Privacy Policy

Last updated: [TO COMPLETE: date] · Version: draft 1.0

This Privacy Policy explains how Otimo AS (company registration number 915790526), Loddefjordveien 14, 5171 Bergen, Norway, processes personal data when you use the BBall app and the website bball.com (the “Service”). Otimo AS is the data controller for this data.

In short: BBall is ad-free. We never sell your personal data, and we do not share it with advertisers or data brokers. We only collect what the app and the store need to work. You can ask for access, correction or deletion at any time.

This is a structural draft, not finished legal text. Every [TO COMPLETE] marker must be filled with real information, and a Norwegian data-protection lawyer should review this document before it goes live — the app processes health/behavioural data about users who are often minors.

1. Contact

Data controller: Otimo AS. For privacy questions contact geir@otimo.no or contact@bball.no, phone +47 473 20 258.

Data Protection Officer: [TO COMPLETE: name a DPO if appointed, otherwise state “not appointed — not legally required for our operations”]. Large-scale processing of health/behavioural data and data about children may trigger a DPO requirement under GDPR Art. 37 — this should be assessed specifically.

2. What data we process

2.1 Data you provide in the app

Category	Examples	Purpose
Account data	Name, email, phone number, profile	Create and manage your account
Team & activity	Team membership, practices, attendance, matches, events	Core app functionality
Health & wellbeing	Injuries, sleep, motivation, fatigue	Tracking you record yourself
Communication	Chat messages with team / coaches	In-app messaging
Shared content (premium)	Documents, images, video in library	Team sharing for premium users

Special category — injury data. Data about injuries may be health data and is treated as a “special category” under GDPR Art. 9. This requires an explicit legal basis — normally your explicit consent (or a guardian's consent for minors). [TO COMPLETE: confirm consent is the chosen basis and that the app collects this consent explicitly when injury data is recorded.]

2.2 Data we collect automatically

Technical device data: IP address, browser type, time zone, and device/app identifiers.
Usage data: how you use the app and website, for troubleshooting and improvement.

We do not track you across other apps or websites for advertising.

2.3 Data in the online store

When you buy products in the BBall store we process:

Order and delivery data: name, address, email, phone, order history.
Payment data: handled by our payment provider. [TO COMPLETE: state which provider(s) you enable, e.g. Stripe / Klarna.] We do not store full card numbers ourselves.

3. Legal basis (GDPR Art. 6 and 9)

Processing	Legal basis
Create and run your account	Contract (Art. 6(1)(b))
Core features: teams, practices, attendance	Contract (Art. 6(1)(b))
Injury / health data	Explicit consent (Art. 9(2)(a))
Sleep, motivation, fatigue	Consent (Art. 6(1)(a))
Store — orders and payment	Contract (Art. 6(1)(b)) / legal obligation (accounting)
Security and troubleshooting	Legitimate interest (Art. 6(1)(f))

4. Processors and sharing

We never sell data. We use a few providers that process data on our behalf (processors), under a data processing agreement:

Provider	Role	Location / transfer
Google (Firebase Authentication)	Login / authentication	USA — see section 5
Hostinger	Website / store platform	[TO COMPLETE: hosting location]
Payment provider	Store payments	[TO COMPLETE]
[Other Firebase services]	Database, messaging, storage if used	[TO COMPLETE]

This list must reflect what the app actually uses. Confirmed: Firebase Authentication (USA). [TO COMPLETE: list every Firebase service and other third party that processes personal data — e.g. Firestore, Cloud Storage, Cloud Messaging (push), Crashlytics, analytics.]

5. Transfers outside the EEA

Firebase Authentication runs from data centres in the USA, so login data is processed in the United States. The transfer relies on the EU Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework. Google acts as processor and Otimo AS as controller. [TO COMPLETE: confirm the chosen transfer mechanism and that a data processing agreement with Google is in place.]

6. Retention

Account data: deleted when you close your account, at the latest [TO COMPLETE: number] months later.
Injury / health data: [TO COMPLETE: retention period — should be short and consent-driven]
Order and payment data: kept for 5 years to comply with the Norwegian Bookkeeping Act.
Chat messages: [TO COMPLETE: retention period]

7. Children and young people

Many users are minors. BBall is used by young athletes. In Norway the digital age of consent is 13; in several EU countries it is up to 16. For users below the age of consent, a guardian's consent is required.

[TO COMPLETE: describe how the app handles age — age gate at sign-up, how guardian consent is obtained and verified, and how injury data for minors is handled.]

8. Your rights

You have the right to access, correction, deletion, restriction, data portability, and to object to processing. Where processing is based on consent, you can withdraw it at any time. Contact geir@otimo.no to exercise your rights. To delete your account, see our Delete Account page.

You may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no, if you believe the processing breaches the rules.

9. Security

We use technical and organisational measures to protect your data, including encryption in transit (HTTPS) and access controls. No transmission over the internet can be guaranteed 100% secure, but we work to protect your data.

10. Cookies

[TO COMPLETE: describe which cookies — strictly necessary vs. analytics/statistics, and whether a consent banner is used.] Because the brand is ad-free, cookieless or consent-based analytics is recommended, so that tracking matches the message.

11. Changes

We may update this policy. For material changes we will notify you in the app or on the website and update the “last updated” date above.

← Back to the portal

PRIVACYPOLICY