PRIVACY POLICY

Last updated: 2026-03-16

This Privacy Policy ("Policy") describes how Skillplay AB, Company Registration Number: 559569-1840, Address: Larsbergsvägen 24, 18139 Lidingö, Sweden, Email: info@skillsethandball.com ("Company", "we", "us") collects, uses, stores, and protects personal data in connection with the digital training platform Skillset Handball ("Service").

The Company is the data controller for the processing of personal data described in this Policy.

1. WHAT PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

Account information:

  • first name and last name

  • email address

  • password (encrypted)

  • language preference.

Payment information:

  • card type and last four digits of card number (stored by Stripe, not by us)

  • billing country

  • payment history and invoices.

Usage data:

  • training progress and completed exercises

  • login history and session information

  • device information and browser type.

Subscription data:

  • subscription status (trial, active, cancelled, expired)

  • start and end dates for subscription and trial period

  • selected age groups and player information.

2. HOW WE COLLECT PERSONAL DATA

We collect personal data in the following ways:

  • Directly from you — during account registration, payment, and use of the Service

  • Automatically — via cookies, session information, and server logs when using the Service

  • From third-party providers — payment information from Stripe (e.g., card country, payment status).

3. LEGAL BASIS FOR PROCESSING

We process personal data based on the following legal grounds under the GDPR:

  • Performance of a contract (Article 6.1.b) — to provide the Service, manage your account, process payments, and deliver training content

  • Legitimate interest (Article 6.1.f) — to improve the Service, prevent misuse, analyze usage patterns, and ensure platform security

  • Legal obligation (Article 6.1.c) — to comply with accounting and tax legislation

  • Consent (Article 6.1.a) — for optional email notifications (new content, news). Consent may be withdrawn at any time via the Service's settings.

4. HOW WE USE PERSONAL DATA

We use personal data for the following purposes:

  • provide and operate the Service

  • create and manage your account

  • process payments and manage subscriptions

  • send transactional messages (welcome emails, payment confirmations, subscription changes)

  • track training progress

  • provide customer support

  • prevent misuse and protect platform security

  • fulfill legal obligations.

5. THIRD-PARTY SERVICE PROVIDERS (DATA PROCESSORS)

We share personal data with the following third-party service providers that process data on our behalf:

Provider Purpose Data shared Location
Stripe Payment processing Name, email, card details, billing country USA/EU (Privacy Shield/SCC)
SendGrid (Twilio) Email delivery Name, email address USA (SCC)
Vimeo Video hosting No direct sharing of personal data; videos streamed via embedded player USA
Google Cloud Platform Hosting and storage All data (stored encrypted) EU (Stockholm, europe-north1)

All third-party providers are bound by agreements (data processing agreements) or Standard Contractual Clauses (SCC) to ensure an adequate level of protection.

6. DATA STORAGE AND RETENTION PERIODS

We store personal data as follows:

  • Active accounts — data is stored for as long as the account is active

  • After subscription expiry — account data is retained for 90 days after the subscription's last day, to allow easy re-subscription

  • Warning notification — 7 days before deletion (day 83), an email is sent informing about the upcoming deletion

  • Deletion — after the 90-day period, the account and all associated personal data are permanently deleted by an administrator

  • Accounting records — payment and invoice information may be retained in accordance with the Swedish Bookkeeping Act (7 years).

7. YOUR RIGHTS

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — you may request a copy of the personal data we hold about you

  • Right to rectification — you may request that inaccurate data be corrected

  • Right to erasure ("right to be forgotten") — you may request that your data be deleted, provided there are no legal obligations requiring us to retain it

  • Right to restriction of processing — you may request that we restrict the processing of your data

  • Right to data portability — you may request that your data be exported in a machine-readable format (JSON)

  • Right to object — you may object to processing based on legitimate interest

  • Right to withdraw consent — if processing is based on consent, you may withdraw it at any time via the Service's settings.

To exercise your rights, contact us at info@skillsethandball.com.

8. COOKIES AND SIMILAR TECHNOLOGIES

The Service uses cookies for the following purposes:

  • Essential cookies — session cookies for login and CSRF protection. These are necessary for the Service to function and do not require consent.

  • Functional cookies — store language preference and theme selection.

The Service does not use third-party cookies for marketing or tracking.

9. SECURITY

We take appropriate technical and organizational measures to protect personal data, including:

  • encryption of data in transit (HTTPS/TLS)

  • encrypted storage of passwords

  • access control and role-based permissions

  • regular security reviews

  • automated database backups.

10. TRANSFERS TO THIRD COUNTRIES

Some of our third-party providers (Stripe, SendGrid) may process data in the USA. Such transfers are made on the basis of:

  • the European Commission's Standard Contractual Clauses (SCC)

  • the providers' data protection agreements.

All primary data storage takes place within the EU (Google Cloud, Stockholm).

11. CHILDREN'S PERSONAL DATA

The Service is not directed at children under 18 years of age. We do not knowingly collect personal data from children under 18 without the consent of a parent or legal guardian. If we discover that personal data has been collected from a child without appropriate consent, we will delete the data.

12. COMPLAINTS

If you believe that we process your personal data in violation of the GDPR, you have the right to file a complaint with the Swedish supervisory authority:

Swedish Authority for Privacy Protection (IMY) Box 8114 104 20 Stockholm, Sweden imy.se

13. CHANGES TO THIS POLICY

The Company reserves the right to update this Policy at any time. The updated Policy will be published on the website. In the event of material changes, we may notify you by email.

14. CONTACT INFORMATION

For questions about this Privacy Policy or the processing of personal data, contact us:

Skillplay AB Email: info@skillsethandball.com Address: Larsbergsvägen 24, 18139 Lidingö, Sweden