Privacy Policy

Controllers

The following five companies operate this website together and are joint controllers for the processing described here within the meaning of Art. 26 GDPR.

Contact point under Art. 26 (1) GDPR

Contact point for exercising data subject rights: hello@the-league.eu. Enquiries are forwarded from there to the responsible company.

Irrespective of the internal allocation, data subjects may exercise their rights under the GDPR against each and every one of the controllers named above.

Arrangement on joint controllership

Each of the companies named above is primarily responsible for enquiries and processing that concern itself. A detailed written arrangement between the five companies is in preparation.

Hosting and server log files

When the website is accessed, technically necessary connection data are processed so that the pages can be delivered.

Our hosting provider is Lovable (lovable.dev), which also delivers this website. Lovable processes technically necessary connection data on our behalf. Details on server location and subprocessors used are available in the Lovable Trust Center (trust.lovable.dev); we will add them here once confirmed by Lovable.

Reach measurement – first party, anonymous, without cookies

We measure how often our pages are viewed, using our own system on our own infrastructure. No third-party tool is involved. For every page view we store only: the requested path, the host name of the referring website (never the full referring URL), a two-letter country code if our hosting provider supplies one, a device class (mobile, tablet, desktop) and the browser family.

We do not store IP addresses, we do not set cookies, we do not use localStorage and we do not create any identifier, session id or fingerprint. Two visits cannot be linked to each other and no record can be traced back to a person. Because the data are anonymous from the moment they are collected, no consent is required and there is no consent banner.

The legal basis is our legitimate interest in reach measurement (Art. 6(1)(f) GDPR). The aggregated, non-personal access figures are kept for no longer than 14 months.

Contact form

The details entered in the contact form (name, email address, optionally company, message) are stored in our database at Supabase and additionally sent to us by email via the delivery service Resend so that we can answer the enquiry. Both services process the data on our behalf.

Supabase and Resend are each covered by the provider's standard data processing agreement (Supabase: supabase.com/legal/dpa; Resend: certified under the EU-US Data Privacy Framework). Enquiry data is deleted once the enquiry has been resolved, and no later than after 24 months, unless a statutory retention obligation applies.

Sign-in to the administration area

The administration area is not public and is accessible only to a defined group of people. Email address and sign-in time are processed for authentication. This processing does not concern visitors to the website.

Transfers to third countries

One of the joint controllers, KIDS INDUSTRIES (UK) LIMITED, is established in the United Kingdom. An adequacy decision of the European Commission is in place for the United Kingdom.

Based on the current assessment, a representative under Art. 27 GDPR is not strictly required in this configuration; a final legal determination is still pending.

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. You may exercise these rights against any of the controllers named above. You also have the right to lodge a complaint with a data protection supervisory authority.

Because five independent controllers in five different countries are involved, there is no single lead supervisory authority for this joint processing. You may contact the national data protection supervisory authority responsible for you.