Privacy statement

This statement is about korfbalinc.nl, the platform with news, results, standings, transfers, polls, predictions and comments.

The shop korfbalinc.shop is also ours, but has its own privacy policy: the shop's privacy policy. It explains what happens when you view, order or pay for something in the shop. One thing from the shop runs via this platform: the "Withdraw from contract" button (see 3.12).

The short version is at the top. Below it is everything in detail.

Part 1. The short version

For everyone, including if you are 14.

Who are we?
KORFBALINC makes the website korfbalinc.nl about korfball and the shop korfbalinc.shop. When we write "we", we mean KORFBALINC. (with a full stop: that is how our name is registered with the Chamber of Commerce). This statement is about korfbalinc.nl. The shop has its own privacy policy.

You can read without us knowing who you are.
You don't have to fill in anything to read news, results and standings. We do count how many people view which pages, how long they read, how fast the page loads, how far they scroll and where they click. In the Netherlands we do this without a cookie and without knowing who you are. With your consent we also count what you search for on the site and which addresses don't exist. Not from the Netherlands? Then we only count you once you click Accept. Don't want to be counted in the Netherlands either? Turn it off under "Cookie settings" at the bottom of every page.

The cookie notice.
If you click "Accept", we set a cookie. That is a small file on your phone or computer. It helps us see better what works and lets us try out two versions of a page. We then also see where on a page people click, and for some of the visits we make a recording of what happens on the screen. What you type is not included. If you click "Reject", that is fine too. Everything keeps working as normal. Under 16? Then choose Reject.

Voting and tapping.
You can vote in a poll without an account. You can also tap the winner of a match. Your browser then gets a random code, so nobody can vote ten times. That code says nothing about who you are. Even if you are logged in, we don't know what you voted.

A short question.
Sometimes we ask something at the bottom of the screen, for example what score you give the site. Answering is not required and is done without a name. On your device we only remember which question you already got, so you don't see it over and over again.

An account is possible from age 16.
Want to comment, or make predictions for points? Then you need an account. That is possible from age 16. We only ask for your email address, a username and your year of birth. You log in with a 6-digit code that we email you. Other people only see your username, never your email address. You choose yourself whether your username appears in the predictions leaderboard.

Comments.
Every comment first passes through a simple filter. It looks for swear words and for details that don't belong there, such as a phone number. The filter can hold a comment back, but only a human removes anything.

Sending something in.
If you send a tip, a correction or a video, only we see what you send. Your name and email are not required. You can send a video as a link or upload it. We only put your name with a video if you tick that box. If someone under 16 is recognisable in a video, we don't publish it.

Buying something.
What happens in the shop is in the shop's privacy policy: ordering, paying and shipping, and what Meta, Google and Shopify see if you allow that in the shop's cookie notice. Want to undo a purchase with the "Withdraw from contract" button? That form runs via this platform. You immediately get an email confirming we received it (see 3.12).

How do we make the news?
For the news we use AI: Claude, from the company Anthropic. A few times a day Claude searches public sites for new korfball news and writes a first version. A human from the editorial team reads and approves every piece the AI writes. Only then does it go online. For the news we only give the AI public sources and sports data, no comments and no data from your account.

Who helps us?
We use a few companies for the technology. For example the place where the site runs, and the service that sends our emails. Most of these companies may only use your data for us. Some are American. Claude also helps us build and manage the site, and can access our database while doing so. Claude does not look at readers' data: that is a fixed agreement. Only when we look into a question about a withdrawal can Claude see that withdrawal.

We sell nothing of yours.
On korfbalinc.nl we don't sell your data, we don't show other people's advertising and we don't build a profile of you for advertising. For the shop: see the shop's privacy policy.

How long do we keep it?
No longer than necessary. Every night the site itself clears out what is too old. If you delete your account, we immediately remove your account, your comments and your predictions. They then remain in our backups for at most a week. We keep reports for up to 12 months after the decision, without a link to your account.

What are your rights?
You may always ask what data we hold about you. You may ask us to correct or remove something. Email info@korfbalinc.nl. You will get an answer within a month. Not satisfied? Then you can complain to the Autoriteit Persoonsgegevens. If you live in another country, you can also complain to the supervisory authority there.

Are you on the site yourself?
If you play in the Korfbal League, your name, club and statistics are on the site. That is sports news. We never add your age, address, phone number or email. We only name youth players if a source, such as a club or a newspaper, already named them. We don't publish photos of children under 16. Is something wrong? Click "Report an error".

Part 2. The full version

1. Who is responsible?

KORFBALINC. is the "controller". That means: we decide why and how your data is used, and we can be held accountable for it. That applies to both sites. Even when a form from the shop sends your data to korfbalinc.nl (see 3.12), we remain the same controller. What the shop does with your data is in the shop's privacy policy.

We have no data protection officer. For a small organisation like ours, one is not required.

2. A few terms explained

• Personal data: anything that says something about a person who can be identified. For example a name, an email address or an IP address (the internet address of your device).
• Legal basis: the law lists six reasons for which data may be used. We use four of them:
  • contract: we need the data to do what you ask, such as making your account work;
  • legal obligation: the law requires us, for example to send you a confirmation when you undo a purchase;
  • legitimate interest: we have a good reason, and it outweighs your privacy. For example securing the site. You may always object to this (see chapter 9);
  • consent: you said "yes" yourself, as with the cookie notice. You may always withdraw that consent.
• Processor: a company that does something with your data on our behalf, such as the place where the site runs.
• IP code: a code we make from your IP address, using a secret key. For submissions and reports, that key changes every day. Your IP address cannot be recovered from the code. We only use it to count how often something happens from one internet connection, and delete it after 24 hours.
• Journalism: the law gives room for news and sports reporting. Chapter 4 is about that.

3. Which data, for what and for how long

Every night the site itself deletes what has been kept longer than stated below. Where that is (still) done manually, it says so.

3.1 You visit the site

• What: your IP address, the type of browser and device, the time and the page you request. This is in the server's technical logs. Also the country of your visit (a country code, such as NL). If the site is behind an access code, such as before the launch, a cookie remembers that you entered the right code (see the cookie statement); the server only counts wrong attempts in its working memory.
• Why: to make the site work and keep it secure, and to prevent abuse, such as someone trying to retrieve all the data in one go.
• Legal basis: legitimate interest (a working, secure site).
• How long: the logs at Vercel, the place where the site runs, 1 day. If something goes wrong, such as an outage or a possible leak, we keep a copy of the part of the log we need, for at most 4 weeks, unless we need it for our register of data breaches.

3.2 Statistics without a cookie (only in the Netherlands)

• What and why: we count which pages are viewed, how visitors arrive (for example via Google or Instagram), with what type of device and browser, how long someone stays on a page, how fast the page loads and how far people scroll, and which links and buttons are clicked. For a click we only know where on the page it was (for example the menu or the results block) and where the link goes; for a link to another site, only the name of that site. This lets us improve the site. PostHog does this for us (PostHog EU, servers in Frankfurt). Nothing is placed on your device: PostHog makes a code from your IP address and browser that changes every day. We don't store your IP address itself. We don't send free text, such as what you type or searched for, and link nothing to an account. With your consent we also count what you search for on the site and which addresses don't exist.
• Legal basis: legitimate interest. We weighed our interest against your privacy and recorded that assessment.
• Opting out: turn off "Counting without cookie" in "Cookie settings" at the bottom of every page. You then object and we don't count you. If your browser sends a "do not track" signal (Global Privacy Control), we don't count you either.
• How long: at most about 12 months. After that we only keep totals.
• Not from the Netherlands? Then we only count you if you click Accept (see 3.3).

3.3 Statistics, tests, heatmaps and recordings with a cookie (only if you agree)

• What: if you click "Accept", PostHog sets a cookie for us with a random code. With it we see whether you come back, how you click through the site, and which version of a page or of the menu you saw when we try out two versions (an A/B test). Such a test runs two to four weeks, and we run at most three at the same time. PostHog derives from your IP address roughly where you are (city, postcode and a spot on the map); we don't store your IP address itself. Furthermore, if you also agree to Statistics (Accept does that):
  • Heatmaps: we see where on a page people click and how far they scroll, as one image per page for all visitors together.
  • Recordings: of about 1 in 10 visits PostHog makes a recording of what happens on the screen (which pages, where you click and scroll). Everything you type in a field is masked and not recorded; comments aren't either. We never record on your account pages, when logging in and signing up, submitting and reporting. We record no technical data from your browser (no console log and no network traffic).
  • We don't use it for advertising and never link it to your account.
• Legal basis: consent. You can also turn statistics and tests on or off separately in "Cookie settings". You can always withdraw via "Cookie settings" at the bottom of every page; we then let the cookie expire and record nothing more. Under 16? Then choose Reject.
• How long: the cookie 6 months; recordings 30 days; the other data at most about 12 months. More in the cookie statement.

3.4 Voting in a poll, and tapping the winner without an account

• What: your choice, the time, and a random code in a cookie in your browser (the vote code). We only set the cookie when you vote or tap, not when you open the page. We only store an encrypted version of that code (a "hash"). A vote is never linked to your account, not even if you are logged in.
• Tapping the winner: without an account you can tap the winner of a match once. It works just like voting, without points. After the match you see in your own browser whether you were right.
• Why: to count the votes and taps and to prevent double voting.
• Legal basis: legitimate interest.
• What others see: only the count, never who voted or tapped what.
• How long: the votes themselves as long as the poll is online; a tap counts permanently in the distribution. We delete the encrypted code 30 days after the poll closes, or 30 days after the match. The cookie in your browser disappears automatically 12 months after you last voted or tapped (see the cookie statement).

3.5 Your account

• Who: an account is possible from age 16. Because we only ask for your year of birth, it is only possible from the year in which you turn 17. See the age policy.
• What: your email address, your username, your year of birth, the tick box "I am 16 or older", the date you agreed to the house rules, and if you wish your favourite club. We also record: your role (reader, regular contributor or writer), a trust level set only by the editorial team, the status of your account, when you were last active, whether and when we emailed you that you had been inactive for almost 2 years, and your points and level in predictions.
• Logging in: with a 6-digit code that we send to your email address. There is no password and there is no login link in the email. A code is valid for 10 minutes, works only once, and stops working after 5 wrong attempts. We only store the code encrypted. During logging in and signing up we set two short cookies that expire after 10 minutes. After logging in we set a cookie that keeps you logged in. It lasts 90 days. Every time you visit, those 90 days start again.
• Preventing abuse when logging in: we count how often a code is requested, per email address and per internet connection. We only store this as an encrypted code and as an IP code, and delete it after 24 hours.
• The email with the code is sent by Brevo for us (see chapter 5). Brevo only counts per type of email how many emails are opened or clicked, not per person.
• Log out everywhere: your account has a button that logs you out on all your devices at once.
• Downloading your data: in your account you can download a file with your account data, your comments and your predictions.
• Why: to let you comment and make predictions, to enforce the age limit, and to prevent abuse.
• Counting: each week we count how many accounts did something, only as a total. That way we know how many people at least use the site.
• Legal basis: contract. You create an account and agree to the house rules. For the weekly count and preventing abuse: legitimate interest.
• What others see: only your username. If you choose the public leaderboard in predictions, also your points and level (see 3.8). Never your email address or your year of birth. Your favourite club is not public, unless you take part in your club's leaderboard yourself. Then your username appears in that club's leaderboard.
• How long:
  • as long as your account exists;
  • if you delete your account, we immediately remove your account, along with your comments and your predictions. Reports are kept, but no longer linked to your account: a report you made, with your username and email address, and a report about a comment of yours, with a copy of that comment. We delete those 12 months after the decision (see 3.7). Tips, corrections and videos are not tied to your account; the periods in 3.9 apply to them. After that it remains in our backups for at most 7 days; we only use those copies to restore the site after an outage. If we have to restore a backup, we immediately delete your account again;
  • if you are inactive for 2 years (you didn't visit while logged in during that time, and didn't log in either), we delete your account. You get one email about it a month beforehand;
  • if we block an account, it remains as long as the block lasts, even if you are inactive for 2 years. If you delete a blocked account, we only keep your email address in encrypted form, for as long as the block lasts plus 12 months. This prevents someone from immediately creating a new account. With a permanent block, that encrypted form remains as long as the block applies. We review such a block after 5 years. If it is no longer needed, we remove it, and that encrypted form too.

3.6 Comments

• What: the text, your username, the time, under which piece, and the status (awaiting review, visible, hidden, not published, removed). If the filter holds a comment back, we keep what the filter found. If we remove a comment, we keep the reason, the house rule, who decided and the explanation we sent you.
• How we keep an eye on things:
  • the editorial team reviews your first comment first;
  • after that a comment goes online directly, but first it passes through a filter on our own server. That filter looks for swear words, phone numbers, email addresses, addresses and more than one link (that may be advertising). We don't use an AI service for this: comments don't go to another company;
  • the filter never decides on its own that a comment disappears. At most it can hold a comment back until a human looks at it;
  • between 23:00 and 07:00 every comment awaits review;
  • you can post at most 30 comments a day, and one per 20 seconds.
• Why: a safe, pleasant place to talk about korfball.
• Legal basis: contract (the house rules) and legitimate interest (a safe environment). For reports and the explanation when removing: legal obligation (the European Digital Services Act).
• How long:
  • visible comments as long as the piece is online, or until you delete your account;
  • removed and unpublished comments and the decision about them 12 months after the decision. This is needed if you object, and to recognise repeated abuse;
  • if we are obliged to give something to the police, we keep it as long as that investigation requires.

3.7 Reporting something (the report button)

• What: which comment you report, a copy of the text, why, whether it is urgent, and your name and email address. If you are logged in, we take these from your account. If you report sexual content involving children without logging in, you don't have to give your name and email address. Without an email address we can't send you a confirmation or the outcome.
• Preventing abuse: you can make at most 10 reports per 24 hours. If you report without an account, we count this with an IP code, which we delete after 24 hours. With an account we count per account.
• Why: to handle the report properly. If you gave an email address, you get a confirmation and then the outcome.
• Urgent: an urgent report goes directly by email to the editorial team. That email only contains the type of report, under which piece and when. Not the text of the comment, and not your name or email address.
• Legal basis: legal obligation (Digital Services Act) and legitimate interest (preventing abuse).
• What the writer hears: we don't tell the writer who reported it.
• How long: 12 months after the decision. A report that is still open remains until it has been handled.

3.8 Predictions, points and levels

• What: your prediction per match, your points, your level, your highest level this season, your place in the leaderboard, your choices for the public leaderboard and your club's leaderboard, and whether the editorial team removed you from the leaderboard (see the house rules, chapters 4 and 9).
• Legal basis: contract.
• What others see: you choose that yourself. With your first prediction you choose: "Show my username in the leaderboard" or "Rather not". Nothing is switched on in advance. If you choose the leaderboard, others see your username, points and level in the leaderboards, and possibly in the block "De voorspellers" in Het Weekend. If you choose "Rather not", you still get points and a level, and only you see your position. You can always change your choice, in your account.
• Your club's leaderboard: only if you switch it on yourself in your account ("Yes, I take part in my club's leaderboard"). Nothing is switched on in advance. Others then see which club you chose as your favourite. A club leaderboard only appears once at least 5 people take part.
• What others never see: what you predicted for a match. Others only see how all predictors chose together, for example "62% think KZ".
• Prizes: there are no prizes to be won.
• How long: as long as your account exists.

3.9 Sending something in: tips, corrections, club news and videos

• What: your message, a link to a video or the video file itself, the page you came from, and what it is about. Not required: your name, email address, club and role (player, coach, board). We don't link your submission to your account, not even if you are logged in.
• Videos: you can submit a video from age 16; younger via a parent. You send a link or upload the file (mp4, mov or webm, up to 50 MB). An uploaded file goes directly from your browser to protected storage at Supabase in Frankfurt; in doing so Supabase, as our processor, sees your IP address and the type of browser. Only the editorial team can view the file. You agree to short terms shown with the form: you made the video yourself or the maker agrees; nobody under 16 is recognisable in the footage; we may show it on the site and on social media, and shorten it; and we remove it if you or the maker asks. We only add a name if you tick "Credit my name with the video". If you don't tick it, we don't name anyone and you waive attribution (article 25 of the Auteurswet). When a video comes in, the editorial team gets an email with the type (link or file), the club if you filled it in and a link to the admin area; your name, your email address and the file are not in it.
• Report an error: for this we ask for no name and no email address. If it concerns something that doesn't work on the site, we include the type of device and browser (such as "iPhone" and "Safari"). You see these in the form and can change them.
• Preventing spam: we don't use another company's service. The form has a hidden field that only computer programs fill in, and a form sent within 2 seconds doesn't count. You can also submit at most 20 times a day from one internet connection. We count this with an IP code, which we delete after 24 hours. We don't keep spam.
• Why: to make news, fix errors, and be able to ask you something about your message.
• Legal basis: legitimate interest, and the room the law gives for journalism.
• What others see: nothing automatically. The editorial team reviews everything first. If we use your tip, we don't name you unless you want us to. If we publish your video, a name only appears with it if you ticked that box.
• How long:
  • your name, email address, club and role 6 months after we have handled your message;
  • your message itself as long as we need it for our work, at most 2 years after handling. If it led to an article, we keep it as a source with that article;
  • an uploaded video: if we reject it, we remove the file immediately; if we don't use it, after 90 days; if we do use it, at most 2 years, or earlier if you or the maker asks. An upload whose form was not completed disappears within 48 hours. If we remove your submission, the file goes with it immediately.

3.10 You email us

• What: your email address, your name and what you write.
• Where: in the info@korfbalinc.nl mailbox, at Zoho Mail of Zoho Corporation B.V. (the Netherlands), in a data centre in the European Union.
• Legal basis: legitimate interest, or contract if it concerns an order.
• How long: 2 years. If it concerns an order, a refund or a withdrawal, it is part of our records and we keep it for 7 years. Once a year, in January, we clear out the email we no longer need to keep.

3.11 Rights complaints

Do you think we are using something of yours without permission, such as a photo, a text or a logo? Then you can report it (see the Rights complaints page).

• What: your name, email address, possibly your organisation, which content it concerns and why.
• Legal basis: legitimate interest and legal obligation.
• How long: 2 years after handling. We keep a list of all complaints.

3.12 Undoing a purchase in the shop (withdrawal)

What happens in the shop, such as ordering, paying, shipping and returns, is in the shop's privacy policy. One thing from the shop runs via this platform: the "Withdraw from contract" button. With it you undo a purchase. This is how it works:

• The route: the form is on korfbalinc.shop, but first sends what you fill in to our platform korfbalinc.nl. That platform is also ours: your data stays with the same controller. The platform runs at Vercel in Frankfurt and stores your withdrawal in our database at Supabase in Frankfurt. After that the form also goes via Shopify to our mailbox, as extra assurance.
• The confirmation: the platform records the time we received your withdrawal, gives it a reference (such as H-2026-7K3M), and immediately sends you a confirmation by email via Brevo, from site@post.korfbalinc.nl. That email states what you filled in and the date and time. After that we get a notification in info@korfbalinc.nl.
• What we keep: your name, your email address, your order number, which products (empty means the whole order), the time of receipt, the reference, and whether the two emails (to you and to us) were sent.
• Against abuse: this is possible at most 5 times per hour per internet connection, and 3 times per 24 hours per email address. To count this, the server makes a fingerprint from your IP address. It is only briefly in the server's working memory and never goes into our database. We only count attempts from the past hour. We don't store your IP address with your withdrawal.
• In your browser: until the confirmation screen appears, what you filled in is briefly in your browser's session storage. That way the confirmation screen can show it. After that the shop deletes it immediately, and otherwise it disappears when you close the tab. It doesn't go to us (see the cookie statement).
• Legal basis: sending the confirmation is a legal obligation (article 6:230oa paragraph 4 of the Burgerlijk Wetboek). Keeping your withdrawal as evidence, in case a question or dispute arises later: legitimate interest. Refunding and the records of it: contract and legal obligation.
• How long:
  • your withdrawal on the platform 2 years after receipt, as evidence. After that the site deletes it automatically;
  • what goes into our records with a withdrawal, such as the refund and the notifications in info@korfbalinc.nl: 7 years, because the Belastingdienst requires it.
• Sending back: how to send something back and what it costs is in the shop's terms.

3.13 Error reports and availability

• Error reports (Sentry): your browser only sends something to Sentry if there is an error. We then get a technical report: the page (without what comes after the question mark), the browser with its language and time zone settings, the error message, and the last steps just before the error, such as which pages you opened and what you clicked. In addition, about 1 in 20 times our server builds a page, it measures how fast that went. Only the page and the type of browser are included. Before the report is sent, we remove your IP address, cookies, login details and what you typed in a form, and email addresses and IP addresses in the error message are replaced by "[weg]". Sentry's own filters and "Enhanced Privacy" are also switched on. The reports are stored in Frankfurt. We make no recordings of your screen.
• Availability (Better Stack): checks every few minutes whether the site and the shop are reachable. No visitor data is used for this.
• Legal basis: legitimate interest (a working site).
• How long: error reports 30 days. After that, even we can no longer view them.

3.14 A short survey

• What: a few times a year we ask readers how often they visit and on which devices. This can be via a form on the site or an Instagram story. The form is anonymous. We ask for no email address and no name.
• Instagram: if you vote via a story, we only use the totals. We don't look at or keep who chose what. Instagram does show the creator of a story who chose what; we don't look at that list.
• Why: to check whether our visitor figures are correct.
• Legal basis: legitimate interest. Taking part is voluntary.
• How long: the answers 12 months. After that only totals.

3.15 A short question on the site

• What: sometimes a single short question appears at the bottom of the screen: a score for the site, whether you find what you are looking for, or what you still miss. We keep your answer, the page on which you answered (without what comes after the question mark in the address), which version of an A/B test you saw if you took part in one, and the time. No name, no email address, no account and no IP address; the site itself removes email addresses and phone numbers in an open answer. To prevent abuse the server only counts in its working memory how often answers come from one internet connection, with a code that expires after just over an hour.
• On your device: we remember which question you already got and when, so you don't keep seeing the same question (see the cookie statement). Nothing goes to PostHog.
• Why: to hear what readers think of the site and to improve it.
• Legal basis: legitimate interest. Answering is voluntary; with "No, thanks" or the cross you close the question.
• How long: the answers 1 year; after that the site removes them automatically.

3.16 The questionnaire about the site and the prize draw

• What: between 17 October and 1 November 2026 you can fill in a questionnaire about the site. We keep your answers and the time. No name, no email address, no account and no IP address; the site itself removes email addresses and phone numbers in an open answer. To prevent abuse the server only counts in its working memory how often something comes in from one internet connection, with a code that expires after just over an hour.
• Prize draw: if you then enter the draw for € 100 in shop credit, we keep your email address, the day you entered (no time) and whether you were drawn. This is kept separately from your answers and cannot be linked to them. We only email the winner.
• On your device: we remember whether you already got the invitation to take part and what you chose, so it appears at most twice (see the cookie statement). If you accept cookies for measuring, PostHog only counts that the question appeared and what you chose, never your answers.
• Why: to improve the site with what readers themselves say, and to run the prize draw.
• Legal basis: for the answers legitimate interest (filling in is voluntary); for your email address the performance of the promotion terms you agree to.
• How long: the answers 1 year; the email addresses no later than a month after the draw, and in any case gone on 2 December 2026.

4. People in our news and in our sports data

KORFBALINC is a news site about korfball. That is why people's names appear on it: players, coaches, staff, referees, board members and clubs.

• What we show: name, club, team, role, matches, goals and other statistics, transfers, and what a source writes about someone. At launch, player pages only exist for players from the Korfbal League.
• Where it comes from: the federation's official match data, the Korfbal League website, the commentary on livestreams, clubs' websites and social media, other media, and submissions.
• What we never do:
  • we don't show or store the age, date of birth or place of residence of players;
  • we don't show phone numbers or email addresses of people or clubs;
  • for youth matches we don't store or show referees' names. For matches in the top senior competitions we do show the referees by name, as the source names them;
  • we only name youth players if a source already did so;
  • we don't publish photos or videos in which children under 16 are recognisable.
• How we work: we use AI to find and write news: Claude, from the company Anthropic (see chapter 5).
  • A few times a day Claude, as a scheduled task, searches public sites for new korfball news, such as the websites of clubs, the federation, the Korfbal League and other media.
  • Figures, such as results, standings and goals, are calculated by a computer program from the official data. It then checks the figures stated in a piece.
  • Claude writes a first version (a draft). That draft goes into our review queue, and the editorial team gets an email about it. The AI cannot put anything online itself.
  • A human from the editorial team reads every draft and approves it, or sends it back. Only after that approval does it go online, under the responsibility of the editorial team.
  • For the news we only give the AI public sources and sports data, such as matches, standings, players and earlier pieces. We give the AI no comments and no data from readers or customers. The scheduled task can only read the database; which sports data it requests is fixed in its instructions.
  • Pieces that the site makes from figures only, without text from the AI, go online automatically. For example results, standings and a weekend overview with only figures.
• Legal basis: the law gives room for journalism (article 43 of the Uitvoeringswet AVG). As a result, a number of privacy rules don't apply, or apply less strictly. In addition: legitimate interest.
• Your request: we correct an error as quickly as possible, within 24 hours at the latest, with a correction line below the piece. If you want something removed, we assess case by case whether the news interest outweighs your interest. That also applies to referees, coaches and others who appear on the site. If it concerns a minor, that weighs extra heavily for us. If it concerns your own child under 16, we remove it as quickly as possible, within 48 hours at the latest, and you don't have to explain why (see the age policy). Email info@korfbalinc.nl, or use "Report an error".

5. Who we share data with

Most of the companies below help us make the platform work. They may only use your data for us, and not for themselves. One exception: for what we do with our Claude subscription (see Anthropic below), Anthropic's terms and privacy policy apply, and Anthropic itself is responsible for that. We are responsible for what we show Claude. Who gets which data when you view or order something in the shop is in the shop's privacy policy.

Better Stack, which checks whether the sites are reachable, receives no data from visitors or customers.

Sometimes we have to give data to others:

• to the police or judicial authorities, if the law requires us to, or if someone threatens another person in a comment;
• to the Belastingdienst, for our records.

6. Data outside Europe

Some of our suppliers are American. Your data may then sometimes be in the United States, or an American company may have access to it. The law allows this if there are proper arrangements: a decision of the European Commission that a country offers adequate protection (such as the EU-US Data Privacy Framework for participating companies, or the decision for the United Kingdom), or model contracts approved by the Commission (standard contractual clauses).

You can get a copy of the arrangements via info@korfbalinc.nl.

There is a court case about the Data Privacy Framework at the Court of Justice. That is why, where possible, we choose storage in Europe, and we keep a list of all our suppliers so we can switch quickly.

7. What we don't do

• On korfbalinc.nl we don't sell your data.
• On korfbalinc.nl we don't show other people's advertising and don't use advertising cookies.
• We don't build a profile of you for advertising.
• A computer doesn't make decisions about you that have major consequences for you. The comment filter at most holds a comment back; a human decides. The AI only writes drafts of news; a human approves them.
• For the shop: see the shop's privacy policy.

8. Security

• All connections to our sites are encrypted (https).
• For our accounts with suppliers we use strong, unique passwords. Secret keys are only kept in protected settings, never in the code.
• Readers don't have a password with us. They log in with a 6-digit code by email. So there is no password to steal. Codes, sessions and IP codes are only stored encrypted in the database.
• Only the editorial team can access the data, and only what is necessary. Claude helps the editorial team with this and can technically access the database, but under a fixed agreement does not look at readers' data (see chapter 5). The scheduled task that searches for news can only read the database and cannot change anything; which sports data it requests is fixed in its instructions.
• We make a backup of the platform's database every day (kept for 7 days).
• We ask for as little data as possible.
• If something does go wrong, we follow our data breach plan. If there is a risk to you, we report it to the Autoriteit Persoonsgegevens within 72 hours. If there is a high risk, we let you know too.

9. Your rights

You have these rights:

• Access: ask what data we hold about you.
• Rectification: have something corrected that is wrong.
• Erasure: have your data removed. You delete your account yourself with one button in your account. Sometimes removal is not allowed straight away, for example for invoices we have to keep for 7 years.
• Restriction: ask us to stop using your data for a while, for example while we check whether something is correct.
• Objection: object when we use your data on the basis of legitimate interest. For example to the statistics without a cookie. The quickest way is the "Counting without cookie" switch in "Cookie settings" at the bottom of every page: turn it off, and we no longer count you. Emailing is also fine.
• Portability: receive your data in a file you can use elsewhere. With an account you can download that file yourself.
• Withdrawing consent: for example for the cookie, via "Cookie settings". For email from the shop: with the unsubscribe link at the bottom of the email.

How: email info@korfbalinc.nl, preferably from the email address of your account or order. Sometimes we ask you to show that it is really you. You will get an answer within a month. If your request is complicated, it may take two months longer; we will then let you know within a month. It costs nothing.

Complaints: not satisfied with how we handle your data? Let us know first. You may also always complain to the supervisory authority:

• in the Netherlands: the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl);
• in Belgium: the Gegevensbeschermingsautoriteit (gegevensbeschermingsautoriteit.be);
• in another country of the European Union: the supervisory authority in that country.

10. Young people

• Anyone can read and vote, without an account.
• An account is possible from age 16.
• We don't publish photos and videos with recognisable children under 16.
• Parents can always email us to have an account or a video involving their child removed.

Everything about this is in the age policy.

11. Cookies

Which cookies we use and how to change your choice is in the cookie statement.

12. Changes

If we change something important in this statement, we put it at the top of this page, with the date and the number of the new version. Earlier versions remain available to read. If you have an account, you will get an email about a major change.