Privacy statement
What we record about you, why we are allowed to, who gets to see it and how long we keep it. This system holds data on minors; that raises the bar above the legal minimum.
Version 2 — 9 September 2026
Who processes your data
NK Little League, Kelvinbaan 48 in Nieuwegein, is the data controller for everything set out below. Questions about your data, or a request? E-mail info@nklittleleague.nl.
We have not appointed a data protection officer; the tournament office handles your request itself and involves the regional coordinator where needed.
What we process, what for, and on which legal basis
Per group, below is what ends up in the system, what we need it for and which legal basis under the GDPR allows us to process it.
| What we process | What for | Legal basis |
|---|---|---|
| Players | ||
| Name, date of birth, gender, home address and country | Assessing the registration, calculating the league age and linking the player to the right region and division | Performance of the participation agreement |
| Name and address of the school | Determining which league a player falls under when the home address does not decide it | Performance of the participation agreement |
| Coordinates of the home and school address | Automatically determining which league boundary an address falls within | Performance of the participation agreement |
| Name, phone number and e-mail address of a parent or guardian | Contact about the registration, the selection and the tournament | Performance of the participation agreement |
| Club and sport preference | Placement in baseball or softball and coordination with the club | Performance of the participation agreement |
| Name of the signing parent, their relationship to the child and the moment of signing | Demonstrating that a parent or guardian made the registration | Legal obligation (accountability) |
| Selection status, reserve or withdrawal status and the reason for it | Putting the regional team together and submitting the selection | Performance of the participation agreement |
| Notes about diet, allergies or medical circumstances | Catering and safety during the tournament | Explicit consent of the parent; in case of acute danger, the vital interests of the child |
| Images in which a player is recognisable | Covering the tournament on the site and on social media | Consent |
| Coaches, team officials, volunteers and umpires | ||
| Name, date of birth, address, phone number, e-mail address and role | Accreditation, scheduling and contact during the tournament | Performance of the agreement about your involvement |
| Preferred location, available time blocks, preferred tasks and experience | Planning your involvement and assigning you to a location | Performance of the agreement about your involvement |
| What you fill in on the volunteer sign-up form | The sign-up goes by e-mail to the tournament office, which turns it into a participation in the back office. The form itself stores nothing | Steps taken at your request before entering into an agreement |
| VOG and Diamond Leader — the document, the screening profile, the expiry date and who checked it when | Making sure only screened adults work with underage athletes | Legitimate interest in a safe sporting environment |
| Travel distance, IBAN and account holder (stored encrypted) and shirt size | Paying the mileage allowance and ordering clothing | Performance of the agreement and a statutory retention duty for the accounts |
| Accounts and administration | ||
| Name, e-mail address, phone number, encrypted password, two-factor data and a profile photo | Signing in, securing the account and making visible who did what | Performance of the agreement and legitimate interest in security |
| Change history — who changed which field and when | Keeping it traceable who changed something and detecting misuse | Legitimate interest in an auditable system |
| Mail log — recipient, subject, template and moment of sending | Demonstrating that a message was sent. We record no content and do not measure whether you open a mail | Legitimate interest in demonstrable communication |
| Newsletter | ||
| Name, e-mail address, language, where you signed up and the moment you signed up and confirmed | Sending the newsletter. Your sign-up only counts once you follow the link in the confirmation e-mail; every mail we send has an unsubscribe link | Consent |
| Your IP address at sign-up | Being able to show from which connection a sign-up was made, and countering misuse | Statutory accountability duty and legitimate interest in security |
| Whether your mail server accepted a newsletter or returned it as undeliverable, and for what reason | Monitoring delivery and removing addresses that no longer exist from the list | Legitimate interest in deliverable mail |
| Which link in a newsletter was clicked, and when | Seeing which topics are read. We do not measure whether you open a mail, and a click records no IP address or browser details | Legitimate interest in useful messages |
| Safe sport reports | ||
| The topic, your report itself and — unless you report anonymously — your name, e-mail address and phone number | The report goes straight by e-mail to the confidential counsellor and is not stored in the system. Reporting anonymously is always possible | Legitimate interest in a safe sporting environment; whatever you fill in, you share on your own initiative |
| Visitors to this site | ||
| Your IP address when you submit the registration form | Countering misuse of the form | Legitimate interest in security |
| Your IP address when a consent is recorded | Being able to show when a consent was given or withdrawn | Statutory accountability duty |
| Visitor statistics via Google Analytics, with a pseudonymous identifier in a cookie | Seeing which pages are read. Without consent no script loads and we measure nothing | Consent |
| The Trustindex review widget | Showing reviews. Loads only after consent or when you open them yourself | Consent |
| Anonymous proof of your cookie choice — a random identifier, the chosen categories, the version and the moment | Being able to show that we only measure with consent | Statutory accountability duty |
Health data
A dietary wish, an allergy or a medical circumstance is special category personal data. We treat it differently from an address.
We only ask for it when the tournament needs it, we ask for explicit consent, and the system only shows it to those who have to act on it: dietary wishes and allergies to catering and the regional coordinator, medical notes only to the regional coordinator. A coach does not see them. They do not appear in exports or on participant lists.
Want a medical note removed? We do that right away. If a child would be put at risk by it, we call the parent or guardian first.
Children
A registration is always made by a parent or guardian. We record who signed, their relationship to the child, and when that happened.
Consents we ask for separately — images, newsletter, medical notes — are given by that parent or guardian on behalf of the child, and they can withdraw them just as easily. From the age of sixteen a young person decides on this themselves. The rights below are likewise exercised by a parent or guardian for as long as the child is under sixteen.
Where the data comes from
Most of it comes straight from you: from the registration form, from your volunteer application or from your own account.
Not all of it. A coach or regional coordinator also enters players and team officials themselves, or loads an existing team list into the system as a CSV or XLSX file. If you appear on such a list without having filled in anything yourself, your rights below apply in full — feel free to ask what has been recorded about you and by whom.
Who else gets to see your data
Inside the organisation the rule is: you only see what your role needs. A coach sees their own team, a regional coordinator their own region, and only the tournament office sees everything. Outside it, we engage these parties.
| Party | What for | Where |
|---|---|---|
| Our hosting and e-mail provider | Running the application, sending messages and reporting back whether a message was undeliverable | European Union |
| Google (Analytics) | Visitor statistics, only after consent for statistics | EU and United States |
| Google (Maps) | Completing addresses on the registration form — what you type in the address field goes to Google | EU and United States |
| Trustindex | The review widget, only after consent | European Union |
| Moosend | The separate mailing list that a newsletter consent from the participant back office lands on. The newsletter on this site we send ourselves | EU and United States |
We conclude a data processing agreement with every party that processes data on our behalf. Want to know exactly which suppliers those are? Just ask. Beyond that we share nothing, unless we are legally required to. We do not sell data and we do not use it for advertising.
How long we keep it
The periods below are settings in the system and run automatically every week — no person is involved who could forget. What we do not yet clear out automatically is stated honestly.
| What | Retention period | What happens afterwards |
|---|---|---|
| Screening documents (VOG, Diamond Leader) | 180 days | The approved document is deleted; the profile, date, checker and status remain, so it stays demonstrable that a check took place. |
| Registrations from a closed season | 3 years | The registration leaves the system and can no longer be viewed or exported by anyone. A running season is never purged. |
| Sent e-mail (mail log) | 2 years | Deleted. We keep no content and no open or click data. |
| Change history (audit log) | 2 years | Deleted. |
| Clicks in a newsletter campaign | 1 years | Deleted. The click count per campaign stays; who clicked does not. |
| Newsletter sign-up without confirmation | 30 days | Deleted. Without confirmation by e-mail we send you nothing. |
| Proof of cookie choices (anonymous) | 2 years | Deleted. |
| Data on players, coaches, volunteers and umpires in a running season | As long as you take part | There is no automatic per-season clear-out for this yet. Ask us to delete your data and we will do so once the tournament has finished. |
| Newsletter subscription and the sending history per campaign | As long as you are subscribed | Unsubscribe and we stop sending immediately. We keep the fact that you unsubscribed, so you are not added back by accident. |
| Account data (name, contact details, two-factor data, profile photo) | As long as your account exists | Close your account and we delete it along with everything attached to it. |
| Payment details for the umpire allowance | 7 years | A tax retention duty applies to the accounts; after that we delete them. |
Your rights
You always have these rights. You exercise them with a single e-mail to info@nklittleleague.nl; we respond within four weeks and may extend that period by two months for a complex request. We may ask you to show that you are who you say you are, so that we do not hand a child's data to the wrong person.
- Access — request which data we hold about you and what we do with it.
- Rectification — have an error corrected or something added.
- Erasure — have your data deleted, unless we are legally required to keep it.
- Restriction — have processing paused while a dispute or correction is running.
- Objection — object to anything we base on a legitimate interest, including your name appearing on this site.
- Portability — receive the data you supplied yourself in a common file format.
- Withdraw consent — as easily as you gave it. What happened before you withdrew stays lawful; after that it stops.
- Complaint — lodge a complaint with the Dutch Data Protection Authority.
Transfers outside the EU
Google and Moosend may process data in the United States. For those transfers we rely on the EU-US Data Privacy Framework or, where that does not apply, on the European Commission's standard contractual clauses. Beyond that, data stays inside the European Union.
How we secure it
Security is not an afterthought here. Every administrative account requires two-factor authentication. Permissions are limited per role, so nobody sees more than their task requires. VOG and Diamond Leader documents sit on shielded storage that cannot be reached from the internet. Umpires' bank details are stored encrypted. Every change to a personal data field is written to the change history.
Suspect a breach, or see something that is not right? E-mail info@nklittleleague.nl and we will pick it up immediately.
Automated processing
The system calculates the league age from the date of birth itself, and works out from the postcode and coordinates which league boundary an address falls within. Both are aids: a regional coordinator or the tournament office still assesses every registration by hand and can override the outcome. We take no decisions based solely on automated processing that significantly affect you, and we do not profile.
Changes to this statement
If anything changes about what we record, who we share it with or how long we keep it, we update this statement and raise the version number at the top. If the change touches something you gave consent for, we ask for that consent again.