Privacy Statement
This Privacy Statement explains how Refplan handles Personal Data. We attach great importance to careful and transparent processing and comply with the General Data Protection Regulation (GDPR). This statement applies to our websites and to the services surrounding the Refplan platform.
Article 1 — Who we are
1.Refplan is a trade name of CVC consultancy, registered with the Chamber of Commerce (KvK) under number 93483740. Where this statement refers to "we", "us" or "Refplan", this means CVC consultancy.
2.For questions about this Privacy Statement or about the processing of your Personal Data, you can contact us at support@refplan.app.
Article 2 — Two roles: Controller or Processor
Under the GDPR, an organisation may be a "Controller" (determines itself why and how data is processed) or a "Processor" (processes solely on the instructions of another party). For Refplan, this depends on which data is involved:
We are the CONTROLLER for the data of visitors to our website and of the contact person(s) of an affiliated Association (for example for the purposes of invoicing, account management and support). How we handle this is set out in Articles 3 and 4.
We are the PROCESSOR for the Personal Data that an Association enters into the platform about its referees, planners and youth match supervisors. For that data, the Association is the Controller; we process it solely on its instructions, on the basis of a Data Processing Agreement. See Article 5.
1.Are you a referee, planner or youth match supervisor and do you want to know what happens to your data, or do you want it changed or deleted? You can adjust much of the data yourself in the app, and you can delete your account yourself — upon which your data is removed from our database. For anything else, you should turn to your Association; if you contact us, we will refer you to the responsible Association.
Article 3 — Visitors to our websites
1.When you visit our websites (refplan.app and my.refplan.app) or send us a message (for example via a contact form or by e-mail), we process the data you provide yourself — such as your name, e-mail address and the content of your message — and limited technical data required to keep the website functioning securely and properly, such as your IP address and browser type.
2.We use this data solely to answer your question, to contact you and to secure the website. The legal basis is your request and our legitimate interest in a secure, functioning website.
3.Cookies: our website and app use solely functional and strictly necessary cookies (for example for logging in, the language choice and security). We do NOT place tracking, advertising or non-functional analytics cookies. No consent is required for strictly necessary cookies; therefore we do not display a cookie banner.
Article 4 — Contact persons of affiliated Associations
1.When an Association registers for the Service, we process data of that Association's contact person(s) — such as name, e-mail address, function (for example treasurer or referee coordinator) and the data required for invoicing and payment.
2.We process this data to perform the Agreement, send invoices, provide support and communicate about the Service. The legal basis is the performance of the Agreement and, for invoicing, a legal obligation.
3.Payments are handled via our Payment Service Provider Stripe. Full payment details (such as card numbers) are processed directly by Stripe; we do not see them. See Article 6 for the engaged parties.
Article 5 — Users of the platform (our role as Processor)
1.For the referees, planners and youth match supervisors listed in the Service (website and app), the Association is the Controller. We process that data — such as first and last name, e-mail address, qualification level, availability, preferences (including preferred (age) categories and language and display preferences) and match appointments — solely on the instructions of the Association, on the basis of a Data Processing Agreement as published at refplan.app/en/dpa.
2.The exercise of your rights (such as access, rectification or erasure) as a referee, planner or youth match supervisor is handled via your Association. We provide the Association with all reasonable cooperation in this respect.
3.As part of providing the Service, we also process some data directly: login credentials for authentication, e-mail addresses for the delivery of messages, and — if you enable that feature yourself — data for push notifications on your device.
Article 6 — Parties we engage
To provide the Service, we engage a limited number of other parties, with each of which we have concluded a data processing agreement. The parties that process data on behalf of Associations are also listed in Article 4 of the Data Processing Agreement; we engage Stripe for payment processing (for which we are ourselves the Controller):
Supabase — database, authentication and file storage. Data is stored in the European Union (Ireland region).
Vercel — hosting of the application. The server functions run in the European Union (Dublin).
Resend — sending of transactional e-mail (invitations, password recovery, notifications).
Apple — delivery of push notifications on iOS devices (Apple Push Notification service), only when the iOS app is used.
Google — delivery of push notifications on Android devices (Firebase Cloud Messaging), only when the Android app is used.
Stripe — processing of payments.
1.Some of these parties are established in the United States. Insofar as Personal Data is processed outside the European Economic Area (EEA) in that context, this takes place on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission. Storage and server-side processing take place within the EU.
2.Apart from the parties named above, we do not provide your Personal Data to third parties, unless we are legally obliged to do so.
Article 7 — Retention periods
1.We retain data of Associations' contact persons for as long as the Agreement is in force. We retain invoice and administrative data thereafter for the statutory tax retention period of seven years.
2.The Personal Data contained in the platform is retained and deleted in accordance with the Data Processing Agreement. After termination of the subscription, the Association's data is deleted upon expiry of the period stated therein.
3.Data you provide to us via the website or by e-mail is retained no longer than necessary for handling your question.
Article 8 — Your rights
1.You have the right of access to your Personal Data, and to rectification, erasure, restriction of processing, data portability and objection to the processing, insofar as the GDPR provides for this.
2.We do not take decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or otherwise significantly affect you.
3.If you are a referee, planner or youth match supervisor, you exercise these rights via your Association (see Articles 2 and 5). If you are a visitor to our website or a contact person of an affiliated Association, you can address your request to support@refplan.app.
4.We respond to a request as soon as possible and no later than within one month of receipt. If a request is complex or if we receive several, this period may be extended by no more than two months; we will inform you of this within the first month.
5.If you believe that we do not handle your Personal Data with due care, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Article 9 — Security
1.We take appropriate technical and organisational measures to protect your Personal Data. These include: encryption of data in transit and of sensitive data at rest, access security with mandatory two-factor authentication for administrators, storage within the European Union, and strict separation of data per Association.
Article 10 — Changes
1.We may amend this Privacy Statement from time to time, for example when our working methods or legislation and regulations change. The current version can be found at refplan.app/en/privacy; the version number and the date at the bottom show the version in force at any given time.
This Privacy Statement relates solely to Refplan. Your Association is responsible for the data that your Association processes about you; please consult your Association's privacy policy for that.
This document is an English translation of the Dutch "Privacyverklaring". In the event of any discrepancy between the English and Dutch versions, the Dutch version prevails.