What we keep, and what we don't.

Who is responsible

ABC Sport BSO is responsible for the data that comes in through this site. We are a small company in Assen; behind the email address below sits a person who reads your message themselves. We do not have a data protection officer: we are too small for that, and it is not mandatory for us.

Controller

ABC Sport BSO Assen B.V., sports after-school care in Assen

Email

info@abcsportbso.nl

Postal address

HVA Hockey Assen · Mien Ruysweg 3, 9408 KA Assen

Chamber of Commerce number

42118508

National Childcare Register (LRK)

to follow: this number will appear here once the location is registered

What this statement covers

This website, the two forms on it and the visitor count, and nothing else. ABC Sport BSO is not open yet: no group is running and no child is enrolled. Once that changes, a second and more detailed privacy statement will follow for the care itself: about child records, photos, consent, the movement and heart-rate data from the Core Band, and the retention periods the Dutch Childcare Act prescribes. That statement does not exist yet, and we are not going to pretend otherwise.

What we receive from you

Only what you enter yourself. Two fields are required, your name and your email address; the rest you can leave blank, and that has no effect on your place on the list. On top of that, our server sees a few technical details that come with any website visit.

• Required: your name and your email address.
• Optional: phone number, town, your child's name, year of birth, preferred package, preferred days and a free-text comment field.
• Automatic: your IP address, the time of submission and ordinary browser details. We use those only to keep the form from being abused; we do not store your IP address in readable form.
• With every page visit, for the visitor count: the time, which page you view (just the address, without anything after it), the site you came from as your browser passes it on, your type of device, operating system and browser, and roughly where you are (country, region and town, derived from your IP address). Your IP address itself is not stored for this; more on that under 'Cookies and what ends up in your browser'.

What we use them for

To let you know when we open and when enrolment starts. To get in touch if you asked a question, or if we want to check something about your preferred days or package. And to see which towns the interest comes from: that helps decide where we explore a next location. We also want to know how many people visit the site, which pages they read and how they find us, so we can see what works. Nothing beyond that: no newsletter on other subjects, no advertising, and we never sell or rent out your details.

On what legal basis

For the sign-up itself it is your consent (Article 6(1)(a) GDPR). You give it with the checkbox below the form; without it you cannot submit. You may withdraw that consent at any moment, no reason needed (see the section on unsubscribing). What happened before you withdrew it remains lawful; from the moment you withdraw, we stop. For the technical measures that protect the form (the limit on submissions per IP address and the bot check) we rely on our legitimate interest (Article 6(1)(f) GDPR). A form without a brake is found by bots within a day. The visitor count rests on the same legitimate interest: knowing whether the site is found and read, in a way that does not follow you and does not show us who you are.

Details about your child

You don't have to enter anything about your child. If you do, it stays with a first name and a year of birth, so we know which age group they will fit into. Please don't use the comment field for details about health, care needs, faith or background: this form is not built for that, and we deliberately don't ask for it. If you want to discuss something like that, email us or save it for the introductory visit; we'll record it later in a place that is set up for it.

Who else sees your details

We use a handful of providers, each handling one part of the process. They get what they need, and no more than that.

• Resend, our mail sender: it turns your sign-up or request into an email to our mailbox, and sends you a confirmation that we have received it. In doing so Resend sees everything you entered, including your child's first name and year of birth if you provided them.
• The provider of our mailbox: where the sign-up arrives and stays until we delete it.
• Vercel: hosts the website, runs the form function and provides the visitor count (Vercel Web Analytics). It sees technical details such as your IP address and keeps them briefly in its own logs. Your IP address is not stored for the visitor count.
• Upstash: the datastore where we keep three things: the total number of sign-ups (a number only), an unreadable code derived from your email address so you don't end up on the list twice, and an unreadable code derived from your IP address for the submission limit. Your email address and IP address are not stored there in readable form.
• Cloudflare: runs the bot check under the forms (Turnstile). It loads as soon as you open a page with a form, such as the homepage, and receives your IP address and details about your browser for that purpose.

Honestly, about where we stand: we have no separately negotiated data processing agreement with these parties. We rely on the standard processor terms they supply with their service. Before we open and start handling real enrolments, we will go through this, put in writing what needs to be in writing, and update this statement.

Processing outside the EU

Some of these providers are American or use servers outside the European Union, so your data may be processed outside the EU. We rely on the safeguards those providers offer themselves (standard contractual clauses or the EU-US Data Privacy Framework) and we have not negotiated these separately per provider. Would you rather avoid that? Send us a plain email at info@abcsportbso.nl instead of using the form. Your message then goes straight to our mailbox, without the intermediate steps above.

Cookies and what ends up in your browser

This site uses no tracking or advertising cookies. We do count visits, with Vercel Web Analytics from our host. That works without cookies and without storing anything in your browser: Vercel recognises a visit by a code it derives from the request and discards after 24 hours, so you cannot be followed across days or to other websites. We only see totals: no names, no IP addresses, no profiles. The fonts are served from our own server. That is also why there is no cookie banner. What does end up in your browser:

• Your language choice (Dutch or English), stored locally so the site remembers it.
• If the bot check kicks in, Cloudflare briefly stores a value of its own for it.

Both are needed to make the site work. Neither of them follows you to other websites.

How we protect it

The site runs entirely over https. The email address that sign-ups are sent to lives on the server only, not in the code your browser downloads. The form has a hidden field that gives bots away, a limit on submissions per IP address per hour and per day, and a check by Cloudflare. Email addresses and IP addresses used for those limits are stored in unreadable (hashed) form only. What we cannot promise: that email is encrypted in transit: that depends on your mail provider and ours.

How long we keep it

As briefly as is useful. Specifically:

• Your sign-up in our mailbox: at most twelve months after the opening of the location you signed up for, or sooner if you ask.
• If a location does not go ahead, we delete that list as soon as this is certain, after letting you know.
• The unreadable code derived from your email address, for the duplicate check: seven days, after which it disappears by itself.
• The unreadable code derived from your IP address, for the submission limit: one hour for the hourly limit, one day for the daily limit. Those expire on their own too.
• The counter showing the number of sign-ups: that is a single number without names, and it stays.
• The visitor count: Vercel keeps one record per page visit with the details above, without your IP address; we only see totals. We can look back one month; Vercel may keep the data longer under its own policy.
• Technical logs at Vercel: we do not keep those ourselves; Vercel keeps them briefly under its own policy.

Unsubscribing or having your data deleted

Send an email to info@abcsportbso.nl with the address you signed up with and the word 'delete'. You don't have to explain why. We take you off the list and confirm it. We do that within four weeks, and in practice usually within a few days. That also withdraws your consent: you won't hear from us again unless you sign up anew later on.

Your rights under the GDPR

They apply just as much to a short list of fields. You can ask us for:

• Access: what data do you hold about me?
• Rectification: correcting something that is wrong.
• Erasure: having your data deleted.
• Restriction: putting the use on hold for a while.
• Objection: objecting to the use of your data.
• Portability: receiving your data in a common file format.
• Withdrawal of consent: at any moment, without giving a reason.

Email info@abcsportbso.nl. To avoid handing data to the wrong person, we may ask a verifying question, roughly when you signed up, for instance. We will never ask for a copy of your ID.

Filing a complaint

If you feel we are not handling your data properly, tell us first at info@abcsportbso.nl. We take it seriously and you will get an answer. If we can't resolve it together, you can file a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority: autoriteitpersoonsgegevens.nl, or by post at Postbus 93374, 2509 AJ The Hague, the Netherlands. That right is always yours: you don't have to come to us first.

Changes to this statement

ABC Sport BSO is still being built, and a few things will change over the coming months: we open, we start enrolling, and a separate statement will follow for the care itself. If we amend this text, we put the new date at the top. If a change affects your sign-up, we'll let you know by email.