Privacy Policy – Coach12
Version: 1.2 – 7 August 2026
The Dutch version (privacy-policy-nl.md) is the primary; this English version is a translation provided for non-Dutch-speaking users. In case of conflict, the Dutch version prevails.
1. Who we are
Coach12 is a software service helping Dutch youth sports teams automatically and fairly distribute volunteer duties (corvee), and automate match and training management.
Data controller:
- Name: Barry Schiffer, trading as Coach12
- Chamber of Commerce (KvK) number: 42105110
- KOR-registered (VAT-exempt under the Dutch small-business scheme)
- Contact: info@coach12.nl
For privacy questions, contact us via the email above. We have not appointed a Data Protection Officer (DPO) as we are not legally required to do so at our scale.
2. What data we process and why
2.1 Account data (required to use the Service)
- Name and email address of team managers, trainers, coaches, parents/caretakers and (older) players
- Role within the team (manager, trainer, coach, parent, etc.)
- Language preference (NL/EN) per user
- Session information (cookies, login tokens) – strictly necessary for authentication
Purpose: providing the Service (account creation, magic-link login, team communication). Legal basis: performance of a contract (Article 6(1)(b) GDPR).
2.2 Player data (entered by team managers / caretakers)
- Player name
- Age category (e.g. JO13, MO11)
- Caretaker relationships: which parent/caretaker belongs to which player
- Availability for matches and trainings (entered by caretakers / players themselves)
We do not directly process contact details of underage players – communication always runs through registered caretakers with their own account. Players aged 13+ can optionally create their own account; in that case we only process their name and email with caretaker consent.
Purpose: roster planning, fair duty distribution, and match communication. Legal basis: performance of a contract.
2.3 Activity and audit data
- Duty assignments (who gets which task on which date) and history thereof
- Audit log: who changes what, when
- Authentication logs: login attempts, IP address, browser user-agent
Purpose: service delivery, fraud prevention, dispute resolution. Legal basis: performance of a contract and legitimate interest (Article 6(1)(f) GDPR).
2.4 Payment data
- Payment status per team per season (paid / unpaid)
- Amount and date of payment
We do not process credit-card or bank-account details ourselves. Payments are processed by our external payment provider Mollie. See “Sub-processors” below.
Purpose: billing and access control (locked teams). Legal basis: performance of a contract and legal obligation (accounting retention).
2.5 Marketing communications (optional, only with consent)
- Email address for opt-in newsletters and Service updates
Purpose: marketing and user communication. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time via the unsubscribe link in every email.
3. Who we share data with (sub-processors)
We use the following sub-processors. We have a Data Processing Agreement (DPA) with each of them under Article 28 GDPR.
| Sub-processor | Purpose | Processing location | Privacy |
|---|---|---|---|
| Microsoft Azure (Container Apps + PostgreSQL + Communication Services) | Hosting, database, transactional email (magic-links, duty notifications) | EU (North Europe – Ireland) | Azure Trust Center |
| Cloudflare R2 | Encrypted offsite backups of the database (PostgreSQL) | EU (Cloudflare EU zone) | Cloudflare Privacy |
| Mollie | Payment processing (iDEAL/SEPA) | EU (Netherlands) | Mollie Privacy |
| Microsoft Clarity | Cookieless website analytics (heatmaps, session recordings) on the marketing site | US / global (Microsoft) | Clarity Privacy |
We do not share data with third parties for marketing purposes. We do not sell data.
3.1 International transfers
All sub-processors that process personal data for the application are located within the European Economic Area (EEA). The cookieless website analytics on the marketing site (Microsoft Clarity) may process data outside the EEA; Microsoft relies on the EU Standard Contractual Clauses (SCCs) and is certified under the EU–US Data Privacy Framework.
4. Retention periods
| Data type | Retention period |
|---|---|
| Active account and team data | As long as the account / team is active |
| Deleted accounts | 30 days after deletion, then irreversibly erased |
| Audit logs | 12 months |
| Authentication logs | 12 months |
| Magic-link tokens | 15 minutes (60 minutes in dev mode) |
| Session cookies | Up to 90 days |
| Payment data (accounting) | 7 years (Dutch fiscal retention obligation) |
| Marketing opt-in | Until consent is withdrawn |
After the retention period expires, data is irreversibly deleted or anonymised.
5. Your rights under GDPR
Under the GDPR you have the following rights:
- Access (Article 15) – a copy of the data we process about you
- Rectification (Article 16) – correct inaccurate data
- Erasure (Article 17, “right to be forgotten”) – request deletion
- Restriction (Article 18) – pause processing during a dispute
- Data portability (Article 20) – receive your data in machine-readable form
- Object (Article 21) – object to processing on grounds of legitimate interest or marketing
- Withdraw consent – for processing based on consent
Submit requests to info@coach12.nl. We respond within 30 days (extendable by 60 days in complex cases, with reasons).
5.1 Complaint to the supervisory authority
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP):
- Website: https://autoriteitpersoonsgegevens.nl
- Address: Postbus 93374, 2509 AJ The Hague, the Netherlands
6. Security
We take reasonable technical and organisational measures to protect your data:
- Encryption in transit: all connections via HTTPS (TLS 1.2+)
- Encryption at rest: database files encrypted at rest by Azure
- Offsite backups: encrypted backups stored offsite in the EU (Cloudflare R2); the backup encryption key is held externally, separate from the storage provider, so the provider only ever stores ciphertext
- Access control: minimal access to production data, audit-logging of admin actions
- Magic-link authentication: tokens stored as SHA-256 hashes
- Session security: httpOnly + secure cookies, CSRF protection
- Secrets: stored in Azure Key Vault or equivalent
- Data breach procedure: in the event of a breach we notify the AP within 72 hours and inform affected data subjects, in accordance with Articles 33 and 34 GDPR
No service is 100% secure. We follow industry-standard practices.
7. Cookies
The application (app.coach12.nl) uses only strictly necessary cookies for authentication and session management:
| Cookie | Purpose | Retention |
|---|---|---|
session_token | Login / session | 1–90 days |
locale | Remember language preference | 1 year |
player_switcher | Which child you are currently viewing | Session |
The marketing site (coach12.nl) uses no tracking or marketing cookies. To improve the site we use privacy-friendly, cookieless analytics:
- Microsoft Clarity runs in cookieless mode: no
_clck/_clskcookies are set. Clarity assigns a temporary per-page-view ID and does not track you across sessions or websites. We use this to produce anonymised heatmaps and session recordings to find friction in the user experience.
Because this service sets no cookies and performs no cross-site tracking, we do not show a cookie banner. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in improving our website. You can object via info@coach12.nl.
8. Children under 16
We address ourselves to team managers and parents/caretakers, not children directly. We do not collect contact details of players under 16 without consent from a parent/caretaker.
Player names and age categories are entered by caretakers based on team-organisation needs. This data is not used for marketing and not shared with third parties for commercial purposes.
Players aged 13 and over can, with caretaker consent, create their own account; in that case their name and email are protected under this privacy policy and the GDPR.
9. Changes to this policy
We may update this policy from time to time. The latest version is always on this page with a date. For substantive changes, we inform users by email or via a banner in the Service at least 30 days before the change takes effect.
10. Contact
Privacy questions or want to exercise your rights?
- Email: info@coach12.nl
Last updated: 7 August 2026 Version: 1.2