Privacy Policy

Controller

The controller for data processing on this website within the meaning of the GDPR is:

Nürnberg Renegades e.V.
Bartholomäusstr. 26c
90489 Nürnberg, Germany
Represented by: Andreas Scherm (Chairman)
Registered in the Nürnberg register of associations, VR 202816

Email for data protection matters: it@nuernberg-renegades.de
General contact: info@nuernberg-renegades.de

We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR, § 38 BDSG) do not apply to us.

What we process — an overview

This website is deliberately built to collect as little as possible. It uses no advertising or tracking technology, embeds no analytics service and builds no usage profiles. Fonts are served from our own server, so simply opening a page creates no connection to Google.

Personal data arises in essentially four places:

• when you open the website (server log data, in particular your IP address),
• when you open the results pages, because your browser fetches the match data from our database at Supabase in Frankfurt am Main,
• when you submit one of our forms (contact, trial training, membership application),
• when you consent to the Google Maps embeds on the training page.

Categories of data subjects

• Visitors to this website
• People who contact us through a form
• People who apply for membership

Legal bases

We process personal data on the following legal bases. Which one applies in a given case is stated with the relevant processing activity.

• Art. 6(1)(a) GDPR — consent: for Google Maps and for storing your language and theme preferences. § 25(1) TDDDG additionally applies to storing and reading information on your device.
• Art. 6(1)(b) GDPR — contract and pre-contractual steps: for handling membership applications and trial training enquiries.
• Art. 6(1)(f) GDPR — legitimate interests: for the technically secure operation of the website, defence against spam and automated attacks, and answering general enquiries.
• § 25(2) no. 2 TDDDG: for strictly necessary storage, such as saving your cookie decision.

Hosting and server logs

This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

When you open a page, your browser transmits technically necessary data that is processed in server log files: IP address, date and time of access, the address requested, the referrer, and browser and operating system identifiers. Without your IP address we could not deliver the page to you.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website reliably and securely. We do not evaluate these logs ourselves and do not combine them with other data.

As Netlify is a US company, data may be transferred to the USA. Such transfers are safeguarded by the European Commission's standard contractual clauses or — where the provider is certified — by the EU-U.S. Data Privacy Framework.

Fonts

We use the typefaces “Manrope” and “Sora”. Both are served exclusively from our own server. No connection to Google Fonts or any other third party is made, and your IP address is not transmitted to anyone for this purpose.

Cookies and local storage

We use no advertising or tracking cookies. Only the following is stored, in each case locally in your browser (localStorage and a cookie of the same name):

These entries do not expire automatically. You can delete them at any time through your browser settings; the website will continue to work, it simply will not remember your choices.

Your consent

On your first visit we ask whether you consent to anything beyond the technically necessary functions. Nothing is pre-selected: without your active consent, no preferences are stored and no maps are loaded. You can change or withdraw your consent at the top of this page at any time, with effect for the future.

Results, tables and the live ticker

The results pages show fixtures, results and league tables for both our teams. That data sits in our own database at Supabase, in their Frankfurt am Main data centre. When you open a results page your browser fetches it from there, which — as with any page request — transmits your IP address. The live ticker additionally holds an open connection to that database for as long as you keep the page open, so the score updates without a reload.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in showing our teams' results up to date. No cookies are set and no usage behaviour is analysed.

The match data itself comes from LeagueSphere, our association's match platform. Only a server-side service of ours fetches it, at regular intervals. Your browser never contacts LeagueSphere and no data about you is transmitted there.

Until September 2026 this section embedded a display from an external provider (GitHub Pages, USA). We have removed that embed; opening the results pages no longer contacts any third party.

Our forms

All three forms work the same way: your input is passed to a server function at Supabase, which composes an email and sends it to our club mailbox via the provider Resend. Nothing is stored in a database — afterwards the data exists only as an email in our mailbox.

Contact form

We process your name, email address, subject and message. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry); if your enquiry is aimed at a contract, it is Art. 6(1)(b) GDPR.

Trial training enquiry

We process your name and email address and — if you provide them — phone number, age, previous experience and your message. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps).

Membership application

To admit you to the association we need the type of membership, your first and last name, date of birth, place of birth, address, email address and preferred joining date. Nationality and phone, mobile and fax numbers are optional.

If you wish to grant us a SEPA direct debit mandate, we additionally process the account holder, IBAN, BIC and bank name. These details are optional; membership is possible without them, but the fee must then be paid another way. We use payment details solely to collect the membership fee.

For children and teenagers under 16, a parent applies and signs as their legal guardian. We then process the details about the child listed above, together with the email address, phone number and account details the parent gives for themselves — solely for the child's membership.

From your entries we automatically generate a completed PDF of the application form, which is attached to the notification email. The legal basis is Art. 6(1)(b) GDPR (establishing and performing the membership relationship).

How long we keep the data

We delete contact and trial training enquiries once they have been dealt with and no follow-up questions are expected. Membership application data is kept for the duration of the membership. Statutory retention periods remain unaffected — in particular the six and ten year periods under § 257 HGB and § 147 AO; for that period processing is restricted rather than the data deleted.

Google reCAPTCHA

To protect our forms against automated submissions we use reCAPTCHA v3 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is not loaded on every page, only on pages containing a form — and there only once you actually click into or fill in the form. If you merely read such a page, no connection to Google is made. For its assessment, reCAPTCHA evaluates your IP address, time spent on the page and mouse movements, among other things, and transmits this to Google.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against spam and abuse. Data may also be transmitted to Google LLC servers in the USA, safeguarded by standard contractual clauses or the EU-U.S. Data Privacy Framework.

For details see Google's privacy policy and its terms of service.

Google Maps

On the training page we show the location of our training grounds using maps from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The maps are only loaded after you have given explicit consent. Without consent you see only a notice in their place and no connection to Google is made. Once a map loads, your IP address and details about your browser are transmitted to Google, possibly also to the USA.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at the top of this page at any time.

Recipients and processors

We do not pass your data on for advertising purposes and we do not sell it. Only the following service providers, acting on our behalf, have access:

We have data processing agreements under Art. 28 GDPR with these providers. Where data reaches the USA, we base the transfer on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR or on the EU-U.S. Data Privacy Framework. We point out that the USA does not offer a level of data protection equivalent to European law and that access by authorities there cannot be entirely ruled out.

Social media

We link to our Instagram profile in the footer. This is an ordinary link, not an embedded plugin: no Instagram content is loaded and no data is transmitted to Meta when you merely open our page. Only when you click the link do you reach Instagram, where Meta's privacy terms then apply.

Security

The website is served exclusively over encrypted HTTPS. Beyond that we take appropriate technical and organisational measures under Art. 32 GDPR to protect your data against loss, alteration and unauthorised access. Access to our club mailbox is limited to the responsible board members.

Your rights

You have the following rights against us. An informal message to it@nuernberg-renegades.de is enough.

• Access (Art. 15 GDPR): you can find out whether and which data we process about you, and receive a copy.
• Rectification (Art. 16 GDPR): you can have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can request deletion of your data where we no longer need it and no retention obligation applies.
• Restriction (Art. 18 GDPR): you can require that we only store your data for the time being and no longer use it.
• Data portability (Art. 20 GDPR): you can receive the data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
• Objection (Art. 21 GDPR): on grounds relating to your particular situation you may object at any time to processing we base on a legitimate interest.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out beforehand.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority at any time. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the authority where you live or work.

Changes to this policy

We update this privacy policy when the processing described here changes. The version published here is the one that applies; the date above shows its current status.