Privacy Policy

1 Who we are

Sport in Denmark ("we", "us", "the platform") is a Danish initiative taken by 7 sports federations that helps international citizens discover and join local sports clubs in Denmark. Our platform is operated from Denmark and the website is available at sportindenmark.dk.

For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for personal data processed through the platform.

2 Data we collect

Account information

• Name, email address, password (stored as a salted one-way hash — never in plain text)
• City of residence, preferred language, profile photo (optional)
• Date you joined and your role (member, club administrator, federation administrator, etc.)

Bookings and activities

• Trial sessions you book and the clubs/teams you book with
• Events you register for
• Volunteer roles you apply for
• Buddy profile and messages exchanged via our matching feature (if you opt in)
• Well-being check-ins you choose to answer (WHO-5-based questions about how you have been feeling). These are health-related data — a special category under GDPR Art. 9, so we process them only on your explicit consent, which you give with a tick box before your first check-in. They are stored with your account and kept in anonymous form after your account is deleted.

Club administrator data

If you administer a club, federation, or company on the platform, we additionally process the content you publish (team descriptions, photos, FAQs, events, volunteer postings, marketing materials you generate, etc.).

Technical data

• IP address, browser type and version, operating system, screen size
• Pages you visit on the platform and timestamps (kept in server logs)
• Session cookie that keeps you logged in
• If you submit a bug report: page URL, browser, viewport, timezone, and any recent in-browser JavaScript errors — used solely to reproduce and fix the issue

3 How we use your data

• To create and maintain your account and let you log in
• To register you for trial sessions, events, and volunteer roles, and to communicate those bookings to the relevant club
• To send transactional emails (booking confirmations, password resets, important account notices)
• To send the platform newsletter, if you have opted in (you can unsubscribe at any time using the link in every email)
• To ask you, after a trial session or an event, how it went — see Follow-up questionnaires below
• To improve the platform, debug issues, and prevent abuse
• To comply with legal obligations

Turning off optional email

Under Account → Email & privacy on your dashboard, "Stop all emails" switches off every optional message in one click: the newsletter, digests, reminders about sessions and events, follow-ups and evaluations, well-being check-ins, buddy messages and club messages. You can switch it back on from the same place, and we restore the exact preferences you had before.

There are three ways to stop optional email in bulk, and they do not reach equally far. Many mail apps show their own "Unsubscribe" button next to the sender; when yours does, using it normally stops every optional email, because it sends us a one-click unsubscribe that we handle as the full opt-out — but not every mail app shows that button, and a few only offer to send us an email instead, so if you want to be certain, use "Stop all emails" under Account → Email & privacy, which always stops everything optional. The "Unsubscribe" link in the text of the email is the narrow one: it opens a page whose button stops the newsletter and the research mailings we send from the administration pages, and leaves reminders and follow-ups running. Two of these emails can also be switched off on their own, under "Notification preferences" on your Messages dashboard page: "Email on new message" (either the reminder we send when a buddy's message is still unread after 20 minutes, or the welcome email your club buddy sends when they take your trial request) and "Email on new connection" (the introduction we send when a club matches you with a club buddy). Turning either off stops that email only — it does not affect your bookings, your event registrations, or any other optional email. The well-being check-ins carry their own unsubscribe link in the invitation. Whichever you use, the emails described just below keep coming, and pressing Subscribe again on the unsubscribe page, or switching "Stop all emails" back off under Account → Email & privacy, lifts a full opt-out again and restores the preferences you had before.

A small set of emails keeps going, because they are part of a service you asked for and you would be left stranded without them: confirmations, changes and cancellations for your own bookings, events and volunteer applications; login codes, password resets, email-change confirmations and the account-deletion link; and messages you receive because you administer a club or a federation. Today 57 message types always send and 30 are blocked by "Stop all emails".

Follow-up questionnaires

If you booked a trial session or joined an event, we may email you a short follow-up questionnaire about that experience. We send it on the basis of our legitimate interest (Art. 6(1)(f)) in finding out whether the platform actually helps people join a club — never as advertising.

You can switch these questionnaires off yourself at any time. "Stop all emails" under Account → Email & privacy stops them, and so does your mail app's own "Unsubscribe" button if it shows one. The button on the unsubscribe page that the link in the email opens is the narrow one — it stops newsletters and research mailings, but not the automatic follow-up after a trial session or an event — so use "Stop all emails" if you want all of it to stop.

We do not sell your personal data, and we do not use it for targeted advertising.

4 Legal basis (GDPR Art. 6 and Art. 9)

5 Sharing and third parties

We share the minimum data necessary with:

• Sports clubs and federations on the platform — when you book a trial, register for an event, or apply to volunteer, the relevant club receives your name and the booking details so they can welcome you. Clubs cannot see contact information until you allow them to, as well as members of other clubs.
• Email delivery providers — to send transactional emails and (if you opt in) newsletters.
• Hosting and infrastructure providers — to operate the servers and databases that run the platform.
• Public authorities — if required by Danish or EU law (e.g. court order, regulatory request).
• Analytics provider — we use Google Analytics 4 (Google Ireland Ltd.) to measure how the platform is used. Nothing is sent to Google until you accept analytics cookies — before you accept, the Google Analytics script is not loaded at all, so Google receives no page view, no IP address and no identifier from your visit. If you do accept, it receives technical identifiers, your IP address and page-interaction data. The one-time tokens in personal links — password resets, account activation, booking cancellation, evaluations, surveys and unsubscribe links — are stripped out of the page address before it is sent to Google, so a personal link of yours is never shared with the analytics provider. Google acts as an independent controller for its part of the processing; details are in Google's own privacy policy. We use no social-media or advertising pixels.

All processors are bound by data-processing agreements and are required to handle your data in accordance with GDPR.

6 Cookies and tracking technologies

We use cookies and similar technologies (local storage) for the following purposes:

Strictly necessary (always active)

These are required for the platform to work. They cannot be turned off.

Analytics (only with your consent)

We use Google Analytics 4 (Google Ireland Ltd.) to understand how visitors find and use the platform, which pages are popular, and where the experience can be improved. Google Signals and advertising features are switched off, and the property is not linked to a Google Ads account. Nothing is sent to Google until you accept analytics cookies. Until then the Google Analytics script is not even loaded on the page: nothing is stored in your browser, and no page view, IP address or identifier leaves your browser for Google.

Marketing and advertising (only with your consent)

Nothing in this category is active today. There is no Meta/Facebook Pixel, no LinkedIn Insight Tag and no TikTok Pixel on this website, and Google Analytics is not linked to Google Ads. We do not run advertising features or Google Signals, and we do not build advertising audiences from your visit.

The cookie banner still offers a Marketing category, because we intend to add advertising technologies later. Until we do, accepting it changes nothing and no advertising cookies are set. When we add them, they will only load for visitors who have accepted that category, and we will update this page first.

Managing your choices

The first time you visit, a cookie banner asks for your choice. You can Accept all, Decline, or open View preferences and tick the categories separately — Functional, Preferences, Statistics and Marketing. Today only Functional and Statistics have anything behind them; Preferences and Marketing are listed because we may add such technologies later. Nothing beyond the strictly necessary cookies is loaded until you accept it.

You can change or withdraw your choice at any time by clicking "Cookie settings" at the bottom of any page. That brings the banner back so you can choose again, tells Google Analytics to stop, and deletes the analytics cookies from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

If you decline, or simply ignore the banner, no analytics or advertising cookies are set, nothing that can recognise you across visits is stored, and nothing at all is sent to Google.

You can also block cookies entirely in your browser settings, or use browser-level tracking-prevention features.

Club kiosks

Some clubs run the platform on a shared tablet at their venue (the /kiosk/ page). Because that screen is handed from one guest to the next, the cookie banner is not shown there and the page sets no consent cookie and no analytics cookie at all. Since analytics can never be accepted on a kiosk, nothing is sent to Google from that screen either.

7 Data retention

• Account data: kept while your account exists. You can delete your account yourself at any time — see Deleting your account below.
• Bookings, event registrations and volunteer applications: kept as the club's record of who signed up and who turned up. If you delete your account, your name and contact details are removed from them and only the anonymous attendance figures remain.
• Email delivery log: which account a message went to, the template name, the subject and the delivery status — no address and no message content — kept for up to 24 months as proof of what we sent.
• Server logs: typically up to 12 months, then deleted.
• Bug reports: kept until the issue is resolved, and then up to 12 months for quality assurance.

How long we keep technical records

These are cleaned up automatically every night:

When an administrator deletes something

When an administrator deletes a club, an account, an event, an email template or a campaign, the data is kept in a trash bin for 30 days so the deletion can be undone, then permanently deleted by the nightly cleanup. As with sent email, a technical backup copy is kept outside the website for up to 30 more days and then deleted.

Deleting your account

You can delete your account yourself: open Account → Email & privacy on your dashboard and choose "Delete my account". We ask for your current password and then email you a one-time confirmation link, so that nobody else can delete your account on your behalf. The deletion happens when you follow that link, and you are logged out immediately afterwards.

Clubs have to be able to say honestly how many people came to their sessions, so deleting your account does not erase those attendance rows — it removes you from them. Your account becomes an anonymous "Deleted user":

• Your name, email address, password, phone number, year of birth, gender, nationality, city, languages, biography and profile photo are erased, and the photo file is removed from our servers.
• Your buddy profile, your private messages, your connections, blocks and bookmarks, your saved preferences and notifications, and any mobile devices registered to you are permanently deleted.
• Free text you wrote elsewhere — volunteer applications, support messages, bug reports, notes on an event registration, evaluation comments — is stripped of your name and contact details.
• Your name is also removed from other people's notifications about you, and from any email still waiting in the queue that mentions you.
• What remains are bookings, registrations and evaluation scores with no person attached, so clubs keep their attendance and quality figures.

Three records are deliberately kept. None of them is used to contact you or to build a profile of you:

• The administrator access log. A record of when a site administrator viewed the platform as your account. It is an audit trail that exists to protect you, and we keep it on the basis of our legitimate interest (Art. 6(1)(f)).
• Moderation reports. Reports made about you, and reports you made about someone else, kept as the evidence behind a moderation decision.
• The deletion request itself. Your former user number, a one-way hash of the confirmation link, and three timestamps. It holds no personal details; it is what lets a re-opened link answer "already used" instead of "not valid".

Your deleted account keeps the "no email" setting switched on, and its address is replaced by an address that cannot receive mail, so nothing can ever be sent to it again. We do not keep a copy of your old email address for this.

Deletion is not available while you hold an administrator role (club, team, federation, company or site administrator) or an active club-buddy profile, because someone else would be left without an owner for that role. Hand the role over or stand down as a club buddy first, or contact us and we will help.

8 Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data ("right to be forgotten"), or delete your account yourself under Account → Email & privacy (see Data retention)
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest, including the follow-up questionnaires described in How we use your data, which you can also switch off yourself at any time
• Withdraw consent — for anything we do on the basis of your consent (e.g. newsletter)

To exercise any of these rights, email us (see Contact us). We respond within 30 days.

You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.

9 Security

We protect your data with industry-standard measures, including:

• TLS/HTTPS encryption for all traffic between your browser and our servers
• Salted one-way password hashing — we cannot read your password
• Role-based access controls — administrators can only see data for the clubs and federations they belong to
• Server-side input validation and protection against common web attacks (SQL injection, XSS, CSRF)
• Regular software updates and security reviews

No method of transmission over the Internet is 100% secure. If we ever experience a breach affecting your personal data, we will notify you and the Danish Data Protection Authority as required by GDPR Art. 33–34.

10 Children

Sport in Denmark is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16 without verified parental or guardian consent. If a parent or guardian becomes aware that their child has provided us with personal data without consent, please contact us and we will delete it.

11 International data transfers

Our servers are hosted within the European Union. Google Analytics is the only third-party analytics service we use, and it may transfer data to the United States — but only if you accept analytics cookies. If you do not accept, nothing is transferred at all: the Google Analytics script is not loaded, so there is no transfer to consider. If you do accept, cookies are set, measurement runs, and the one-time tokens in personal links are removed from the page address before it is sent. Such transfers are protected by appropriate safeguards, including the EU–U.S. Data Privacy Framework (where the provider is certified) and/or the European Commission's Standard Contractual Clauses (SCCs), with supplementary technical and organisational measures where applicable.

12 Changes to this policy

We may update this policy from time to time to reflect changes in the platform or in the law. The "Last updated" date at the top will always show the current version. For material changes that affect your rights, we will notify registered users by email.

13 Contact us

If you have any questions about this policy or about how we handle your personal data, please contact us:

• Email: hello@sportindenmark.dk
• Website: sportindenmark.dk

To have specific content removed, contact us through the contact form and tell us what you would like removed. We will confirm once it is done. To remove your whole account, use "Delete my account" under Account → Email & privacy on your dashboard — see Data retention.