at the top will always show the current version. For material changes that affect your rights, we will notify registered users by email.

13 Contact us

If you have any questions about this policy or about how we handle your personal data, please contact us:

• Email: hello@sportindenmark.dk
• Privacy questions: privacy@sportindenmark.dk
• Website: sportindenmark.dk

To have specific content removed, contact us through the contact form and tell us what you would like removed. We will confirm once it is done. To remove your whole account, use "Delete my account" under Account → Email & privacy on your dashboard — see Data retention.