Privacy Policy
Datenschutzerklärung · Last updated [PLACEHOLDER — date]
Before launch. This document is a working draft written to the structure the GDPR requires. Everything marked [PLACEHOLDER] is a fact only you have, and the finished text must be reviewed by a lawyer. It also has to match what the product actually does on the day it ships — a privacy policy that describes a different product is worse than none.
1. Who is responsible
The controller for the processing described here, in the sense of Art. 4(7) GDPR, is:
[PLACEHOLDER — legal entity][PLACEHOLDER — street address], [PLACEHOLDER — postal code and city], Germany
privacy@matchsquads.example
Data protection officer: [PLACEHOLDER — name and contact, or a statement that no DPO is required under Art. 37 GDPR / § 38 BDSG]
2. What we process, and on what basis
We only process what a given function needs. Where the basis is consent you can withdraw it at any time, and withdrawing is as easy as giving it was.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Server logs (IP, time, page, user agent) | Delivering the site and defending it against abuse | Art. 6(1)(f) — legitimate interest in a working, secure service | [PLACEHOLDER — e.g. 7 days] |
| Account data (name, email, password hash) | Creating and running your account | Art. 6(1)(b) — performance of a contract | While the account exists, then [PLACEHOLDER] |
| Sports, area and radius you choose | Showing matches near you in the sports you play | Art. 6(1)(b) — the core function of the service | While the account exists |
| Precise location, if you allow it | Distance to matches and venues | Art. 6(1)(a) — consent, revocable in your device settings | Not stored beyond the request [PLACEHOLDER — confirm] |
| Messages, posts and photos you send | Delivering them to the people you sent them to | Art. 6(1)(b) | Until you delete them [PLACEHOLDER — confirm] |
| Analytics on this website | Understanding which parts of the page fail | Art. 6(1)(a) — consent, and only after you press Accept | [PLACEHOLDER] |
3. This website specifically
The page you are reading loads two font files from Google Fonts, which means your IP address reaches Google's servers. [PLACEHOLDER — decision] If self-hosting the fonts is preferred, that removes the transfer entirely and is the recommended route for a German entity; the alternative is naming Google here as a recipient and describing the transfer under section 5.
Nothing that measures your behaviour runs before you have answered the consent banner. Your answer, and the language you picked, are stored in your browser's local storage — they are never sent to us. See the Cookie Policy for the exact list.
4. Who else sees the data
We use service providers who process data on our instructions under Art. 28 GDPR contracts. Today those are:
- Hosting: [PLACEHOLDER — provider, location]
- App distribution: Apple App Store, Google Play
- Analytics: [PLACEHOLDER — provider, or "none"]
- Email: [PLACEHOLDER — provider]
We do not sell personal data, and we do not share it for advertising.
5. Transfers outside the EEA
[PLACEHOLDER] Where a provider processes data outside the European Economic Area, the transfer is covered by an adequacy decision or by the EU Standard Contractual Clauses. List each such provider and the safeguard that applies before launch.
6. Your rights
Under the GDPR you can, at any time and free of charge:
- ask what we hold about you and get a copy (Art. 15);
- have wrong data corrected (Art. 16);
- have data deleted (Art. 17);
- have processing restricted (Art. 18);
- take your data elsewhere in a machine-readable form (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent you gave, without affecting what happened before (Art. 7(3)).
Write to privacy@matchsquads.example. You also have the right to complain to a supervisory authority — usually the one where you live. Ours is [PLACEHOLDER — competent Landesdatenschutzbehörde].
7. Children
[PLACEHOLDER — minimum age] The service is not directed at children under the age set here. Where consent is the basis and the person is under 16, Art. 8 GDPR requires the holder of parental responsibility to consent — note that Member States may set this as low as 13, so the age has to be decided per market.
8. Changes
When this policy changes we update the date at the top, and for material changes we tell you in the app before the change takes effect.