Privacy policy

Last updated: October 2026

This privacy policy describes how personal data is processed when you use Keppniskerfi. Processing is governed by Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, GDPR).

Data controller

Keppniskerfi is responsible for processing information about its own user accounts and the operation of the service. Tournament organizers decide which personal data they record and publish about their tournaments and are responsible for that processing. Keppniskerfi stores and publishes that information as directed by the organizer. Questions can be sent to keppniskerfi@keppniskerfi.is.

What personal data do we process?

Personal data is provided by users and tournament organizers. Information is also recorded when the service is used. An email address is required to create an account and sign in. We process the following information:

  • Name, email address, role and connections to clubs, teams and tournaments.
  • Information recorded by organizers, such as contact email addresses and team information.
  • Sign-in and access information, IP address, browser information, invitations and logs of email deliveries, changes and errors.

Legal basis for processing

The legal basis depends on the purpose of processing:

  • Contractual services: processing necessary to provide the agreed service where the contract is with the individual concerned (Article 6(1)(b) GDPR).
  • Access by invitation from an organizer: accounts created at an organizer’s invitation are based on the legitimate interests of the organizer and Keppniskerfi in providing access to those invited (Article 6(1)(f) GDPR).
  • Security, operations and usage measurement: legitimate interests in protecting access, diagnosing errors, maintaining the service and measuring its use to improve it, insofar as these interests are not overridden by the individual’s rights (Article 6(1)(f) GDPR).
  • Legal obligations: where the law requires processing or retention of information (Article 6(1)(c) GDPR).

Organizers determine the legal basis for processing personal data they record about participants and contacts.

Why do we process personal data?

Personal data is used to identify users, manage access, send sign-in codes and invitations, manage tournaments, teams, schedules and results, maintain security, diagnose errors and measure use of the service. No automated decisions, including profiling, are made about individuals. Keppniskerfi does not sell personal data.

Processors and recipients

The following service providers process personal data on behalf of Keppniskerfi to operate the service:

  • Neon - database and backups. Hosted in London, United Kingdom.
  • Vercel - hosting, file storage, usage and performance measurement. Web servers run in Dublin, Ireland.
  • Resend - email delivery. Sent from Ireland.
  • Sentry - error monitoring. Hosted in Germany.
  • Upstash - rate limiting to prevent abuse. Hosted in Ireland.
  • Mapbox - maps. The user’s browser retrieves maps directly from Mapbox in the United States. This transmits the IP address and browser information, and Mapbox retains IP addresses for up to 30 days.
  • Google - sign-in, when a user chooses to sign in with a Google account. Google processes that information under its own privacy policy.

Tournament schedules and results, together with team and club names, are published on the tournament’s public website. All these providers are US companies. Even when data is hosted in Europe, they may process it in the United States, for example for operations and support. Such transfers rely on their certification under the EU-U.S. Data Privacy Framework. The United Kingdom, where the database is hosted, has received an adequacy decision from the European Commission. Further information about safeguards is available from Keppniskerfi.

How long do we keep data?

Retention depends on the type of information and the purpose of processing:

  • Account information is kept for as long as needed to provide access and services to the user.
  • Tournament data is retained for tournament organization, schedules and results. Requests to erase personal data within it are handled with the relevant organizer.
  • Delivery, change and security logs may be kept longer where needed to trace deliveries, resolve errors or investigate abuse.
  • Database backups are kept for up to five weeks. Deletion from the active database therefore does not immediately remove older backups.

Individuals may request erasure of personal data or further information about retention. If certain data must be retained because of a legal obligation or another valid reason, the individual will be informed.

Your rights

Individuals may request access to, correction, erasure, restriction of processing or portability of their personal data, and object to processing where applicable. Send requests to keppniskerfi@keppniskerfi.is. Requests are answered without undue delay and no later than one month after receipt. This period may be extended by up to two months if a request is complex or there are many requests; the individual will be informed of the extension and its reasons within one month of receipt. Requests about information recorded by a tournament organizer are handled in cooperation with that organizer.

Cookies and browser storage

Essential cookies are used for sign-in. Sessions generally last seven days. Favorite teams and some interface settings are stored in the user’s browser.

Referee QR codes provide access to result entry. If an organizer protects a pitch code with a PIN, its unlocked state is stored in an essential cookie for 12 hours.

Usage measurement and error monitoring

Vercel Analytics counts visits and general usage events, and Vercel Speed Insights measures performance. Favorite-team events do not include team names or identifiers. Sentry is used for error monitoring.

More about measurement data
  • Sign-in, invitation and referee pages are excluded from Vercel measurement. Query strings and fragments are removed from transmitted URLs.
  • Events are recorded when a favorite team is added or removed and when the favorites overview is opened. Team selections are stored in the user’s browser.
  • According to Vercel’s documentation, these tools do not use traditional tracking cookies, but they do send measurement data from the browser.
  • Sentry receives error data. Sensitive access URLs and query strings are removed. When an error is linked to a signed-in user, Keppniskerfi sends only the user identifier, without a name or email address.

Children

The service is used for children’s and youth tournaments. Organizers may record team information and publish schedules and results. Concerns about children’s personal data that may have been recorded or published without appropriate authorization can be directed to Keppniskerfi or the relevant organizer.

Changes to this policy

Keppniskerfi reserves the right to update this privacy policy. Significant changes are communicated to users by email or a notice in the system. The date of the latest update appears at the top of this page.

Complaints to the Icelandic Data Protection Authority

Individuals have the right to lodge a complaint with the Icelandic Data Protection Authority if they believe that processing of personal data violates the law (personuvernd.is).

Questions and contact

Questions about personal data processing by Keppniskerfi can be sent to keppniskerfi@keppniskerfi.is.