Privacy Policy

Effective from 4 October 2026.

This privacy policy explains how SIA “Kidshockey.lv” processes personal data on the website kidshockey.lv (the Website) when receiving applications for training sessions and camps, and in related communication. We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Latvian Personal Data Processing Law.

1. Controller

For any questions about the processing of personal data, write to us or call us.

2. What data we process

• Application data about the child: first and last name, year of birth, the team the child plays for (if given), and the selected training or camp dates.
• Data about the parent or legal guardian: name, phone number and email address (if given).
• Record of consent: the fact and time of consent, the version of the privacy policy, and your choice about receiving news.
• Technical data: IP address, browser information (user agent), the time the application was sent and the page it was sent from.
• Communication data: our correspondence and conversations with you about the application and the child’s participation.
• Participation and payment data: application status, confirmation of participation, payer details and invoice information if an invoice is issued.
• Server logs: standard access records (IP address, requested page, time) for security purposes.
• Cookies: see the Cookie Policy.

The application form does not ask for the child’s health data or other special categories of personal data. Please do not enter such data in the form fields.

3. Children’s data

An application for a child is submitted by the child’s parent or legal guardian, who confirms this in the application form. We process children’s personal data only to the extent necessary to organise the child’s participation. The Website is not intended for children to submit applications themselves. If we learn that an application was submitted by a child without the parents’ knowledge, we will delete the data.

4. Purposes and legal basis

• Reviewing the application, contacting you about it and organising the child’s participation in training sessions and camps – your consent (Article 6(1)(a) GDPR) and steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Keeping applications and the child’s participation history (which camps and training sessions the child attended) – your consent (Article 6(1)(a) GDPR).
• Keeping participation records (which child attended which camps and training sessions, payments) so that we can confirm participation and defend our rights in a possible dispute – our legitimate interest (Article 6(1)(f) GDPR).
• Information about upcoming camps and training sessions (by phone, SMS, WhatsApp or email) – only if you have ticked this separately in the application form (Article 6(1)(a) GDPR). This consent is optional and can be withdrawn at any time.
• Invoicing and accounting – performance of a contract and compliance with our legal obligations (Article 6(1)(b) and (c) GDPR).
• Security of the Website and the application form (spam protection, server logs) – our legitimate interest in keeping the Website running and protecting it from misuse (Article 6(1)(f) GDPR).
• Photos and videos from training sessions and camps – see section 5.

5. Photos and videos

We take photos and videos at training sessions and camps to show the school’s work. Photos and videos are published in the “Media” section of the Website and on our Facebook and YouTube accounts; children may be recognisable in them. The legal basis is our legitimate interest in informing about the school’s activities (Article 6(1)(f) GDPR). If you do not want your child to appear in published material, let us know and we will remove the relevant photos and videos from the Website and our accounts.

6. Recipients of data

Only the school’s management and coaches who need the data to handle applications and organise the child’s participation have access to it. We also use the following service providers:

• Telegram – notifications about new applications in the school’s work group; a notification contains the application data;
• Hetzner Online GmbH – servers in the European Union on which the Website runs and applications are stored;
• Cloudflare – content delivery network, Website security and protection of forms against bots (Turnstile);
• Google – storage of backups (Google Drive), and the Google Maps map and YouTube videos if you load them;
• other IT service providers that help us maintain the Website and its software.

We disclose data to public authorities only where required by law. We do not sell data or use it for advertising profiling.

7. Transfers outside the EEA

• Cloudflare and Google may also process data in the United States; such transfers are based on the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the European Commission.
• Telegram processes data outside the EEA, in a country for which the European Commission has not adopted an adequacy decision, and no additional safeguards (such as standard contractual clauses) are applied. This means that the level of protection of your data may be lower than in the EU. This transfer is based on your explicit consent (Article 49(1)(a) GDPR), which you give when submitting the application. We include in the notification only the information necessary to process the application.

8. Retention periods

• applications and participation history – for as long as your consent is valid, but no longer than 10 years after the last application or the child’s last participation in our training sessions or camps (each new application or participation restarts this period). The period corresponds to the general 10-year limitation period for claims under the Latvian Civil Law;
• consent to receive news – until it is withdrawn or the application data is deleted;
• Telegram notifications – as long as the applications; when we delete data at your request, we also delete the related notification;
• invoices and accounting records – for the period required by law (usually 5 years);
• server logs – up to 5 days;
• backups – up to 7 days: deleted data automatically disappears from the backups within this period;
• photos and videos – for as long as they are relevant to show the school’s work, or until you object;
• cookies – see the Cookie Policy.

9. Your rights

You have the right to request access to your own and your child’s data, to have inaccurate data corrected, to request erasure, restriction of processing and data portability, and to object to processing based on legitimate interest (for example, the publication of photos). You can withdraw your consent at any time by writing to [email protected] or calling +371 20 277 709; this does not affect the lawfulness of processing before the withdrawal. After you withdraw consent, we will delete the application data, except data we must keep by law (such as invoices) and participation records needed to defend our rights (Article 17(3)(e) GDPR), which we keep until the end of the period stated in section 8.

We respond to requests within one month at the latest. To protect your data, we may ask you to confirm your identity. If you believe your rights have been violated, you can lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv).

10. Provision of data and automated decisions

Providing data in the application form is voluntary, but without the required fields and consent we cannot accept the application. We do not carry out automated decision-making or profiling.

11. Changes

The current version of this policy is always available on the Website. In the event of significant changes, we will update the effective date at the top of the page. Each application stores the version of the policy you agreed to.