Loyal2Sports privacy statement

Deze website zet 5 cookies, waarvan er 2 pas na jouw toestemming worden geplaatst. Er staan 0 trackers van derden op de site en we verkopen niets door. Vul je een aanvraag in of maak je een proefomgeving, dan gebruiken we die gegevens alleen daarvoor.

Who you are dealing with

Responsible for your data.

Loyal2Sports is responsible for the data that reaches us through this website. We are registered with the Dutch Chamber of Commerce under number 84872624 and based in the Netherlands. If you have a question about your data, email info@loyal2sports.nl. You get an answer within 30 days, usually much sooner.

This statement covers www.loyal2sports.nl. If your club uses the platform itself, we are the processor for that data rather than the controller; what applies there is set out in the data processing agreement you sign at the start.

What we process

Three things, and nothing else.

For each of the three, below is exactly what we record, what we use it for and on what basis that is allowed.

Your request for a demo or a free start

What Club name, your name, your role, email address, phone number, your preferred moment, the number of members, the modules you are interested in and your own message. Alongside that we record which page you filled the form in on and which link or campaign brought you to the site.

What for To get in touch with you and prepare the appointment or the trial environment. We use the origin to learn which page genuinely helps clubs, never to follow you around.

Legal basis Performance of an agreement at your request, and our legitimate interest in following up on enquiries.

Visitor statistics, only if you say yes to them

What A random identifier, your IP address, the town and region that go with it, your browser, operating system and device type, the pages you look at and the link that brought you here. Also which buttons you click, how far you scroll on a page and whether you started filling in a form.

What for To see which pages actually help clubs and which do not, so that we can improve the site.

Legal basis Your consent, which you can withdraw at any time.

Your trial environment, if you create one

What Club name, your role, your email address, the sponsorship packages and images you build, and the responses sponsors leave on them. Inside your trial we also measure what you use, so we can improve it and help you.

What for To make your trial work: signing in without a password, publishing your pages, and sending sponsor responses straight to your inbox.

Legal basis Performance of the agreement you enter into by creating the trial environment.

Recording your cookie choice

What A random number unconnected to anything else, your choice, the version of this statement, your browser string and a hashed print of your IP address. The IP address itself is not stored here.

What for To be able to demonstrate that you gave or refused consent.

Legal basis Our legal duty to make consent demonstrable.

Five cookies, two of them only with your yes.

Say no in the cookie notice and the two statistics cookies are not placed, and are removed if they were already there.

Cookie	What for	Type	How long
`l2s_consent`	Remembers your choice in the cookie notice, so we do not ask again on every visit.	Necessary	6 months
`l2s_site_csrf`	Protects the two forms against misuse from another site.	Necessary	Until you close the browser
`l2s_vid`	Recognises your device, so a return visit does not count as a new visitor.	Statistics	12 months
`l2s_sid`	Keeps track of which pages belong to a single visit.	Statistics	Until you close the browser
`l2s_proef`	Keeps you signed in to your trial, if you created one.	Necessary	30 days

What we do not do

This is definitely not on our site.

This is not a promise on paper but a setting on the server: the site is not allowed to load files from other hosts at all. A tracker would not even work.

No ad networks, no retargeting and no social media pixels.
No Google Analytics or any other third party statistics service.
No external fonts, scripts or images. The browser only loads files from our own server, on this site and in the platform. Since 21 September 2026 not a single external host remains in any page's security settings, and a check in our build pipeline blocks every attempt to add one.
No selling, renting or swapping of your data. Never, to anyone.
No profiles used to follow you across other websites.
No decisions about you taken by a computer without a person looking at them.

Retention periods

How long we keep things.

Everything we keep has an end date. Anything past its term is deleted.

Requests for a demo or a free start

24 months after our last contact, or sooner if you ask.

Visitor statistics

14 months, after which we delete the data.

Your trial environment

Active for 2 months; kept for another 90 days in case you come back, then deleted, images included.

Sponsor responses in a trial environment

24 months, like other enquiries.

The record of your cookie choice

3 years, because that is how long we must be able to demonstrate a given consent.

Email about your request

For as long as the contact runs, after which we clear it out with the rest of the correspondence.

Where it sits and how it is secured

In the European Union, behind an encrypted connection.

Our servers and our database are located within the European Union. What comes in via this website does not go to countries outside the European Economic Area. For the platform it is more nuanced. If a club connects its Facebook or Instagram, the posts it publishes go to Meta in the United States. That is set out below under "The platform".

The platform

In a club environment the roles are reversed.

If your club uses Loyal2Sports, it decides what is recorded about you. We supply the system and process those data only on its instructions. That is not a formality: it determines who you need to approach.

The club decides, we carry it out

A club that uses Loyal2Sports decides for itself which data it records about its members, customers, sponsors, volunteers and (in our education environment) pupils and parents. That makes the club the data controller. We supply the system and process those data solely on its instructions.

What that means What this means for you: if you want to know which data a club holds about you, or want them erased, you need to approach that club. We are not allowed to do so on our own initiative. If you are unsure who to contact, email us and we will point you to the right party.

What we are responsible for ourselves

For the data of the people who hold a contract with us: a club's contact person and its administrators. Name, email address, telephone number, role, login details and billing details. Also for our own logs about the operation and security of the system.

What that means For those you can come to us directly.

What a club environment may contain

That differs per club and per module. In practice it concerns name, address, email address, telephone number, date of birth, team, function or role, photos, orders and payments, sponsor contracts, and in the education environment attendance and progress of pupils. For direct debit an IBAN is recorded. We store that encrypted.

What that means We do not look into those data, except when a club asks us for help or when we have to resolve a malfunction. That is done by a person, it is logged, and never unasked.

Children

In the education and youth environment the data concern minors, and in the parent portal the link between a parent and their child. There the school or the club is the controller. Where required, it obtains consent from the parent or guardian.

What that means We build the portal so that a parent only sees their own children, and we never use these data for anything other than making the environment work.

Who else has access

Four parties, and exactly what for.

This list does not come from a template but from the outgoing connections of the system itself. If a party is not listed here, it receives nothing either.

Party	What for	Where
Strato (Germany)	Hosting of the platform and the databases, and sending email on behalf of clubs.	Within the EU.
Mollie (the Netherlands)	Payments: iDEAL, direct debit and refunds. Mollie receives the data belonging to a payment.	Within the EU.
Meta: Facebook and Instagram (United States)	Only if a club connects its Facebook page or Instagram account. We then send the posts it publishes to Meta, together with the reference to that page or account. We do not send any member data to Meta.	Outside the EU. Meta participates in the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition.
Push services of Google, Apple and Mozilla	Only if someone switches on notifications in the parent portal. That service receives an address of the device. The content of the notification is encrypted by us and unreadable to that service.	Partly outside the EU, under the same standard contractual clauses.

A club that connects neither Facebook nor Instagram and switches on no notifications has nothing to do with the last two parties.

How it is secured

Six measures you can check.

None of these points is an intention. They are in the code and are checked again on every change by our build pipeline.

Every club has its own database. Data from one club are not physically present in another club's environment.
We store passwords encrypted and irreversibly. Administrators log in with a second step via an authenticator app.
Access tokens of connected services and IBAN details are stored encrypted, not as readable text.
Who may see what is defined per role and is checked again on every action, not only in the screen.
All traffic runs over https. The browser may only load files from our own server.
Actions that touch money or data are recorded in a log that cannot be altered afterwards.

Retention periods in the platform

What we keep, and for how long.

One thing we say honestly: within a club environment we do not clean up automatically. The club decides what may go, and we carry that out.

Data in a club environment

As long as the club is a customer and as long as it keeps them itself. The club decides what may go; we carry that out. At present we have no automatic clean-up. A club that wants something erased asks for it, and then we do it.

After the contract ends

The environment stays accessible for 30 days so the club can export its data. After that we delete the environment and the associated backups within 90 days.

Invoices and accounting

Seven years, because tax law requires it of us.

Logs about operation and security

At most 12 months, then deleted.

Connections with Facebook or Instagram

Until the club disconnects. It can do that itself, in one click, in Club settings. The access token is then erased.

Your rights

What you may ask of us.

One email to info@loyal2sports.nl is enough. We will not ask for a copy of your passport.

Access

You may ask which data we hold about you.

Correction

If something is wrong, we correct it.

Erasure

You may ask us to erase everything. We will, unless the law requires us to keep something.

Restriction and objection

You may object to a processing activity or ask us to pause it.

Portability

On request you get your data in a common file format.

Withdrawing consent

“Cookie preferences” sits at the bottom of every page. One click there switches the measurement back off.

If we cannot resolve it together, you may lodge a complaint with the Dutch Data Protection Authority. That is your right, and we would rather hear it from you first so we can put it right.

Version

This statement can change.

If anything changes in what we process, we update this page and ask for your cookie choice again. This is version 2.0, updated on 21 september 2026.