Privacy Notice
Last updated 27 September 2026
- We store what we need to run sessions: your email, your display name, which sessions you sign up for, and your membership details.
- Your display name is shown publicly on the list for the current session. Anyone visiting the site can see it. You choose the name, so a first name or nickname is fine.
- We never sell your data or use it for advertising.
- You can change your name, turn off emails or delete your account yourself, on your account page.
1. Who is responsible for your data
IF Academ (non-profit association, org. no. 846501-7161), Malmö, is the data controller for the personal data on this website. For anything about your data, email ifacadem@karen.mah.se.
2. What we collect and why
- Your account
- Your email address, the display name you choose, a user ID, and a password if you choose to set one (stored only in scrambled, hashed form). We use these to log you in, show your name on session lists and send you emails about sessions you are part of.
- Session sign-ups
- Which sessions you sign up for, when you signed up, whether you have a confirmed spot or are in the queue, and which part of a split session you chose. This is how we run the spots and the queue.
- Membership registration
- When you register as a member: your full name, whether you study at Malmö University, whether you are a member of Studentkåren Malmö, how you paid, and the name of whoever paid for you or took your cash payment. Also any notes you add, and whether the board approved or rejected your registration. We need this to check that you meet the membership requirements and have paid the fee. If you register through our Google Form instead, the same kind of information is stored in Google Forms.
- Email notifications
- Which sports you want emails from when a new session is posted. New accounts start with volleyball emails turned on. You can turn them off at any time, from your account page or with the unsubscribe link in each email.
- Feedback
- Feedback you send is anonymous: we store the text and its category, but not who sent it. Please don't include personal details in it.
- Technical data
- Our hosting providers keep your IP address and browser details in logs for a short time, and we count page visits without cookies (Vercel Web Analytics).
Why we're allowed to: we use your data because it's part of your membership. The exceptions are the public session list, new-session emails, feedback and technical logs. For those we rely on our legitimate interest in letting people see who's coming, telling you about sessions, improving the association and keeping the site secure. You can object to those (see section 5).
You need an email address to log in, and membership details to become a member. Without them you can't sign up for sessions. We make no automated decisions about you. The queue is simply first come, first served.
3. Who can see your data
- Anyone visiting the site: the display names on the current session list for each sport, and whether each person has a spot or is in the queue. Earlier sessions are not shown.
- Other members and activity leaders: the same session lists.
- The board (admins): email addresses, display names, membership and payment details, and whether you have attended in the last 30 days.
- Our service providers, who handle data only on our instructions: Supabase (database and login, data stored in Ireland), Vercel (website hosting), Brevo (email, France), and Google, Cloudflare and jsDelivr (fonts and icons, plus Google Forms if you use it).
Supabase, Vercel, Google and Cloudflare are US companies. Any access from outside the EU/EEA relies on the EU–US Data Privacy Framework or the EU's Standard Contractual Clauses. If you join our Facebook, Messenger or WhatsApp groups, Meta handles that data under its own privacy policy.
4. How long we keep it
- Your account: until you delete it. Accounts with no login for 2 years are deleted automatically.
- Attendance history: made anonymous (your name and user ID removed) 12 months after each session.
- Membership and payment details: deleted 2 years after the end of the membership year they belong to.
- Feedback: deleted after 2 years.
- Technical logs: kept by our providers for a short period, normally a few weeks at most.
If you delete your account, we remove your login, email address, display name, notification settings and membership details right away, and free your spot in any upcoming session. Sessions that have already happened keep an anonymous count, with your name removed.
5. Your rights
You have the right to:
- see the data we hold about you and get a copy of it;
- correct it. You can change your display name on your account page;
- have it deleted. You can delete your account on your account page;
- object to processing based on legitimate interest, for example to your name appearing on the public list, or to emails about new sessions;
- restrict how we use it while a question is being looked into;
- take it with you (data portability) in a machine-readable format.
Email ifacadem@karen.mah.se and we will answer within one month, free of charge. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
6. Cookies
We only store what's needed to keep you logged in and remember small preferences, and use no tracking or advertising cookies.
7. Changes
If we change how we handle your data, we will update this page and the date at the top. If a change matters to you, we will also tell you on the site or by email.