Personal data
Purpose
Section titled “Purpose”Know who is responsible for the players’ data, what must be in place before the first player signs up, and how long the system keeps the information.
This page is guidance, not legal advice.
| Who | Role | Means |
|---|---|---|
| Your association | Data controller | You decide which information you collect and why. You own the privacy policy and answer players when they ask about their data. |
| Legendernes Verden | Data processor | We run the installation for you and process data only on your instructions. |
| Our suppliers (for example hosting and e-mail) and yours (for example Vipps MobilePay, Wix) | Sub-processors | Listed in the data processing agreement and in your privacy policy. |
Before the first sign-up
Section titled “Before the first sign-up”- Data processing agreement between your association and Legendernes Verden. We send a draft.
- Privacy policy, participant terms and — if you sell tickets — terms of sale. The system has templates for all three (see below).
- Master data under The organisation: name, address, CVR number and contact e-mail. They are inserted into the templates.
The templates for terms
Section titled “The templates for terms”Under the ticket pages (the Terms tab, Vilkår) you write and publish your participant terms, terms of sale and privacy policy. Each publication is a new version; a published version never changes. When buying, the buyer accepts the current versions of the participant terms and terms of sale, and the acceptance is stored with the version. Players can read them at /vilkaar/privatlivspolitik, /vilkaar/handelsbetingelser and /vilkaar/deltagervilkaar.
The templates are anonymised starting points built on Legendernes Verden’s terms (in Danish). Read them through and adapt them to your situation — for example which suppliers you use, and your rules for cancellation and refunds. Sales cannot open until the terms of sale have a completed section on cancellation and refunds.
Retention and deletion
Section titled “Retention and deletion”The system anonymises old information by itself every night. The rows are kept, but fields that can be linked to a person are emptied. On a new installation this is on from the start; the page Ticket core → Retention (Billetkerne → Opbevaring) shows the state and a dry run with counts. The defaults are the same on all installations:
| Information | Anonymised or deleted | Kept |
|---|---|---|
| Orders and payments | 5 years after the end of the financial year they belong to (Danish Bookkeeping Act) | Amounts, lines, types, dates and references |
| Ticket holders and check-ins (name, e-mail) | 2 years after the event | The ticket and that it was used |
| Dietary information from meal sign-ups | 3 months after the event | The sign-up itself |
| Form submissions on the website | 12 months after submission | — |
| Sensitive answers in forms | 30 days after the event (without an event: 90 days after submission) | — |
The periods can only be shortened, never extended: the ticket periods on the page Ticket core → Retention, the sensitive form answers per form. If you set the orders’ period below 5 years, complying with the Bookkeeping Act is your responsibility.
Common mistakes
Section titled “Common mistakes”- The privacy policy does not mention your suppliers. Write them in (the template has a placeholder).
- Personal data in templates or screenshots. Templates never contain personal data. Do not share screenshots with real players’ data outside the association.
- Players ask for access or deletion. That is your task as data controller; contact us if you need help finding or deleting data.