Privacy Policy for goalGetr

DRAFT FOR LEGAL REVIEW. NOT IN FORCE. This text describes how goalGetr will work once the changes in “goalGetr legal fixes” (27 October 2026) have been built. Yellow highlights show points that must be confirmed before publication, numbered P1, P2 and so on, and collected at the bottom.

Last updated: [BEKREFT P1: date of approval]. Version: [BEKREFT P2: version name, e.g. privacy-2026-11-xx].

In short

goalGetr AS in Stavanger is behind the website goalgetr.co and the goalGetr app for ice hockey clubs in Norway and Sweden.
We process names, email addresses or phone numbers, birth years, teams, attendance and photos you add. We only ask for health data before a camp (allergies), with a separate consent from a parent or guardian (section 3.1).
We process the team’s data, such as rosters and attendance, on behalf of the club.
We do not sell personal data and do not use data about children for marketing. Children’s accounts get no advertising, no newsletters and no prompts to buy.
The Meta Pixel is only used on the website, only after “Accept”, and never on pages for children. The app has no pixel.
Children under 13 only get an account when a parent creates it with “Add child”.
The app calculates the rating on the player card from attendance and tasks; no coach sets it. At children’s-sport age, only the child and their parents see the back of the card. For others under 18, it is hidden by default (section 4).
A photo is only shown to others after a yes from the parent (under 13), or from both the young person and the parent (13–17, section 6).
Some suppliers, including those for email and AI, store data in the USA (sections 7 and 10).
You can ask for access, rectification, erasure and a copy. You can delete your account with “Delete account” under “Account settings”. You can complain to Datatilsynet (the Norwegian Data Protection Authority), or to IMY (the Swedish Authority for Privacy Protection) in Sweden. A parent can delete the child’s whole account (section 8).

1. Who we are and what this policy covers

The controller is goalGetr AS, organisation number 935 734 746, Kannikgata 51, 4009 Stavanger, support@goalgetr.co. [BEKREFT P3: that the business address Kannikgata 51, 4009 Stavanger should also be used as the postal address; the Brønnøysund Register Centre (Brønnøysundregistrene) has no separate postal address registered]

This policy covers the website goalgetr.co, the app at app.goalgetr.co and the phone app when it arrives. On the website, it covers the camp pages, sign-up and payment for camps, the meeting form and the order form for clubs. The club forms are received in our internal system HQ at hq.goalgetr.co. When we say “parent”, we also mean other guardians, for example a legal guardian.

The rules for using goalGetr are in the Terms of Use. There are short versions for children under 13 (to read with a parent) and for ages 13–17. [BEKREFT P4: the address of the short versions for children] At Stripe, YouTube and Vimeo, their own privacy policies also apply (section 7).

2. Who is responsible: goalGetr, the club and Meta

The one who decides why and how data is used is the controller. The one who processes data on behalf of someone else is a processor.

goalGetr is the controller for accounts, birth years, accepted terms and parent links. We are also the controller for player cards, the rating, the level and trades (and stickers and tokens once they are launched, section 3.4), for the forms on the website including camp payments, for cookies and the Meta Pixel, for AI translation of our own content, and for the newsletter, customer support, deletion requests and the log of what has been accepted.

The club is the controller for rosters, attendance, training plans, game rosters, development notes, and the team’s photos and video. goalGetr is the club’s processor and only uses the data as the club decides. This follows a written data processing agreement, signed by the club’s board or management (the privacy code of the Norwegian Olympic and Paralympic Committee and Confederation of Sports, NIF, NIFs personvernnorm, § 4.6). The agreement says that we follow NIF’s code, which subprocessors we use, and that the club can audit us. [BEKREFT P5: the data processing agreement with the clubs has not been written yet; the text must match it] The player card and the training stickers are based on the club’s attendance records. [BEKREFT P6: whether the cards’ use of the club’s attendance is agreed in the data processing agreement as joint controllership or as disclosure from the club to goalGetr] You can send questions about them to the club or to us.

Meta. If you tap “Accept” on goalgetr.co, we measure our ads on Facebook and Instagram with the Meta Pixel. goalGetr AS and Meta Platforms Ireland Limited are then joint controllers (GDPR Art. 26) for the collection and the transfer, under Meta’s Controller Addendum in its Business Tools Terms. goalGetr gives you this information and only loads the pixel after a yes. After that, Meta is independently responsible. Meta can link the data to your Meta account and use it for its own advertising. Meta answers requests for access, rectification, erasure, restriction and data portability for what Meta stores. You can contact either of us; we pass Meta’s part on to Meta. See Meta’s Privacy Policy for how Meta uses the data and on what legal basis. [BEKREFT P7: Jens reads the EU version of Meta’s Controller Addendum (only the UK version has been read) and confirms the summary]

Stripe and camps. Stripe Payments Europe, Limited is the contracting party for camp payments. Stripe Technology Company, Limited (Ireland) is an independent controller for, among other things, fraud checks and regulatory compliance. The camps are sold by goalGetr AS. CDA Hockey leads the training on the ice. [BEKREFT P8: who organises and sells the camps under the competition rules of the Norwegian Ice Hockey Association, NIHF (kampreglement), § 2-14 (activities sold by anyone other than clubs require approval from NIHF, must be held outside the season and cannot target U13 and younger), and whether the camps have such approval, Jens/CDA] [BEKREFT P9: CDA Hockey’s role under data protection law (part of goalGetr, processor or joint controller)]

3. What data we process, why, and on what legal basis

“Art.” refers to the General Data Protection Regulation (GDPR). We do not ask for health data (except allergies before a camp), gender or full date of birth. Attendance answers have no reason, and never options such as “sick” or “injured”. Where coaches write about players, the app says: “Don’t write health details about players here.”

No law requires you to give us data. Without your birth year and accepted terms, we cannot create your account. Without the required fields, we cannot accept a sign-up or an order. Optional fields, photos, the newsletter and the Meta Pixel are voluntary.

3.1 The website goalgetr.co

[BEKREFT P10: the legal bases in table 3.1 are proposals that Jens confirms]

Activity	Data	Purpose	Legal basis
The meeting form (/book-mote)	Name, role (optional), club, email, mobile number (optional), message, that you have read the Privacy Policy and which version, optional newsletter.	Reply and arrange a meeting.	Art. 6(1)(f) (replying to enquiries).
The order and meeting form for clubs (/clubs, stored in HQ)	Order or meeting, package, club, name, role, email, mobile number, preferred start, organisation number, the club’s name, interests, message, and when the order terms were accepted. [BEKREFT P11: whether HQ should store that the Privacy Policy has been read, and which version, CDA]	Handle the order, invoice and follow up.	Art. 6(1)(f) (the agreement with the club you represent).
Camp sign-up (/camps/pamelding)	Parent: name, email, mobile number. Player: name, birth year, position, club. The camp, price, language, a sign-up reference without personal data, and the box “I have read the Privacy Policy. I am the parent or guardian, or I am 18 or older.” [BEKREFT P12: whether the checkbox should say “over 18 år” (over 18) or “18 år eller eldre” (18 or older), as the English text says, CDA and Jens] Optional newsletter. No health data.	Handle the sign-up and plan the camp.	Art. 6(1)(b) (a contract with the parent, or with you if you are 18 or older).
Camp payment (Stripe)	Email (filled in for you), sign-up reference, camp, amount, payment status. You give your card details only to Stripe. [BEKREFT P13: which fields the camp payment links collect at Stripe (name, address, phone), and what goalGetr sees there]	Take payment, show the paid camp and the code for the camp’s team in the app, accounting.	Art. 6(1)(b); accounting: Art. 6(1)(c) (the Norwegian Bookkeeping Act, bokføringsloven).
Allergies and other things the coaches need to know, before the camp	Allergies or other health data that the parent chooses to give when we ask, closer to the camp, with a separate box that is not ticked in advance.	Look after the player.	Art. 9(2)(a) (explicit consent). Deleted after the camp.
Video and photos from the camp	The player on the ice, and the coaches’ feedback.	Training and feedback on the camp’s team in goalGetr.	Not yet settled (section 6).
Summer Pass [BEKREFT P14: whether Summer Pass can still be bought; if not, the row is removed]	The buyer’s or the player’s email and the purchase at Stripe. The email address gets an invitation to the Summer Pass team in the app.	Give access.	Art. 6(1)(b).
Your choice in the cookie banner	A random ID, your choice, the text version and the time, in gg_consent and in a log we keep.	Remember your choice and show consent.	Art. 6(1)(c), read with Art. 7(1).
The Meta Pixel (only after “Accept”)	Pages you visit, browser and device, IP address, Meta’s IDs (section 11).	Measure our ads.	Art. 6(1)(a) and the Norwegian Electronic Communications Act, ekomloven, § 3-15.

3.2 The app: account, age and family (goalGetr is the controller)

[BEKREFT P15: the legal bases in table 3.2 are proposals that Jens confirms]

Activity	Data	Purpose	Legal basis
Account and login	Name, email and/or phone number, one-time codes (no passwords), profile photo if any, role (player, parent, coach), language, time the account was created. Players: position, shooting side, jersey number. Coaches: coach title.	Run the account and the login.	18 and over: Art. 6(1)(b). 13–17: your own consent, Art. 6(1)(a) and Art. 8, read with the Norwegian Personal Data Act, personopplysningsloven, § 5. Under 13: the parent accepts for the child, Art. 8(1). [BEKREFT P16: whether the parent’s acceptance for children under 13 is consent or a contract, and whether one combined box for the terms and privacy is valid consent for ages 13–17 (Art. 7(2) and (4)), Jens]
Birth year and accepted terms	Birth year, that the terms have been accepted and the Privacy Policy read, text version, time.	The right way in for your age, children’s-sport age (section 4), the right content.	Art. 6(1)(c), read with Art. 8(2) and Art. 7(1).
Children under 13 who try to sign up	No account, and we do not store the child’s email or phone number. If the child gives a parent’s email address, we invite the parent to create the account.	Let the parent create the account.	[BEKREFT P17: the basis for the invitation to the parent (none proposed), Jens]
“Add child” and parent links	The child’s name and birth year, and optionally the child’s email or phone number and a team code. The parent’s declaration “I am the parent or legal guardian of [child name].” when creating or linking. The link: child, parent, status (pending, confirmed, removed), who confirmed it, how and when. Invitation links.	Parental control, and reasonable checks of parental responsibility (section 5).	Art. 6(1)(c), read with Art. 8(2); otherwise as for the account.
The log of accepted terms and consents	Who (and the child), who acted, what (terms, terms accepted by a parent, showing a photo, confirmed parent link), text version, language, choice, method (self, parent, confirmed by coach, self-declared), time. Unchangeable copies of each text version in Norwegian, Swedish and English.	Show what has been accepted, and when. Entries can only be added to the log.	Art. 6(1)(c), read with Art. 7(1) and Art. 5(2).

3.3 The app: the team (the club is the controller, goalGetr is the processor)

Here, the club has the legal basis, and goalGetr processes the data on the club’s behalf (Art. 28).

Activity	Data	Purpose
Team membership and rosters	Name, role, membership periods, coach title, position, shooting side, jersey number, card design. Profile photo and card photo only after a yes (section 6). The roster that families see never shows the parents’ details.	Organise the team.
Calendar and attendance	Sessions and games (time, place, title), who is invited or selected, and answers (“Coming” or “Not coming”) with the time, from the player or a parent. The head coach and the team manager see attendance percentages.	Plan training and games.
Coach note on a session	Up to 250 characters, visible to the team and the parents.	Messages about the session.
Development level and development notes	The head coach can set a development level from 1 to 5 for each player (in the app: “Level” under “Position & level”), record positions and write dated development notes. The notes are behind a PIN code, and only the head coach can read them. All coaches on the team see the development level, so they can plan training and put together groups and lines. Players and parents see neither the development level nor the notes in the app.	Follow up development, put together groups and lines. [BEKREFT P18: whether the development level should be used to put together game lines for U13 and younger, where NIHF requires equal ice time and balanced lines; decision at the meeting]
Training plans, lines and game rosters	Groups and lines. Published plans and game rosters show names and jersey numbers to the families on the team.	Run sessions and games.
Files on sessions	Files the coach attaches. Only the team’s members and their parents can open them, and game files only those who are selected.	Share material.
The team’s photos and video	What the team shares in the app.	Training and follow-up.

3.4 The app: player cards, photos and content (goalGetr is the controller)

[BEKREFT P19: the legal bases in table 3.4 are proposals that Jens confirms] “As for the account” means the same basis as for account and login (3.2).

Activity	Data	Purpose	Legal basis
The front of the card	First name and the first letter of the surname, team, jersey number, card design. The photo only after a yes.	Show and trade cards.	As for the account.
The back: rating, skill scores, level and level stickers	Calculated from attendance, tasks ticked off as done and birth year (age group), with a log of each session, game and task that counts (section 4).	Show your own progress and motivate training.	[BEKREFT P20: the basis for the rating, which is systematic monitoring of children, and whether it is legitimate interest with a right to object, Jens]
Tasks and results	Tasks the player creates or gets from the coach, whether they are done, and logged counts, time or distance.	Training at home.	As for the account. [BEKREFT P21: whether tasks that the coach gives are the club’s data, Jens] [BEKREFT P22: whether children’s results (time, count, distance) can be health data under Art. 9, and if so which exception applies, Jens]
Stickers and tokens [BEKREFT P23: applies from when stickers and tokens are launched in the app; removed if they have not been built at publication, CDA]	Stickers for goals and skills, training stickers for milestones, tokens from daily tasks, unlocked card designs. Tokens can only be earned. They can never be bought, given away for money or exchanged for money.	Reward effort.	As for the account.
Trades and the collection	Who you have traded with (QR code or link), and when. The trading partner only gets the front, and the collection always shows the current card.	Collect cards.	As for the account.
Profile photo and card photo	The photo and the answer about showing it (section 6).	Show the photo.	Storing it: as for the account. Showing it to others: Art. 6(1)(a).
Background removal	The card photo is sent to remove.bg (section 6).	Make the card photo, without a separate box.	As for the card, under the Terms of Use (section 5). [BEKREFT P24: the legal basis (which letter of Art. 6(1)) for background removal, especially for ages 13–17, Jens]
The coach’s drills, sessions and videos	Text, drawings, photos, video, links to YouTube or Vimeo, and the confirmation “I have the right to share this, and no other children are shown without consent.”	Create and share training content.	Art. 6(1)(b) (a contract with the coach). The team’s photos and video: the club’s basis. [BEKREFT P25: the basis and responsibility for drills shared outside the team, Jens]
AI: “Expand with AI”, “Translate with AI” and the field “Describe the drill / session”	Only the text the coach sends, without the coach’s name, user ID or other data about the coach (section 7). Text that AI has expanded from keywords is labelled as AI-expanded. Translations are not labelled. In the phone app, we ask for your permission once before first use, and you can withdraw that permission in the settings.	Expand and translate text.	[BEKREFT P26: the basis and role for AI on the coach’s own text, Jens]
Automatic translation	goalGetr’s own drills and texts, translated into Norwegian and Swedish when they are published.	Content in three languages.	Art. 6(1)(f).
Reports and blocks	What has been reported, by whom and when, what we or the head coach did, and who is blocked.	Remove breaches of the rules and protect children.	Art. 6(1)(f).
Prizes in the token shop [BEKREFT P27: applies only once goalGetr starts selling subscriptions/prizes]	Prize, price in tokens, the child’s order, the parent’s approval or refusal, delivery address.	Send the prize. A parent approves each order and address from their own account, and the address is only used for delivery.	As for the account; Art. 6(1)(b) for the parent’s approval. [BEKREFT P28: who sends the prizes, Jens]
Purchases and subscriptions (also from the first sale)	The buyer’s name and email (always an adult), subscription, price, period, payment status, the time of the purchase and of any request to start straight away, the withdrawal period. Payment through Stripe. [BEKREFT P29: whether purchases in the phone app should go through Apple or Google]	Deliver the subscription, confirmations, reminders, accounting.	Art. 6(1)(b); accounting: Art. 6(1)(c) (the Bookkeeping Act).

3.5 Notifications, newsletter, customer support and security

[BEKREFT P30: the legal bases in table 3.5 are proposals that Jens confirms]

Activity	Data	Purpose	Legal basis
Emails about the service	Email, first name; team, time, place, game roster; the child’s first name in notifications to parents; login code with approximate location (city and country) and time; invitations (who, team, role). Never offers.	Messages about the team and the account.	About the team: the club’s basis, sent on the club’s behalf. About the account: Art. 6(1)(b).
Push notifications in the phone app	Push key, platform, language, the notification’s title and text (for example the child’s first name, team, time, place) and a link. No notifications that nag children.	Messages about sessions and games.	As for emails about the service.
Newsletter	Email, the box “Yes, send me news and offers from goalGetr by email (camps, programmes, new features), about once a month. Unsubscribe any time.”, text version, time and unsubscribing. Who gets the box: section 5. Every email has an unsubscribe link.	News and offers.	Art. 6(1)(a) and the Norwegian Marketing Control Act, markedsføringsloven, § 15.
Customer support and deletion requests	What you write to support@goalgetr.co or on the deletion page, our reply, and a log of deletion requests (who, what, when).	Help you and show that we have deleted.	Customer support: Art. 6(1)(b) or (f). Requests to use your rights, and the log: Art. 6(1)(c), read with Arts. 12–22.
Operations and server logs	IP address, browser, time, pages and features, user ID in error messages.	Operations, troubleshooting, preventing misuse.	Art. 6(1)(f).

3.6 Where the data comes from

Mostly from you. Otherwise, it comes from your parent (“Add child”, attendance answers), a parent who signs you up for a camp, your child (who gives us your email address), the coaches and the club (rosters, sessions, game rosters, development notes), Clerk (approximate location from your IP address, for the email with the login code) and the Brønnøysund Register Centre (the club’s name).

4. Player cards, rating and level

The front of the player card is what players trade. The back shows the rating (the overall number), six skill scores, the level and the level stickers Black, Bronze, Silver, Gold, Platinum and Diamond.

How the rating is calculated

The app calculates the rating from attendance at the team’s sessions and games, and from tasks that the player or a parent has ticked off as done. The same goes for the skill scores and the level. No coach sets them. The head coach’s development level 1–5 is something else and does not affect the card.
Attendance counts when the player or a parent has answered “Coming”, or when the team counts everyone in and the player has not said they cannot come. It does not count when the coach answers for the player.
Each session and task is weighted by length, type and skills against weekly goals for the age group (based on the birth year). The season starts on 1 August. The rating can go down after a break, but the level never does. At children’s-sport age, a drop is not shown as a loss.

Who sees the back of the card

Children’s-sport age follows the age class in hockey, not the age of 13. In Norway, it covers U13 and younger, and the season ends on 30 April. In Sweden, it covers U12 and younger, and the season ends on 15 May. For example, a child born in 2014 is of children’s-sport age in Norway up to and including 30 April 2027. The server works this out from the team’s country and the birth year.

Player	Who sees the back
Children’s-sport age	Only the child and their parents. Not people who have the card in their collection, not trading partners, not on rosters, and not in the head coach’s view of the player. The back is never used to sort players or to put together groups or lines.
Under 18, above children’s-sport age	Hidden from others by default. The player can choose “Everyone” under “Card privacy”.
18 and over	Visible to people who have the card in their collection, to trading partners and in the head coach’s view of the player, unless the player chooses “Private”.

At children’s-sport age, there are no leaderboards, no comparisons with friends, no sharing of the rating and no “best on the team”. Others only see training stickers as milestones every child can reach during a season (for example 5, 10 and 25 sessions), and tasks at home count too. We never show who has trained the most. Everyone can see stickers for goals and skills (once they are launched, 3.4).

Automated decisions and the right to object

The rating is an automatic calculation of training over time. goalGetr does not use it for decisions such as selection, groups or lines. [BEKREFT P31: whether the rating is profiling under Art. 4(4), and that Art. 22 does not apply, Jens] Because it follows a child’s development over time, it has been assessed in a data protection impact assessment (DPIA). [BEKREFT P32: the DPIA is finished before publication]

You can object (Art. 21) to processing based on legitimate interest by writing to support@goalgetr.co. We then stop, unless compelling grounds take precedence. You can also choose “Private” under “Card privacy”, or delete your account.

5. Children, age and parents

Birth year

Before an account is created, we ask “What year were you born?”. We ask for your birth year, not your full date of birth. That is why we treat you as under 13 until the end of the year you turn 13. Your age is calculated from your birth year. [BEKREFT P33: how the age limit of 18 is calculated when we only have the birth year, CDA and Jens] You cannot change your birth year yourself. A confirmed parent can correct it. [BEKREFT P34: how adults, and young people without a linked parent, get their birth year corrected, for example via support@goalgetr.co, and how we check such a request, CDA]

If you already have an account, we ask you to give your birth year and accept the terms the next time you log in. [BEKREFT P35: what happens to existing accounts for children under 13 that were created without a parent (recommended: the parent approves, 30-day deadline, then pause)]

Children under 13

Only an adult with a parent account can create the child’s account, with “Add child”. The parent accepts the Terms of Use for the child and declares parental responsibility.
The parent manages the account: profile, card photo, attendance answers, tasks, card trading, yes or no to showing the photo, and deletion.
When a child whose account was created by a parent is no longer treated as under 13, we show the child once what the parent has accepted. The child can confirm it or withdraw it.
If the child no longer has a linked parent, for example because the parent deleted their own account, the account is paused until a parent is linked again.

How we check that a parent is a parent

The law requires reasonable efforts to check that the person who accepts for a child has parental responsibility (Art. 8(2)):

The parent declares “I am the parent or legal guardian of [child name].” when using “Add child” or linking to a child. An incorrect declaration is a breach of the Terms of Use (section 11).
The parent’s account is verified with a code sent to their email or phone.
If the child is on a team, a coach on the team confirms or removes each parent in the member list, which only coaches see. A link that comes from a coach’s invitation is confirmed from the start. If the child is not on a team, the link is based on the declaration and the verified account.
Until the parent link is confirmed, the child’s photo and card are kept out of trades with other children. [BEKREFT P36: whether this also applies to players aged 13–17 who have not linked a parent]
A wrong link can be reported. We remove it quickly and log the case.

Young people aged 13 to 17

From 13, you create your account yourself, and ticking the box for the Terms of Use is your consent to using the app (the Personal Data Act, § 5; the same applies in Sweden). It is not a binding contract for you while you are under 18 (the Norwegian Guardianship Act, vergemålsloven, § 9), but the rights in this policy apply in full.
Linking a parent is voluntary. But it is required before your photo is shown to others, before you order a prize and before anything is bought. The parent is then asked to accept the terms for you, without you being stopped. A linked parent can see your profile and what you do in the app.

No advertising and no pressure to buy aimed at children

The app has no advertising, no Meta Pixel and no tracking for marketing, and we do not use data about children for marketing.
The newsletter requires a separate box that is not ticked in advance (3.5). The box is only shown to adults and parents, and the newsletter only goes to their own email. We never send marketing to children’s accounts. [BEKREFT P37: whether young people aged 13–17 get the box, and whether the rule of the Norwegian Consumer Authority (Forbrukertilsynet) that only a parent can consent for children under 15 should be in the text, CDA and Jens]
Children’s accounts never see prices, buy buttons or prompts to “ask your parents” (from the first sale, as in 3.4).
No streak breaks if you skip a day, and you can make up for days you have missed. We send no push notifications that nag children.

6. Photos and video

Profile photo and card photo

When you upload a photo, you see one box that is not ticked in advance: “Show my photo to my team and to players I trade cards with.” Trades are mentioned because cards are also traded with players in other clubs. If you do not tick it, only the player and their parents see the photo. Everyone else sees a placeholder, and the app works the same.

Under 13, the parent says yes. From 13 to 17, the young person ticks the box and the linked parent gets a request. The photo is only shown when both have said yes, and a no from either of them keeps it private. From 18, the player decides alone.
The switch “Show my photo to others” in Settings hides the photo at once everywhere, also in other people’s collections.
We store who answered, when and which text they saw, and for young people both answers. Profile photos and card photos are not openly available on the internet. They are only shown in the app to the people who are allowed to see them.

Background removal (remove.bg)

The card photo is sent to remove.bg (Canva Austria GmbH, Austria), which removes the background. This is part of the card feature under the Terms of Use (section 5), without a separate box. We send the file or a short-lived link. remove.bg is a processor, does not use the photo to train models and deletes it immediately. [BEKREFT P38: written confirmation from remove.bg of no training or improvement programme, immediate deletion (at the latest after about one hour) and processing in the EEA; the data processing agreement allows processing outside the EEA, and some subprocessors are in the USA]

The coach’s videos and content

Before sharing, the coach confirms: “I have the right to share this, and no other children are shown without consent.”
Video that the team shares is the club’s data. Video that we store for the coach goes through DatoCMS and Mux (section 7). [BEKREFT P39: whether coach videos are moved out of DatoCMS (decision item 7), and where they are then stored]
Everyone, including players and parents, can tap “Report” on photos, video and drills that others can see. Our aim is to deal with reports about children within hours, not days. The head coach can remove content and block a member.

Video from camps

The coaches film the players on the ice. The videos are part of the camp, for training and feedback. They are shown to the player and their parents on the camp’s team in goalGetr. [BEKREFT P40: whether the coaches’ feedback is part of what the camp offers, who on the camp’s team sees the video and feedback, the legal basis for the filming, and how long video and feedback are stored, Jens]

Photos of children in marketing

We do not use photos or video of children in marketing without a separate, voluntary consent. That consent can be withdrawn, and it does not affect anyone’s place at a camp. The licence coaches give us for shared drills (Terms of Use, section 3) never covers photos and video of children in marketing. [BEKREFT P41: whether and how the consent is collected, who gives it (the parent, and for ages 13–17 also the young person), and the basis for the photos and film of players on goalgetr.co/camps today, Jens]

7. Who we share data with

We do not sell personal data. We only share data with those who need it. Most of them are suppliers that process data on our behalf or on the club’s behalf, under a data processing agreement. [BEKREFT P42: an agreement in place with each supplier before publication]

Who in goalGetr	What they see
The team (players and parents)	The roster, the calendar, coach notes, published plans and game rosters, photos after a yes. Never the parents’ details.
The coaches	In addition: attendance, the development level and the parents in the member list (to confirm them). Only the head coach reads the development notes. Not the back of the card at children’s-sport age.
Parents	The child’s profile, the card including the back, birth year, attendance, tasks and photos. Not the development level or the development notes.
Trading partners, also in other clubs	The front, the photo only after a yes, the back as set out in section 4.
The club	The team’s data (section 2).
goalGetr AS	A few people who work for goalGetr, for support, operations and publishing our own content. [BEKREFT P43: who has such access, and what confidentiality undertaking they have signed]

Supplier	What they get	Where	Transfer basis (section 10)
Clerk, Inc. (login)	Name, email, phone number, profile photos, the teams’ names and logos, roles, one-time codes (Clerk sends the SMS codes), and the email from Summer Pass purchases, for the invitation.	US company; processes data where Clerk and its subprocessors have facilities, mainly Google Cloud and Cloudflare. [BEKREFT P44: Clerk’s data region]	DPF, with SCCs as a fallback
Svix (messages from Clerk to the app)	Changes to users and teams, including one-time codes in emails.	USA	[BEKREFT P45: a separate agreement with Svix, or Svix as Clerk’s subprocessor, and the transfer basis]
MongoDB Limited (MongoDB Atlas, database)	Everything in the app, and club orders in HQ.	[BEKREFT P46: the region for the databases of the app and HQ]	Outside the EEA: DPF and SCCs. [BEKREFT P47: MongoDB’s entry on the DPF list]
Vercel Inc. (hosting and file storage)	Traffic and server logs for the website, the app and HQ; card photos, the coaches’ photos and videos, session files, videos on the website.	The app: Dublin. The website and HQ: Washington D.C. File storage: [BEKREFT P48: the region for the Vercel Blob stores] May also process data in the USA, where its main facilities are.	DPF; SCCs in the data processing agreement. [BEKREFT P49: that goalGetr has a Pro or Enterprise plan, as Vercel’s data processing agreement requires, CDA]
Plus Five Five, Inc. (Resend, email)	Email address, first name and the content: notifications, login codes with approximate location and time, invitations, the forms from the website.	Sent from Ireland, stored in the USA	SCCs and DPF
Google (Google Workspace, support@goalgetr.co)	The forms from the website, and emails you send us.	[BEKREFT P50: the Google company, storage location and transfer basis for Google Workspace]	See the previous column.
Stripe Payments Europe, Limited (contracting party) and Stripe Technology Company, Limited	Email, sign-up reference, amount and what you enter at Stripe. Stripe Technology Company is an independent controller for, among other things, fraud checks (section 2).	Ireland; may be transferred to the USA and India	DPF (Stripe, LLC) and SCCs
Meta Platforms Ireland Limited (the pixel, only after a yes)	Pages on goalgetr.co, browser and device, IP address, Meta’s IDs. Joint controller (section 2).	Ireland; may be transferred to the USA	DPF (Meta Platforms, Inc.)
Canva Austria GmbH (remove.bg)	The card photo.	Austria (EU); see section 6	[BEKREFT P51: the transfer basis if remove.bg processes photos outside the EEA]
Anthropic Ireland, Limited (AI)	Text from the AI buttons, and goalGetr’s own content for translation. Not used for training. Deleted within 30 days; flagged misuse up to 2 years.	Stored in the USA	SCCs
DATO SRL (DatoCMS, content)	goalGetr’s content and the coaches’ videos.	Italian company; data in Ireland and France	Has subprocessors in the USA, including Mux and Vercel. [BEKREFT P52: a signed data processing agreement with DATO SRL, and the transfer basis for the US subprocessors, CDA/Jens]
Mux, Inc. (video)	The coaches’ videos and the viewer’s IP address. Playback without cookies and tracking.	USA	DPF. [BEKREFT P53: the current data processing agreement with Mux]
650 Industries, Inc. (Expo, push notifications), and from there Apple and Google	Push key and the notification’s title and text. Apple and Google deliver the notification.	USA	DPF. [BEKREFT P54: which Apple and Google companies deliver push notifications]
Google Ireland Limited (YouTube) and Vimeo.com, Inc., only when you tap	IP address, browser, and the fact that you are watching the video.	YouTube: Ireland, may be transferred to the USA. Vimeo: USA.	YouTube: DPF (Google LLC). Vimeo: DPF and SCCs.
Volentio JSD Limited (jsDelivr)	IP address and browser, when your email program fetches the font in our emails, and when the older camp page /camps/pavel-barber-to-norway fetches a script. [BEKREFT P55: the part about the older camp page is removed if the page is removed]	United Kingdom	The EU’s adequacy decision. [BEKREFT P56: whether the decision of 19 December 2025 has been incorporated into the EEA Agreement]
Google (Google Fonts, only on goalgetr.co/onboarding)	IP address and browser.	[BEKREFT P57: the Google company and place of processing; the row is removed if the HQ pages stop using Google Fonts, CDA]	[BEKREFT P58: the transfer basis for Google Fonts]
The Brønnøysund Register Centre	The organisation number in the club form, and your IP address; your browser asks the register directly.	Norway	No transfer
Klingenberg Regnskap AS (accountant)	Accounting information about payments (camps, invoices to clubs, later subscriptions).	Norway	No transfer
CDA Hockey (the coaches at the camp)	The player’s name, birth year, position and club, and what the parents give us before the camp. [BEKREFT P59: what the camp’s coaches get]	The role is still to be settled (section 2)	See section 2

8. Your rights and deletion

Your rights

Access (Art. 15) and a copy. Players and parents do not see the development notes in the app, but they can ask for access to what is stored about them, including the notes. [BEKREFT P60: any exceptions from the right of access for the coach’s notes, and that the club answers as the controller, Jens]
Rectification (Art. 16). A confirmed parent corrects the birth year (section 5).
Erasure (Art. 17), see below.
Restriction (Art. 18), for example while we check whether something is correct.
Data portability (Art. 20): what you have given us, in a common machine-readable format.
Objection (Art. 21) to use based on legitimate interest.
Withdrawing consent (Art. 7(3)) at any time, in the settings or under “Cookie settings”. This does not affect what happened before. Saying no to a photo, the newsletter or the Meta Pixel never stops you from using goalGetr. [BEKREFT P61: what happens to the account when a 13–17-year-old withdraws consent, including when a child withdraws it the first time they are no longer treated as under 13, CDA and Jens]

Write to support@goalgetr.co. We reply within one month. In large or difficult cases, we tell you within one month that we need up to two more months (Art. 12(3)). We may ask you to confirm who you are (Art. 12(6)). We answer about the club’s data together with the club. For children under 13, the parent uses these rights; from 13, you use them yourself.

How to delete

Your own account: you delete your account yourself with “Delete account” under “Account settings” in the app, both at app.goalgetr.co and in the phone app when it arrives. [BEKREFT P62: that the button is still called “Delete account” and is still under “Account settings” once the changes have been built; the consent specification, item 15, says “Delete my account”, CDA]
Your child’s account: as a parent, you can delete your child’s account in the app with [BEKREFT P63: the name of the button for deleting the child’s account, e.g. “Delete child’s account”, and where it is; today the button is called “Remove child” and only removes your link, CDA]. This deletes the whole account, not just your link to the child. If the child has no email address or phone number of their own on the account, you are the only one who can delete it. [BEKREFT P64: whether a parent can delete the account of a young person aged 13–17 without the young person’s consent, CDA and Jens] If a parent deletes their own account, the child’s account stays, because the child is a separate person (under 13: paused, section 5).
Without logging in, you can use the form on the deletion page on goalgetr.co, or write to support@goalgetr.co. [BEKREFT P65: the address of the deletion page on goalgetr.co]
The only head coach: the app first shows you how to hand the team over.

What is deleted, and what we keep

We delete the user, the profile, the card and the photos, the rating and the log behind it, tasks and results, trades and the collection, team memberships, attendance answers and push keys. Your name is removed from notes you have written about other players; the notes stay with the team. The deletion also reaches our suppliers, without you having to ask: Clerk (including the profile photo), the card photos in file storage, videos in DatoCMS and Mux, and contacts at Resend. remove.bg deletes immediately, and Anthropic within 30 days. [BEKREFT P66: whether the coach’s files in file storage and files uploaded to sessions are also deleted, CDA] Drills and sessions you have shared with a team stay with the team. [BEKREFT P67: whether shared content should stay with the team after deletion, and whether the author’s name is removed]

We keep a minimal log of what was accepted (IDs, type, version, choice, method and time) for 3 years after the account is deleted. We keep accounting information about purchases (camps, invoices to clubs, later subscriptions) for 5 years under the Bookkeeping Act. We also keep a log showing that the account was deleted, and when (section 9).

Complaints

Please tell us first. You can send a written complaint to Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, phone 22 39 69 00, datatilsynet.no (digital form or letter). If you live in Sweden: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, phone +46 8 657 61 00, through IMY’s e-service for complaints.

9. How long we keep data

A daily job deletes data when the time limit has passed. [BEKREFT P68: Jens sets the time limits in the rows marked “time limit not set”]

Data	How long
Account, profile, card, rating, trades, collection	Until the account is deleted.
Profile photo and card photo	Until the photo or the account is deleted.
Children’s accounts that are not used	Time limit not set. The parent is notified first.
Other accounts that are not used	[BEKREFT P69: whether adult and youth accounts that are not used should be deleted, and the time limit]
Rosters, calendar, attendance, files on sessions (the club’s)	As long as the club decides. Attendance stays with the team when you leave. [BEKREFT P70: time limits for team data, and what happens when the club agreement ends, to be agreed in the data processing agreement]
Development notes	Until a certain age (time limit not set), and when the player leaves the team.
Names in published training plans	For a while after the player has left the team (time limit not set).
Invitation links	Valid for 7 days. [BEKREFT P71: how long used and declined invitations are stored]
Photos at remove.bg	Immediately after processing (section 6).
Text at Anthropic	Up to 30 days; flagged misuse up to 2 years.
The log of accepted terms and consents	While the account exists; a minimal log for 3 years after deletion.
The log of deletion requests; enquiries from the meeting form and support; club orders in HQ; camp sign-ups	Time limit not set.
Allergies and other health data for camps	Deleted after the camp, at the latest within a time limit (time limit not set).
Video and photos from camps	Not yet settled (section 6).
Accounting information (camps, invoices to clubs, later subscriptions)	5 years, under the Bookkeeping Act. [BEKREFT P72: when the five-year period starts, which section of the Bookkeeping Act applies, and what counts as accounting records for camp payments, Jens]
Newsletter consent	Until you unsubscribe. [BEKREFT P73: how long the unsubscription and the consent are stored afterwards]
Your choice in the banner	In your browser: 180 days. Our log: time limit not set.
Server logs	[BEKREFT P74: how long Vercel and Clerk store logs on our plan]
Email logs at Resend	[BEKREFT P75: how long Resend stores sent emails]
Push keys	Until the device cannot be reached, or the account is deleted.
Backups	Deleted data remains until the backups are replaced. [BEKREFT P76: whether the database has backups at MongoDB Atlas, and how long they are kept, CDA]
Prize orders and delivery address (from the first sale)	Time limit not set.

10. Transfers to countries outside the EEA

We only transfer data to the USA and the United Kingdom when the law allows it, on the bases in the table in section 7:

EU–US Data Privacy Framework (DPF): the European Commission’s decision that certified US companies give adequate protection. It also applies to Norway. Clerk, Vercel, Resend, Stripe, Meta, Google (YouTube) and Vimeo are on the DPF list. Mux and Expo state themselves that they follow the DPF. [BEKREFT P77: the entries on dataprivacyframework.gov/list for Mux, Inc. and 650 Industries, Inc.; if they do not exist, the transfer must rely on SCCs]
The EU’s standard contractual clauses (SCCs), approved by the European Commission: Anthropic, Vercel (if the data processing agreement applies to our plan), Resend, Stripe and Vimeo, and Clerk as a fallback.
Adequacy decision for the United Kingdom: jsDelivr.

The General Court of the European Union upheld the DPF on 3 September 2025, but the case has been appealed. We therefore keep an overview of the basis for each supplier, and a plan for standard contractual clauses or other suppliers if the DPF falls, as Datatilsynet recommends. For a copy of the safeguards, write to support@goalgetr.co.

11. Cookies and the Meta Pixel

Cookies are small files in your browser. Under the Electronic Communications Act (ekomloven, Act of 13 December 2024 No. 76), § 3-15, we need your consent before we store or read anything on your device, unless it is strictly necessary for the service you have asked for. The rule also applies in the app. Datatilsynet and the Norwegian Communications Authority (Nkom) supervise this. [BEKREFT P78: the Swedish rules on cookies, and supervision, for Swedish users, Jens]

The website goalgetr.co

Name	What it does	Duration	Consent?
gg_consent	Remembers your choice in the banner, with a random ID, the text version and the time.	180 days	No, necessary
camp_locale	Shows the page after payment in the language you signed up in.	1 day	No, necessary
camp_checkout	Remembers the IDs of up to four Stripe payments, so the page after payment can show the camp and the code for the camp’s team.	30 days	No, necessary
_fbp and _fbc (Meta)	Meta’s ID for the browser and for ad clicks. Only after “Accept”, and only where the pixel can be used.	[BEKREFT P79: the lifetime Meta sets for _fbp and _fbc]	Yes

We consider the first three strictly necessary. [BEKREFT P80: Jens assesses whether gg_consent, camp_locale and camp_checkout are strictly necessary under § 3-15] Our own code uses no other storage, and the website has no analytics tools. [BEKREFT P81: whether Vercel sets its own cookies, and whether Meta’s script uses other storage after “Accept”]

The Meta Pixel only loads after “Accept”. “Accept” and “Reject” are the same size. After “Reject”, nothing is sent to Meta and the whole website works. The pixel is never used on the camp pages, the sign-up, the page after payment, or the pages for players and summer. [BEKREFT P82: whether the pixel should only be used on /clubs (decision W1) or on all pages that are not for children (as PR #110 is built)] It only sends that a page has been viewed, not sign-ups, purchases or forms. We do not use Meta’s automatic collection, and we do not create audiences from people who have signed up. About Meta’s use: sections 2 and 7. You change your choice under “Cookie settings” at the bottom of the page. If you withdraw your yes, the pixel stops and we delete _fbp and _fbc.

Other requests: the organisation number in the club form is looked up at the Brønnøysund Register Centre (data.brreg.no), which sees your IP address. The videos on the website are fetched from file storage at Vercel. When you pay, Stripe’s cookies apply. /onboarding and other HQ pages fetch Google Fonts. YouTube videos only load when you tap. [BEKREFT P83: that all YouTube videos on the website use youtube-nocookie.com before publication]

The app

Name	What it does	Duration	Consent?
locale	Your language.	365 days	No, necessary
sessions-child, sessions-team, role, sessions-role-view	The selected child (ID), team, role (parent or coach) and view.	365 days, deleted when you log out	No, necessary
Clerk’s cookies	Keep you logged in.	[BEKREFT P84: the names and duration of Clerk’s cookies]	No, necessary
Local storage	Drafts in the drill and session builder, display and print choices, calendar view and date, which tours you have seen, and which teams and children the calendar shows. Most of it is deleted when you log out.	Until you log out or clear it	No, necessary

The phone app stores your login securely on the phone. The app has no analytics tools, no advertising and no Meta Pixel, and the coaches’ videos play without cookies and tracking. [BEKREFT P85: that all storage in the app is strictly necessary under § 3-15, Jens]

YouTube and Vimeo only load when you tap, with a label such as “This video is from YouTube.”. Before that, they get nothing, and we fetch no preview images from Google. YouTube is used in privacy-enhanced mode (youtube-nocookie.com), so watching does not personalise ads for you outside goalGetr. Vimeo is used with dnt=1, where Vimeo only sets four cookies that it calls necessary. After you tap, both can store or read cookies.

12. Security

Login with a one-time code sent to your email or phone, without passwords.
Access is checked on the server every time. Role, birth year, parent links and the rating setting cannot be changed from the browser.
Profile photos, card photos and files on sessions are not openly available on the internet. They are only shown in the app or through short-lived links. [BEKREFT P86: whether the coaches’ photos and videos (today in public file storage and DatoCMS/Mux) should also become private, CDA]
The development notes are behind the head coach’s PIN code, which is not stored in plain text. Trading codes only work for a short time, and messages from the login service are checked with a signature.
Only those who need access get it. [BEKREFT P87: access control, and whether encryption of the database can be mentioned]
If there is a security breach, we notify Datatilsynet and you when the law requires it (Arts. 33 and 34). If it concerns the team’s data, we notify the club without undue delay, and the club passes it on (Art. 33(2)).

13. Changes to this policy

Each version has a name and a date, and is kept in Norwegian, Swedish and English. If we change something significant, we tell you before the change applies. We then ask you to accept the new terms, or to consent again where needed. For children under 13, we tell the parent. [BEKREFT P88: how and how far in advance we give notice of changes (in the app, by email, on the website), Jens]

14. Contact and complaints

goalGetr AS, organisation number 935 734 746, Kannikgata 51, 4009 Stavanger (postal address: see section 1), support@goalgetr.co. [BEKREFT P89: whether goalGetr must have a data protection officer, and if so, the contact details] Complaints: Datatilsynet, or IMY in Sweden (section 8). Please also read the Terms of Use. This policy is always available at goalgetr.co/en/privacy and in the app.

For review (removed before publication)

The numbered open points (P1–P89) are the same as in the Norwegian version. The full list is at the bottom of the Norwegian Privacy Policy.