1. Controller
The controller for processing personal data on this website is the organisation named in the imprint. The placeholders shown there must be replaced before launch.
2. Website access and hosting
When this website is accessed, technically necessary connection data is processed. This may include IP address, date and time, requested URL, referrer, browser and operating-system information, and status and size data. Processing is necessary to provide the website securely and reliably.
Hosting provider: [insert provider]
Location or server region: [insert details]
Server-log retention: [insert period]
The legal basis and retention period must be completed after reviewing the actual hosting agreement.
3. Public league website and Supabase
Public league data is loaded server-side from a Supabase database. Public views contain only the data intended for the website, including team data, fixtures and, for players, first name and city of origin. Internal profile data such as last name, position, skill level and player image is not loaded into public views.
Service: Supabase, Inc. or [insert contractual entity]
Project/server region: [insert details]
Data-processing agreement and other recipients: [insert details and links]
4. Registration, login and player portal
For public registration or registration through a personal invitation and for the player portal, the application may process email address, first name, last name, city of origin, position, skill level and league- and team-related data. Public registrations are reviewed by the league organisation. Authentication is provided by Supabase Auth; the application never stores passwords in plain text.
Processing supports league participation, account administration and protected portal and matchday functions. The exact legal basis, retention period and deletion concept must be completed for the actual participation model.
5. Mailing list
If a person voluntarily provides an email address for the mailing list, it is stored to send information about Pickupleague. The legal basis is generally consent, which can be withdrawn at any time using the contact address in the imprint.
Retention and unsubscribe/deletion process: [insert details]
6. League preference and language preference
The selected league is stored locally in the browser under preferred_league. The selected language is stored for one year in the technically necessary NEXT_LOCALE cookie (path /, SameSite=Lax; Secure in production). Neither preference contains profile data; both only preserve the chosen view and can be deleted through browser settings.
7. Cookies and analytics
Technically necessary session cookies are used when a person logs in and accesses protected areas. A technically necessary acknowledgement cookie is used for twelve months. No advertising, analytics or social-tracking services are currently integrated. This policy must be updated before adding other services or external content.
8. Recipients and third-country transfers
Recipients may include the hosting provider, Supabase and technical providers for authentication and email delivery. The exact recipients, storage locations, contractual bases and safeguards for any third-country transfers must be completed before launch.
9. Data-subject rights
Subject to statutory requirements, data subjects have rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Requests can be sent to [insert privacy contact]. A complaint may also be lodged with a supervisory authority.
10. Updates
This policy is updated when processing activities or services change. The version published on this page is authoritative.