Privacy policy
This text describes how NextGen Cuper processes personal data when a club registers teams for our cups and when you visit our website. We only collect what we actually need in order to run the cup, and we never sell data on.
Who is responsible for your personal data?
NextGen Cuper is the data controller for the processing described here.
If you have questions about how we process personal data, or want to exercise any of the rights below, e-mail us at info@nextgencuper.se. We normally respond within one month.
What do we collect, and why?
When a club registers teams for a cup we collect the club's name and town, the contact person's name, e-mail address and phone number, billing details (address, optional billing e-mail, company registration number and invoice reference), the team names and age class, the accommodation packages chosen and the number of beds, and any additional questions that particular cup's registration form contains.
We use this to administer the registration, confirm and invoice participation, plan accommodation and run the cup. The legal basis is that the processing is necessary to perform the contract with the club regarding participation (Article 6(1)(b) GDPR). For accounting records we also have a legal obligation under Swedish bookkeeping law (Article 6(1)(c)).
If you tick the box for news and offers we use the contact person's e-mail address for mailings. The basis is then consent (Article 6(1)(a)). Consent can be withdrawn at any time and we then stop sending anything. Declining never affects the registration itself.
If you sign up for the newsletter we store your e-mail address and the language you chose. We first send an e-mail with a confirmation link and only add you to the list once you have clicked it — without that confirmation we send nothing, and an unconfirmed address is deleted automatically after seven days. The basis is consent (Article 6(1)(a)). Every mailing contains a link to unsubscribe, and you can do it yourself at any time at newsletter/unsubscribe. When you unsubscribe we stop sending and keep the address only as a suppression record, so that you are not accidentally added again.
When you visit the website we use Google Analytics to understand how the site is used — but only after you have explicitly consented in the cookie banner. Before that, no measurement code is loaded at all and nothing is sent to Google. You can change your choice at any time via "Cookie settings" at the bottom of the page. The basis is consent.
On the pages that have video — the start page and Accommodation & family — the video itself is hosted by YouTube. Nothing is fetched from YouTube when the page loads: before you click, all you see is a still image served from our own server. Only when you press play does your browser contact Google, which then receives your IP address and details about your browser and device. For that processing Google is the controller, not us. We use the youtube-nocookie.com address, which does not set Google's advertising cookies. If you choose not to press play, nothing is sent.
We do not collect sensitive personal data — such as information about health, diet or disability — in the registration.
How long do we keep it?
Registration and contact details are kept for as long as they are needed to run the cup and handle questions afterwards, and at most 24 months after the cup ends. Accounting records are kept for seven years under Swedish bookkeeping law. Data we process on the basis of consent is deleted when the consent is withdrawn. After that, the data is deleted or anonymised.
Who has access to the data?
The data is handled by staff and officials within NextGen Cuper who need it for their role. We also use suppliers that process data on our behalf, known as processors. Today these are Supabase (database and sign-in), Netlify (hosting), Resend (confirmation e-mails), Upstash (protection against abuse and overload), Sentry (error reporting) and Google (web analytics, only after consent). We have data processing agreements with all of them, and they may only process the data on our instructions.
We never sell your data. It is disclosed to a third party only where we are required to do so by law.
Your rights
You have the right to request access to the data we hold about you, to have inaccurate data corrected, in certain cases to have data erased or the processing restricted, to object to certain processing, and to have the data you provided transferred to someone else (data portability). If you have given consent, you may withdraw it at any time.
E-mail info@nextgencuper.se and we will help you.
If you believe we are processing your data incorrectly, you have the right to complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes to this text
This privacy policy is version-controlled. When you submit a registration we store which version of the text was displayed and in which language, so it can later be established exactly what information you were given. When we change the text, we publish a new version here.