Privacy Policy

1. Controller

• Name: [ADATKEZELŐ NEVE]
• Registered address: [CÍM]
• Tax number: [ADÓSZÁM]
• Company registration number: [CÉGJEGYZÉKSZÁM]
• Data protection contact: adatvedelem@handballbridge.com
• Data protection officer: [ADATVÉDELMI TISZTVISELŐ, HA KIJELÖLÉSRE KERÜL]

2. About the platform

Handball Bridge is a professional platform for handball clubs, player agents and adult (18+) professional players. Anyone aged 18 or over can register, but the operator's staff verify every user account and every organisation (club, agency) by hand: they check the user's declaration against public sources (for example the public data of the club, the federation or the company register) and only ask for a document if these are not enough to decide. Until that verification is done, what a user creates — such as a player profile or a club search — is not visible to the rest of the network.

Player data is disclosed progressively, level by level: clubs first see a summary that does not identify the player, and learn the player's identity and confidential data only with the explicit permission of the player (or their mandated agent). The operator is not a player agency: it does not represent players, does not broker deals for a fee, and is not a party to contracts between users.

3. Data we process, purposes and legal bases

• Account and identity data (name, email address, password — stored only as an irreversible hash —, role, organisation membership, language and notification settings, two-factor authentication data, verification status, a generated avatar if you create one) — to create your account, grant access and verify the account. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Terms acceptance and age declaration (the version of the Terms accepted and the time of acceptance — at registration and when accepting an amended version of the Terms —, and the time of the declaration that the user is at least 18; stored with the profile) — to prove on which version of the Terms and when the contract was concluded, and that the user made the age declaration. Legal basis: legitimate interest (Art. 6(1)(f)) in proving the conclusion and terms of the contract, in establishing, exercising or defending legal claims, and in demonstrating that the platform contracts only with adults.
• Verification declaration (the time of the declaration and the version of its wording, stored with the profile; in the audit log also the role, the organisation named in the declaration and the version and time of an earlier declaration) — for verification, the user declares that the information provided is true and that they register in their own name or are entitled to act for their club or agency; the moderator checks this declaration against public sources. Legal basis: legitimate interest (Art. 6(1)(f)) in preventing registrations in someone else's name and other abuse, and in proving who took responsibility for the accuracy of the data and when.
• Document requests for verification (the time and the short reason of the moderator's request while it is open, and the notification about it; in the audit log the fact of the request, the requesting moderator and the reason) — if verification cannot be decided based on the declaration and public sources, the moderator may ask for a supporting document. Uploading a document is otherwise not required; users may upload one voluntarily to speed up verification. Legal basis: legitimate interest (Art. 6(1)(f)) in preventing abuse.
• Your own player profile (name, year of birth, nationality, position and defensive position, handedness, height, weight, current club and league, contract expiry, career, languages, national-team status, video and statistics links) — to match players and clubs and to show the profile according to the disclosure levels. Legal basis: performance of a contract.
• Confidential player data (availability and its date, salary expectation, preferred and excluded countries, minimum league level, desired team role, buy-out situation, hiding from the current club and other exclusion settings) — to refine matching; a club can only learn them at the disclosure level the player allows. Legal basis: performance of a contract.
• Data of players without an account, entered by an agent — see section 4.
• Representation data (the agent and agency, the mandate's validity, exclusivity and territory, the uploaded document proving the mandate — for example the HC-JATE-01 declaration signed by the player or a mandate letter —, the decisions of the player and the moderator) — to establish that the agent is entitled to represent the player. Legal basis: performance of a contract; for reviewing the documents, legitimate interest (Art. 6(1)(f)) in preventing unauthorised representation and abuse.
• Club and agency data (the organisation's name, country and website; for clubs the city, league, sporting level and budget notes; for agencies the countries of operation and — if provided — the licence number; the official contact persons a club provides, with name, role, email address and phone number; documents uploaded for verification — on request or voluntarily —, such as a mandate letter, a company register extract or a federation certificate) — to verify organisations and operate the platform. Verified clubs can search for agents and agencies by name in order to invite them to a search shared with selected agents; this findability can be switched off at any time in Settings. Contact persons' data is provided by the club. Legal basis: performance of a contract; for verification and for contact persons' data, legitimate interest (preventing abuse and keeping in touch with the club).
• Club searches and matching (search criteria — position, age range, height, handedness, salary budget, contract length, work-permit or passport requirement, preferred nationality —, match scores, clubs' saved player lists and their internal notes on them) — to find players who fit a search. Legal basis: performance of a contract. See the paragraph below on how matching works.
• Transfer workflow data (interests and replies, approvals of the mutual identity reveal, negotiation messages, offers, documents and deadlines, in-app and email notifications) — to run communication between the parties. Legal basis: performance of a contract.
• Missing club or league reports (type of report, club or league name, country, free-text note, the moderator's decision and reply, timestamps) — to keep the club and league catalogue accurate. Only the reporting user and the operator's moderators can see a report; the reporting user is notified of the outcome. Legal basis: performance of a contract.
• Contact and access requests on the website (the name, email address, role, organisation and message entered in the contact form — organisation and message are optional —, the website language; the country if the operator records it, internal notes, a log of contacts and the recorded legal basis for contacting) — to answer the enquiry and, where it concerns access to the platform, to assess it. Legal basis: for enquiries about using the platform, steps taken at the data subject's request prior to entering into a contract (Art. 6(1)(b)); for answering other enquiries and for further contact, legitimate interest (Art. 6(1)(f)) in answering people who contact us.
• Access and security logs (who viewed or downloaded which player profile or document and when; exports; matching and interest events; issuing the watermark on confidential pages; rate-limiting events; an audit log of significant decisions; sign-in events; IP address and browser data in server and authentication logs) — for security, detecting and investigating abuse, and so players can see who accessed their data. Legal basis: legitimate interest.
• Moderation data (reports, verification events and decisions, document requests, suspensions, moderator notes) — to enforce the platform rules. Legal basis: legitimate interest.

We do not ask for special-category data (e.g. health data). Please do not enter any in free-text fields or messages. An email address and a password are required to register. A player profile requires a name and a year of birth (the year of birth is needed to check the minimum age); most other profile data is optional, but without it matching may be less accurate.

How matching works: the platform automatically compares the criteria of club searches with the player profiles in the verified network and ranks them by score. The score is based on position, handedness, age, height, league level, defensive and team role, financial fit, availability and geographic preferences, and — where the club sets one — a preferred nationality; the player's exclusion settings rule a match out. This is profiling, but not solely automated decision-making within the meaning of GDPR Art. 22: people — the club, the player or the agent — decide on any contact and every further step based on the ranking.

4. Players entered by an agent (data not obtained from you)

A player agent can also create the profile of a player who has no account on the platform. In that case we receive the data not from the player but from the agent or agency representing them (GDPR Art. 14).

• Data concerned: name, year of birth, nationality, position and defensive position, handedness, height, weight, current club and league, contract expiry, and later the career and links. Confidential data (availability, salary expectation, preferred countries) can only be entered by an agent whose mandate a moderator has approved. The platform does not store contact details of a player without an account.
• Purpose: to support the player's representation and to match the player with club searches.
• Legal basis: legitimate interest (Art. 6(1)(f)) — the interest of the player and of the agent representing them in the player appearing on the transfer market under the mandate. The precondition is the representation mandate: under the Terms, an agent may only add a player while holding a valid mandate from that player.
• Visibility: until a moderator has approved the document proving the mandate and verified the agent's account — or has verified the player profile itself —, the profile is visible only to members of the agency that created it and to the operator's moderators. After that, clubs can see it under the progressive-disclosure rules, starting in a form that does not identify the player.
• Information: under the Terms, the agent who created the profile must inform the player of it, and of where to find this policy, within one month of creating it at the latest.
• Agent declaration: when adding the player, the agent declares that they are entitled to represent the player and will inform the player of the profile. We record the declaration with the player profile, together with the declaring agent's identifier and the time of the declaration, so that it can be checked later who took responsibility for adding the player and when. Legal basis: legitimate interest (Art. 6(1)(f)) in the accountability of adding players and in preventing unauthorised profiles. Retention: together with the player profile.
• Rights: the player can exercise the rights listed in section 10 without an account — in particular access, rectification, erasure and objection — by writing to adatvedelem@handballbridge.com. Upon an objection or an erasure request we delete the profile.
• Retention: for as long as the agency that created the profile represents the player; we delete the profile once the representation ends or at the player's request.

5. Cookies and local storage

We only use cookies that are strictly necessary for the service to work, so we do not ask for consent to them:

• sb-…-auth-token: the signed-in session cookie (Supabase authentication). Removed when you sign out; otherwise kept in the browser for at most 400 days.
• sb-…-auth-token-code-verifier: a short-lived security cookie needed to redeem a confirmation or password-reset link from an email securely; removed once the link is redeemed.
• NEXT_LOCALE: stores your chosen language. Only created when you choose a language other than your browser's, and removed when you close the browser.

In your browser's local storage (localStorage) we record when you last opened each negotiation, so we can mark unread messages. This stays on your device and is not sent to us. We use no analytics or marketing cookies, no third-party trackers, no social media plug-ins and no external font service; fonts are served from our own server.

6. Processors and other providers

The following providers process data on the controller's behalf, under its instructions and under a data processing agreement:

• Supabase (Supabase Pte. Ltd., Singapore) — database, authentication (including sending sign-up confirmation and password-reset emails), file storage and scheduled jobs. Data location: within the European Union (Germany). For operations and support, the provider's sub-processors outside the EU (including the US company Supabase, Inc.) may have access (see section 8).
• Resend (Plus Five Five, Inc., United States) — delivery of the platform's emails from noreply@handballbridge.com. Emails are sent from the European Union, but the provider stores account and email data (recipient, subject, delivery metadata, logs) in the United States (see section 8).
• Hostinger (Hostinger International Ltd., Cyprus) — the virtual private server (VPS) running the application, in a data centre within the European Union.

Avatar generation: to create a profile avatar, our server calls the fal.ai service (Features & Labels, Inc., United States). The request contains only a fixed style description — no name, user identifier, your IP address, photo or any other personal data —, so fal.ai receives no personal data. The resulting image is saved to our own storage. Avatar generation is optional.

7. Who can see your data

Other platform users can only see your data in line with the disclosure levels and their role; for example, a club learns a player's identity and confidential data only with the permission of the player (or their mandated agent). The operator's moderators access data to the extent needed for verification, handling reports and fulfilling data protection requests, and can only use moderator powers with two-factor authentication. We do not sell data or share it for advertising. We disclose data to authorities only where legally required.

8. Transfers outside the European Economic Area

• Supabase: the database is within the European Union (in Germany), but the contracting party is Supabase Pte. Ltd. of Singapore, and its sub-processors include companies outside the EU (including US companies). Transfers rely on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), included in Supabase's data processing agreement.
• Resend: the provider stores email and log data in the United States. Plus Five Five, Inc. is listed as a participant in the EU–US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision (EU) 2023/1795; the provider's data processing agreement also includes Standard Contractual Clauses.
• Hostinger: the server runs in a data centre within the European Union and the provider is a Cypriot company. Where Hostinger uses a sub-processor outside the EEA, the transfer relies on the Standard Contractual Clauses in Hostinger's data processing agreement.
• fal.ai: no personal data is transferred (see section 6).

You can request a copy of the Standard Contractual Clauses at adatvedelem@handballbridge.com.

9. Retention

• Account and profile data: for as long as the account exists. After a deletion request it is anonymised within one month at the latest (see section 11).
• Profile of a player without an account, entered by an agent: for as long as the agency that created it represents the player; deleted once the representation ends or at the player's request.
• Documents uploaded for verification: for as long as the uploader's account exists; deleted when the account is deleted. Documents proving a representation mandate are kept together with the record of the representation contract and deleted when the player's account is deleted.
• Contract, transaction and audit records: kept after an account is deleted in a form that no longer identifies anyone (anonymised), for the accountability of the platform and the parties.
• Missing club or league reports: the content of a report (club or league name, country, note, the decision and the reply) is kept as part of the history of the club and league catalogue; 12 months after a report is closed we remove the reporting user from it, so it no longer identifies anyone. When a reporting user's deletion request is processed, we delete the reports that can still be traced back to them.
• In-app notifications: for as long as the account exists; deleted when a deletion request is processed.
• Terms acceptance and age declaration data, the verification declaration and the agent declaration: kept with the profile — for your own account, for as long as the account exists; for a player entered by an agent, until the player profile is deleted.
• An open document request (time and reason, stored with the profile or the organisation): until the user uploads a new document or the moderator decides on the verification; then deleted. The fact of the request stays in the audit log (see below).
• Contact and access requests from the website: 12 months from the latest of submission, last change (e.g. a decision) and last contact; after that a job that runs daily deletes them automatically, together with the contact log.
• Access logs (profile and document views, downloads, exports, matching and interest events, technical diagnostics): 12 months; after that the daily job deletes them.
• Accountability log entries (moderation and verification decisions, document requests, declarations — Terms acceptance and the verification declaration —, handling of reports, data protection requests and their processing, invitations, membership changes, negotiation stage changes, approvals of identity reveals): kept beyond 12 months because they are needed to review decisions afterwards, but without IP address or session identifier once they are 12 months old.
• Server and authentication system logs: as long as needed for secure operation, at most 12 months. The email provider (Resend) keeps delivery data and logs for 30 days.

10. Your rights

• Access (Art. 15): ask what data we hold about you.
• Rectification (Art. 16): you can correct most data yourself in your profile.
• Erasure (Art. 17): see section 11.
• Restriction of processing (Art. 18).
• Data portability (Art. 20): download your data in machine-readable (JSON) form under Settings → Privacy.
• Objection (Art. 21) to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)) at any time, where processing is based on consent, without affecting the lawfulness of prior processing.

Send requests to adatvedelem@handballbridge.com — also as a player without an account whose profile was created by an agent; we reply within one month (extendable by two further months where justified, in which case we will tell you). You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, www.naih.hu) or with the supervisory authority of the Member State where you live or work, or go to court.

11. Deleting your account

You can request deletion of your account under Settings → Privacy. A moderator of the operator processes the request within one month at the latest. Processing is done by anonymisation: we delete or redact your name, email address, avatar, the content of your own player profile and confidential player data, the text of messages you sent, your verification documents and the documents you uploaded to negotiations, your free-text entries, missing club and league reports, notifications and contact details, and disable sign-in. Contract and audit records remain in a non-identifying form. An organisation's data (club, agency) belongs to the organisation, so deleting a personal account does not affect it — nor the player profiles the agency created. The processing is recorded in the audit log.

12. Security

We use encrypted (HTTPS) connections, row-level access control in the database, progressive disclosure, least-privilege permissions, access logging and, on confidential pages, a watermark that can be traced to the viewer. Uploaded documents are kept in non-public storage. Two-factor authentication is available to every user and mandatory for the operator's moderators. In the event of a personal data breach we act in accordance with GDPR Articles 33–34.

13. Minors

The platform is intended exclusively for people aged 18 or over. Registration requires a declaration that you are at least 18 — we record the time of the declaration (see section 3) —, and agents may not add minor players either. The system rejects a player profile if, based on the year of birth, the player does not turn 18 in the current calendar year. If we learn that a minor's data has been entered on the platform, we delete it without delay.

14. Changes to this policy

We update this policy when the service or the law changes; we notify users of material changes in advance.