Privacy Policy.

Arbolix B.V. is the data controller for the operation of Bankheld. You can contact us about this policy or the use of personal data at the address below.

Team administrators and other account holders who add information about players, emergency contacts, or other people are responsible for having authority and a lawful reason to enter and share that information.

We process data you provide, data created through team and match activity, and limited technical data generated when Bankheld operates.

• Account and authentication data, including your username, email address, Firebase user ID, authentication provider, account dates, IP address, and security metadata.
• Team and membership data, including team codes, team and club names, roles, membership status, approval dates, club address, and selected club logo or image reference.
• Player data entered by an authorized team member, including name, email address, date of birth, emergency contact name, relationship and phone number, photo, and preferred positions.
• Match and participation data, including dates, times, opponents, venues, availability, formations, line-ups, substitutions, playing time, scores, match events, limited injury or penalty status, live-match operation, and notes entered by users.
• Optional photos selected from a device and notification preferences or status. Player photos are stored in protected cloud storage; temporary picker and cache locations may remain on the device.
• Usage and technical data, including app and installation identifiers, the authenticated user ID, device and operating-system information, app version, language, screen views, interaction events, match identifiers used in an event, network information, and update checks.
• Crash and diagnostic data only when crash reporting is enabled, including crash traces, device and app details, installation identifiers, the authenticated user ID, and privacy-safe operational categories. We also store the crash-reporting choice, source, time, text version, platform, and app version.
• Search terms sent to Google Places or HockeyWeerelt when you choose to search for a club, opponent, or venue, together with the network information those providers receive.
• Messages and other information you send when you contact Arbolix for support or a privacy request.

If you use email and password authentication, Firebase Authentication processes the password. Arbolix does not receive or store a readable copy of it.

• To create and secure accounts, provide team access, synchronize Bankheld, store formations and match records, and deliver the features you request. We rely on performance of our agreement with the account holder for this processing.
• To protect accounts, prevent misuse, diagnose service failures, maintain availability, and respond to support requests. We rely on our legitimate interests in operating a secure and reliable service.
• To understand product use through Firebase Analytics, including account-linked screen views and interaction events, and to improve Bankheld. We rely on our legitimate interests in measuring and improving the product.
• To provide optional club and venue search results and software updates when those features are used.
• To comply with legal duties and establish, exercise, or defend legal claims where necessary.

Crashlytics collection remains disabled unless you opt in. When we rely on consent, you may withdraw it at any time without affecting processing that already took place lawfully.

Bankheld is a shared team service. Approved members of a team can access the team, player, match, and participation information allowed by their role. Pending users cannot access team data until they are approved.

Leaving a team, switching teams, signing out, or uninstalling the app does not automatically delete shared team records. Those records may remain available to other approved members.

We disclose data only when needed to operate Bankheld, when you choose a connected feature, or when required by law. The main recipients are:

• Google Firebase for authentication, database storage, protected photo storage, analytics, optional crash reporting, and technical messaging or installation services.
• Google and Apple when you choose their sign-in service.
• Expo and EAS Update for delivering application updates. Update requests include the operating system, Arbolix project ID, and a random installation token, but not a direct account identity.
• Google Places and HockeyWeerelt when you search for or select club, opponent, or venue information.
• Professional advisers, authorities, or courts where disclosure is legally required or necessary to protect legal rights.

Arbolix does not sell Bankheld personal data and does not use it to display advertising.

More information about key providers:

• Firebase
• Expo
• Google
• Apple

Some providers process data outside the European Economic Area. Firebase Authentication is operated from United States data centres, while other Firebase and Expo services may use global infrastructure. Where required, we rely on contractual safeguards, standard contractual clauses, or an applicable adequacy mechanism offered by the provider.

• Account, team, player, and match data is kept while it is needed to provide Bankheld, support an active shared team, meet legal obligations, or handle disputes. Authorized users can delete some records in the app, and further deletion can be requested by email.
• When one account is deleted, shared team and match records may be retained where they are still needed by other team members. We will remove or reduce personal identifiers where required and reasonably possible.
• Stored photos, backups, and queued or cached records may remain for a limited cleanup, backup, security, or recovery period after the visible record is removed.
• Google states that Crashlytics keeps crash traces and associated identifiers for 90 days before beginning removal. Firebase Authentication may take up to 180 days to remove authentication data from live and backup systems after deletion is initiated.
• Google Analytics user-level and event-level retention follows the configured Analytics controls, up to 14 months for a standard property. Aggregated reports may remain for longer.
• Local data remains on the device until it is cleared by Bankheld, the operating system, signing out where applicable, or uninstalling the app.
• Consent records, support correspondence, and legal records are kept only for as long as reasonably needed to demonstrate choices, answer requests, comply with law, or protect legal rights.

Bankheld accounts are intended for adults aged 18 or older. An authorized adult may create a player profile for a minor when they have the required permission or other lawful authority and have informed the player and, where appropriate, the parent or guardian.

Enter only information needed for team and match coordination. Do not place medical diagnoses, detailed health information, or other unnecessary sensitive information in player or match notes.

• Photo access is optional and used only when you choose an image for a player or club.
• Notification permission is optional and used for match timing and resume notifications generated by Bankheld.
• Crash reporting is opt-in and can be enabled or disabled later in Bankheld Settings.
• Firebase Analytics is currently enabled for product measurement and does not have an in-app toggle. You may object to this processing by contacting Arbolix.
• Club, opponent, and venue searches are optional; avoiding the search feature prevents the search term from being sent to the external search provider.

Depending on the law that applies to you, you may have the following rights:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion or restriction of processing.
• Object to processing based on legitimate interests.
• Receive data you provided in a portable format where the right applies.
• Withdraw consent for future processing where consent is the legal basis.

Email contact@arbolix.app with the subject “Bankheld privacy request”, preferably from the email address connected to the account. State whether the request concerns your account or a player for whom you are authorized to act. We may request limited additional information to verify identity and authority, and we will respond within the period required by applicable law.

You also have the right to complain to the supervisory authority in your country. In the Netherlands, this is the Dutch Data Protection Authority.

Bankheld uses authenticated access, role and membership checks, protected Firebase database and storage rules, and encryption in transit and at rest through its providers. No system can guarantee absolute security, so please protect your login details and team code and contact us if you suspect unauthorized access.

We may update this policy when Bankheld, our providers, or legal requirements change. The current version and its update date will remain available at this URL. We will provide additional notice in the app or through another appropriate channel when a change materially affects users.

For questions, objections, access requests, or deletion requests concerning Bankheld, contact Arbolix B.V. at: