Privacy policy

This policy explains how Clubroom processes personal data about the people we are the controller for: club administrators, people on our waiting list and visitors to the Clubroom site. Data about clubs' members we process on the club's behalf, see Members of a club.

Controller

Clubroom is run by a private individual in Denmark and does not yet have a CVR (company) number.

• Controller: Mike Hagen Eggertsen
• Address: Peder Hjorts Vej 7, 2500 Valby
• Privacy contact: hello@getclubroom.com

We have not appointed a data protection officer (DPO). One is only required for public authorities and for those whose core activities are regular and systematic monitoring of people on a large scale or processing of sensitive data on a large scale (Article 37). That does not apply to Clubroom.

Club administrators

When you create an account or are invited to help run a club, we process:

• Account details: name, email address, profile picture if any, and your preferred language.
• Sign-in: nothing beyond your email address when you sign in with an emailed link, which expires after 15 minutes; if you sign in with Google, your name, email address, profile picture and the tokens Google sends us.
• Sessions: IP address and browser details (user agent) for each active session. A session expires after 30 days.
• Roles and invitations: which clubs you help with and in what role (owner, admin, committee), and invitations sent to your email address.
• Acceptance of terms: which version of the terms of service and the data processing agreement you accepted on the club's behalf, and when.
• Activity: your actions in a club are recorded in the club's activity log with your name.

Purpose and legal basis: to provide the service to you and your club (Article 6(1)(b), performance of a contract) and to keep the service secure (Article 6(1)(f), legitimate interest).

Feedback and error reports

When you send feedback, a comment or a vote in the app, we store the text with your name and technical details that help us find the problem: the page you were on, club, role, app version, screen size, language, time zone, browser and any error messages. The legal basis is our legitimate interest in improving and fixing the service (Article 6(1)(f)).

Waiting list

If you join the waiting list on our home page, we send your email address, any referral code and where you came from (utm_source) to Enlist, a waiting-list service that is also run by Mike Hagen Eggertsen. We do not store these details ourselves. We use them to write to you when there is room in the pilot. The legal basis is your consent (Article 6(1)(a)), and you can ask to be removed at any time. Enlist runs its server functions in the USA (Washington, D.C.) on Vercel, under Vercel's data processing addendum and the EU-U.S. Data Privacy Framework. Enlist's providers are listed at enlist.dev/legal/subprocessors.

Site visitors

The Clubroom site sets no cookies and uses no tracking or advertising. If you choose a light or dark theme, the choice is stored only in your own browser (localStorage). Our hosting provider records technical details such as IP addresses in its operational logs to deliver and protect the site. The logs are kept for no more than 1 day.

When you sign in to the app, we set a necessary session cookie on the app domain. It is used only to keep you signed in and does not require consent, as it is necessary to provide the service you ask for.

Members of a club

If you are a member of a club that uses Clubroom, the club is the controller for your data. Clubroom is its processor and processes the data only on the club's instructions, as set out in our data processing agreement.

This means, among other things:

• The club decides what data is collected and how long it is kept.
• Questions about your data, and requests to access, correct or erase it, go to the club. You can also use the links in emails from the club to see, correct or ask to erase your details.
• If you pay online, you do so on the payment page of the payment provider the club has chosen, and the money goes straight to the club. Clubroom never sees or stores your card details.

If you contact us about data a club is responsible for, we pass your request on to the club.

Who we share data with

We never sell personal data. We use providers (sub-processors) for hosting, database, file storage, email and error reports. If you sign in with Google, Google processes the details of your sign-in under its own terms. The current list, with location and transfer basis, is on the Sub-processors page.

Transfers outside the EU/EEA

Some of our providers are American or have American parent companies. Where data may be transferred outside the EU/EEA, this is based on the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. The basis for each provider is on the Sub-processors page.

How long we keep data

• Account: as long as you have an account. When you delete it or ask us to, we delete the account within 30 days. Until the app has a feature for this, write to us at the address below.
• Sessions: expire after 30 days.
• Activity log and acceptance of terms: as long as the club uses Clubroom, as they record who did what.
• Feedback: until it is resolved, and for no more than 12 months after that.
• Waiting list: until the pilot opens for you, or you ask to be removed.
• Backups: deleted data may remain in backups for up to 7 days, until they expire.
• Operational logs at our hosting provider: no more than 1 day.

Your rights

You have the right to access the data we hold about you and to have it corrected or erased. You may also have the right to restrict processing, to object to it and to receive your data in a common format (data portability). Where you have given consent, you can always withdraw it.

Write to us at hello@getclubroom.com. We reply within one month.

Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would like the chance to solve the problem first.

Changes

If we change this policy, we update the version date at the top. We announce significant changes in the app or by email.