Privacy policy, version 1.2

What we store about you and your child, why we have it, how long it stays and what you can ask us to do.

This version takes effect on 3 December 2026. Until then, version 1.1 applies. Read version 1.1

On this page

This is a translation for your information. The Swedish version applies.

Version 1.2. In effect from 3 December 2026. Version 1.1 was in effect from 30 October 2026. Version 1.0 was in effect from 14 September 2026.

Changed in version 1.2: the club management system. Clubs can use Playsa for their member register and for enrolment, fees and invoices, attendance, check-in and invitations. We then handle the data on the club's behalf. Your account with us and the club's register are kept apart, and they are connected only if you approve it yourself. Also new are attendance notices, the calendar in your phone and the interest list. Read more in sections 1, 3 and 4 a to 4 j. The part for children in section 5 says what the child notices. What does not exist yet is no longer included: login with BankID, SMS, notifications in an app and payment through Playsa, and the suppliers for them. Before any of that comes, we update the policy and let you know.

The essentials in half a minute

  • You can search without an account.
  • The account is free. You need it to book a trial session, put your child in a queue, see the place in the queue and enrol your child with a club.
  • In your account we store the child's first name and year of birth. Not the personal identity number.
  • We never sell data. We show no advertising. We do not profile children.
  • Children under 13 never have their own login. The account is yours.
  • If your club uses Playsa for its register, its attendance, its invitations or its invoices, we handle the data on the club's behalf. Your account is connected to the club only if you approve it.
  • You choose yourself which notices you get about your child.
  • You can ask us for a copy of your data, or ask us to delete it, whenever you want.

1. Who is responsible for your data?

Hodla AB is responsible for the search site, your account and what you choose in the account. That also covers the bookings, queue registrations and enrolments you make with us until they have been sent to the organiser, and the calendar feed and the interest list. Hodla AB, which is changing its name to Playsa AB, corporate identity number 559427-7252, Malmö. Email: hej@playsa.se. Questions about personal data can also be sent to dataskydd@playsa.se, which goes to the same mailbox. Postal address: Vimpelgatan 1, 211 14 Malmö.

The organiser, that is the club, the municipal arts school or the company, is responsible for its own members and participants. If the organiser uses Playsa as its club management system, we handle the data on the organiser's behalf. Then the organiser's privacy policy applies, and it is the organiser you contact. This covers:

  • the organiser's register of members, participants, guardians and leaders, including what the organiser has added from a file,
  • your enrolment once you have sent it, with your answers and consents,
  • the fees, the invoices, the payments and the basis for them,
  • the attendance, the check-ins and the basis for grants,
  • the status of the leaders' criminal record extracts,
  • invitations, email to groups and attendance notices.

When you book a trial session, put your child in a queue or enrol your child, we send it to the organiser. After that, the organiser is responsible for how it is handled, for example who gets a place.

The connection between your account and the organiser's register. We are responsible for your choice to connect your account to the organiser and for sending a changed email address and phone number to the organisers you choose. Once the change is in the organiser's register, the organiser is responsible for it. What you see about the organiser in your account, for example the child's group, and the attendance notices are the organiser's data, which we show and send on the organiser's behalf. Read more in section 4 a.

The calendar. We are responsible for the calendar feed: the secret address, that the feed exists and that you have chosen it. The groups and sessions in the feed are the organiser's data, which we show on the organiser's behalf. Read more in section 4 g.

The organiser is also responsible for the photos it uploads to Playsa. See Clubs' photos in section 4.

In sections 4 a to 4 j we write the club. That also covers arts schools and companies.

2. What data we have

About you as a parent

  • Email address.
  • Your name, but only when you register the child for a group. For an account and a trial session, the email address is enough.
  • Phone number, if you add it to send it to a club.
  • Language and settings for messages.
  • Logins and which devices are signed in.
  • Which clubs you have connected your account to, and which of them should get a changed email address and phone number.
  • Which notices you want about each child, and whether quiet hours should apply to you.
  • The address of your calendar, in a form that cannot be read back.

About the child

  • First name.
  • Year of birth.
  • Bookings of trial sessions and whether the child came.
  • Places in queues, offers and your answers.
  • Interest you have registered with a club.

We store an enrolment only when you press Send. The child's surname and date of birth, which you write in the enrolment, are not stored in your account. They go with the enrolment to the club.

About your use

  • IP address, browser and logs. Needed for the service to work and be secure.
  • Alerts you have saved.
  • Reviews you have written.

About you who work in a club

  • Email, name and role in the club, for example administrator, office, treasurer, board or leader, and which groups you lead.
  • Logins and two-factor authentication.
  • What the club writes about you in its register is the club's data. Read more in section 4 j.

What we do not store

  • Personal identity numbers. If a club adds a file with personal identity numbers, we work out the date of birth and sex and do not store the number.
  • The child's full date of birth in your account.
  • Your address.
  • Your location. If you search near you, the location is only used in the search. If you check in your child, we never ask where you are.
  • Pictures. You cannot add pictures of yourself or your child with us.
  • Health data. The club's questions in an enrolment may not be about health, allergies or diagnoses.

Clubs can upload photos from their activities where children can be seen, if the guardians have said yes. Read more under Clubs' photos in section 4.

What we do Data Legal basis How long
Show the search site and answer searches Technical data Legitimate interest: that the service works and is secure Runtime logs one day
Create and manage your account About you Contract: the terms of use As long as you have the account
Add the child to the account The child's first name and year of birth Legitimate interest: that the child can try out and get a place in the activity you chose Until you remove the child, but no longer than until the child turns 18
Book trial sessions and send the booking to the organiser About you and the child, the booking Contract 12 months after the session
Put the child in a queue and pass on offers About you and the child, the place in the queue Contract Until the child has left the queue, plus 12 months
Receive your enrolment and send it to the club About you and the child, the enrolment Contract Nothing is stored before you press Send. After that the enrolment is the club's, see the next table
Receive interest and pass on the club's invitation to the queue The child, the club, the activity Contract 12 months after you registered the interest, or after the invitation if it came later
Connect your account to a club's register and send a changed email address and phone number to the clubs you choose Your approval, which child it concerns, email and phone Contract: you ask for it Until you or the club removes the connection, the child turns 18 or your account is deleted
Store which notices you want Your choice for each child, and quiet hours Contract As long as you have the account
Manage the calendar feed to your calendar The calendar address in protected form and your choice. The times are worked out when your calendar fetches them and are not stored with us. The groups and sessions in the feed are the club's data, which we show on the club's behalf Contract Until you switch off the calendar or delete the account
Send confirmations, reminders and offers Email Contract Delivery log 90 days
Manage accounts for you who work in a club Email, name, role, groups, invitation, two-factor authentication Contract or legitimate interest As long as you have the account. An invitation 90 days after it expired
Manage your alerts Search filters and area Contract As long as the alert exists
Show and moderate reviews The review Contract and legitimate interest As long as it is published
Help you when you contact us Your enquiry Legitimate interest 24 months
Protect the service against intrusion and misuse Logs Legitimate interest Runtime logs one day, audit log 24 months
Find and fix errors Error reports without IP addresses, cookies and query strings Legitimate interest: that the service works 30 days
Produce statistics without data about individuals Aggregated data Legitimate interest
Send newsletters, only if you have said yes Email Consent Until you say no
Show the organisers' photos Photos in which children and adults can be seen Consent, which the organiser obtains As long as the organiser has the photo on Playsa
Receive and review reports about photos The photo, the time, a code derived from the IP address, your email if you leave it Legal obligation under the EU Digital Services Act, and legitimate interest: to protect children and prevent misuse The report 12 months. The log of the emails we send you 90 days

You have the right to object to what we do on the basis of legitimate interest. See section 9.

What we do on the club's behalf

Here we handle the data on the club's behalf. The club decides why the data is used and on what legal basis, and must tell you. The times below are our default times. The club can ask us to delete earlier. The deletion runs every night.

What we do on the club's behalf Data How long
Manage the club's register Name, date of birth or year of birth, email, phone, who is guardian and payer, membership, groups and status. Sex and home municipality only if the club applies for grants. A marker for protected personal data As long as the club has you or the child in the register. A person who has left is deleted, with groups, connections and notices, on the club's deletion date. If the club has not set a date, the person is deleted 24 months after leaving. 30 days before, the club's administrator can download a summary about the person. Of the person's attendance only session, group and number are then kept
Log changes in the register Which field was changed, by whom and from where, never the value 24 months
Read in the club's file Interpreted rows, never the file 7 days after the import
Send the club's invitation to connect The address and the code in protected form 90 days after the invitation was accepted, withdrawn or expired
Receive enrolments that did not lead to a place The enrolment, answers and consents 12 months after the end of the term
Receive enrolments that led to a place The enrolment, answers, surname and date of birth 12 months after the end of the term. The child's place stays in the register
Store the consents in the enrolment Your answer and the version of the text As long as the consent applies, and 12 months after it was withdrawn or the person left
Calculate fees and produce the fee basis Amount, lines, VAT, payer, due date, status 24 months after the end of the term. A fee that has become an invoice is kept like the invoices
Send the club's invoices and reminders The invoice with the payer, the child's first name, the group, the term, the amount, the VAT and the OCR number, and payments, reminders and credits Up to and including the seventh year after the calendar year in which the financial year ended. A draft invoicing run 12 months
Read in the club's file from Bankgirot The payments from the file, never the file itself. The message and the payer's name from the file The payments like the invoices. The message and the name 90 days
Receive the attendance Session, who was there, who marked or checked in and when, the corrections and the basis for grants With name as long as the person is in the club's register. A session is deleted on 1 January seven years after the year it was held: a session in 2027 is deleted on 1 January 2034. For a person who has left, only the session, the group and the number are kept, without names, for five years
Receive check-ins Who checked in, which child and when. No location, no IP address and no picture Like the attendance. The poster's code is removed when the term is over
Send attendance notices Which session, which child, to whom, type and time 12 months after the notice was sent
Send receipts, messages about enrolment, invoices, notices and the club's emails The recipient, the template and the time Delivery log 90 days
Receive replies to invitations The invitation, the reply, who replied and when 12 months after the occasion
Send the club's email to a group The recipients, whether the email arrived and whether it was opened in Playsa Sent emails 12 months after sending. Drafts 90 days after the last change
Store the status of the leaders' criminal record extracts The date of the extract, the day it was shown, who saw it and until when the check applies 12 months after the leader's role ended. A row replaced by a newer extract 12 months after it was replaced
Log the club's permission when we read for support The permission, the matter and each reading 24 months after the permission ended

4. About children

We have built Playsa for children, so we are extra careful.

  • We only ask for what we need: first name and year of birth.
  • Children under 13 never log in themselves. You decide.
  • We never show advertising, neither to you nor to the child.
  • We do not create profiles of children and do not use children's data for marketing.
  • We never sell data.
  • Other parents do not see your child's name in queues, lists or invitations. The queue only shows numbers, for example "Place 4 of 12", and an invitation only how many have replied.
  • Other parents never see whether your child was there, not even as a number.
  • The child's first name is visible to you, to the adults you have invited to the household and to the organiser you book with.
  • If the child is in a club that uses Playsa, the club sees the child's full name and date of birth. The leaders in the child's groups see the full name and year of birth, so that they can call the roll.
  • The leaders see no phone numbers in the list. If a leader needs to reach you, the leader presses Call. The number of the guardians who have connected their account is then fetched, and each fetch is logged.
  • Our emails contain at most the child's first name.
  • A child under 18 cannot be connected to a club on their own and never checks in themselves.
  • At the end of the year in which the child turns 18, we remove the child's profile from your account. We remove the connection to the child in a club's register when the child turns 18.

Clubs' photos

  • Clubs, arts schools and companies can upload photos from their own activities, for example from a training session. The photos are shown with the organiser's activities on Playsa.
  • If a child can be recognised in the photo, the organiser must have a yes from the child's guardian. If the child is older, the child must also get to say yes or no.
  • The organiser is responsible for the photo and for the yes being in place. If you want to withdraw a yes, contact the organiser. The organiser then removes the photo.
  • The photos are shown without names. We remove all information that comes with the file, for example where and when the photo was taken. We never keep the original file.
  • We ask search engines not to show the photos when people search for images.
  • Is your child in a photo that you do not want shown? Press "This is my child" next to the photo. You do not need an account. The photo stays until we have reviewed your report, by the next working day. If it is correct that a guardian has not said yes, we hide the photo. Otherwise it stays.
  • Does your child have protected personal data? Also write to hej@playsa.se with a link to the page, and we review the report first.
  • If you want to hear what happens to the photo, you can leave your email. You get a confirmation straight away and then our decision. The organiser never gets your address.
  • If you report more than ten photos in one day, we do not store your email for the reports over the limit, and you get no reply about them. In that case, write to hej@playsa.se.
  • If we hide the photo, the organiser is told that we did and why, but not who you are. Only we can show the photo again, and only if the organiser shows that the guardians have said yes.
  • If you want the photo removed completely, write to the organiser or to hej@playsa.se with a link to the page. We reply within two working days.
  • If you want to report something else in a photo, for example that it violates someone's rights, use the contact page on playsa.se.
  • We keep the report for 12 months, so that we can see whether the button is misused. We do not store your IP address, only a code derived from it. The key the code is derived with changes every day and is deleted after two days. After that the code cannot be linked to you. The log of the emails we send you is deleted after 90 days.
  • We do not hide a photo just because someone reports it. Then anyone could hide photos that are allowed to be shown. That is why we review every report, by the next working day.

4 a. Your account and the club's register

Applies when the club uses Playsa's register.

With us there are two things that are kept apart:

  • Your account, with you and the children in the family. That is our responsibility.
  • The club's register, with the club's members, participants, guardians and leaders. That is the club's responsibility, and we manage it on the club's behalf. You can be in the register without having an account with us.

The connection

  • Your account and the club's register only meet through a connection that you approve. The club invites you with a code in an email to the address in the register. The code is valid for seven days. Nothing is connected automatically, not even when the email address is the same.
  • When you approve, you choose which child in your account is which child in the club's register, or none. If the year of birth does not match, the connection cannot be made, and you need to contact the club.
  • With the connection you see the club's name and the child's groups, terms and status in your account, for example "Member of the club, group Children's dance". You can also get notices and invitations and check in the child.
  • You see a child's row only if the club's register also has you as the child's guardian. Two guardians can connect separately.
  • If you change your email address or phone number in your account, you choose for each connected club whether the change should be sent there. Only what you changed is sent. The club's log shows which field was changed and that it came from your account, never the new value.
  • Name, date of birth and other details never go from your account to the club. The club's changes never go into your account. If you want to correct your or the child's name in the club's register, contact the club.
  • The club sees whether a row is connected and since when, but never who in the family approved it. The club never sees your account, your other children, your bookings and queues, or whether you are with another club.
  • You can remove the connection whenever you want under Account. The club can also remove it, for example when custody has changed. The club's row stays with the data it had.
  • A child under 18 cannot be invited to a connection of their own. When the child turns 18, we remove the connection to the child. The young adult can then connect their own account.
  • If you delete your account, your connections are removed. The club's row stays.

If the club has added you from a file

  • A club can move its register to Playsa from a file, for example from another membership system. For each file, the club confirms that the data comes from the club's own register and that the club may transfer it. The club must tell you that it uses Playsa.
  • We never keep the file, only the rows the club approves. Columns with health data or addresses are never imported. If the file has personal identity numbers, we work out the date of birth and sex and do not store the number.
  • People with protected personal data in the file are not added.
  • The file never sends any email to you. The invitation to connect is a separate step.
  • The rows from the file are deleted seven days after the import.

4 b. Enrolment

Applies when the club takes enrolments on Playsa.

  • Only a guardian can enrol a child. You log in to the flow with email and a code.
  • You choose the term and the first session, write the child's surname and date of birth and answer the club's questions and consents. You see the price line by line before you send.
  • Nothing is stored before you press Send. The enrolment then goes to the club, and from that moment the club is responsible for it.

What the club gets

  • The child's first name, surname and date of birth.
  • Group, term and first session.
  • Your answers to the club's questions.
  • The consents, with the version of the text and when you answered.
  • The price as you saw it.
  • Your name and email as payer. The person who sends the enrolment is the payer.
  • Not your phone number. The club only gets it if you send it yourself through the connection, see section 4 a.

Questions and consents

  • The club cannot ask about health, allergies or diagnoses. Free text is always optional and at most 300 characters, with a reminder not to write about health.
  • The consents are the club's. We store your answer with the version of the text, so that the club can show what you answered. A no to an optional consent does not affect the place. If you want to withdraw a consent, contact the club.

Emails and status

  • You get a receipt, and a message when the status changes. The emails have the child's first name, the group, the club, a link and the deadline. Never the surname, date of birth, answers or reasons.
  • Under Home you see the status of the enrolment: received, admitted, confirmed, waiting, declined or withdrawn. If the club puts the enrolment on waiting or declines it, you see the club's reason.
  • If the child is admitted, you confirm the place within five days. When you have confirmed, we add the child to the club's register on the club's behalf.

Withdrawing

  • Before the enrolment is admitted, you can withdraw it free of charge under Home.
  • When you have confirmed the place, you have a right of withdrawal. The enrolment says this: "You have 14 days to withdraw from the day the enrolment is confirmed. You withdraw under Home or by writing to the club. If the term starts within that period and your child is to take part from the start, you agree that the service starts during the period; you then pay for the sessions held before you withdrew."
  • The enrolment is an agreement between you and the club. The terms for parents, point 6 a, say more.

4 c. Fees and invoices

Applies when the club takes enrolments or sends invoices on Playsa.

  • The club sets fees, discounts and VAT. We calculate the fee for each enrolment according to the club's rules.
  • When you have confirmed the place, we create the fee on the club's behalf: the child, the payer, the group, the term, the amount, the VAT and the due date.
  • The club's administrator can download a fee basis, a file with the payer's name and email, the child, the group, the amount and the due date, and invoice from the club's own system. Each download is logged, without the content. Children with protected personal data are not included in the file.
  • The leaders see no fees and no invoices.
  • We do not receive any payments. The money goes to the club and never to or through us.

Invoices

  • The club can send invoices with an OCR number from Playsa. The invoice goes by email to the payer in the club's register, also to someone who has not connected their account. The email has the child's first name, the group, the term, the amount, the bankgiro number, the OCR number and the due date. You see the lines, the VAT and the invoice as a PDF when you have logged in.
  • You pay to the club's bankgiro with the OCR number. The club marks the payment as paid, by hand or with a file from Bankgirot. From the file we store the payment. We delete the message and the payer's name from the file after 90 days.
  • If the invoice is not paid, you get at most two reminders, by default 7 and 21 days after the due date. They cost nothing. After that the club will be in touch.
  • You get a receipt when the club has marked the payment as paid, and a credit note if the club credits the invoice.
  • Under Account, Fees you see the invoices where you are the payer. If you have not connected your account, you log in with a code sent to the address the invoice went to, and see only your own invoices.
  • The club's administrator, office and treasurer see the club's invoices. The board and the leaders do not.
  • The club is responsible for the content of the invoice and for its accounting. We keep the invoices on the club's behalf for as long as section 3 says.

4 d. Attendance and attendance notices

Applies when the club takes attendance in Playsa.

The attendance

  • The leader marks the children at each session: present, not present or reported absence. We store the mark, who marked and when. The leader can correct it for seven days, after that the club's office.
  • The leaders in the group, the club's office and administrators see the attendance. You see your own child's. Other families never see the attendance, not even as a number.
  • If you answer no to an invitation, it counts as reported absence.
  • The club can calculate the basis for LOK support and municipal grants from the attendance, with sex and home municipality if they are in the register. Children with protected personal data are counted but never named in the basis. The club submits the application itself.
  • If the club cancels a session and you have connected your account, you get an email with the child's first name.

The notices

If you have connected your account to the club, you can get notices about your child.

The child's age Absence notice Presence notice
Under 16 On Off, you can switch it on
From 16 Off, you can switch it on Off, you can switch it on
  • You choose for each child under Account. Your own choice always applies. The age is counted on the year the child turns.
  • The presence notice is sent the first time the child is marked present, from a quarter of an hour before the start until an hour after the end. If another guardian checks the child in, it is sent from half an hour before the start, but never to the person who checked in.
  • The absence notice is sent 60 minutes after the session ended, only if the child was marked not present without you having reported absence. If the leader corrects the child to present after the absence notice, you get a correction, once.
  • No notice is sent for a child who has not been marked, for reported absence, for a cancelled session or when nobody took attendance. So if no notice comes, it does not mean that the child is there.
  • The notice has the child's first name, the group and the day. Never the place, the time, the leader or other children.
  • The notices are sent by email.
  • The club sees how many notices were sent for a session, never to whom and never a number under 3.
  • The club can switch off the notices for the whole club. Then no attendance notices are sent from that club.
  • We send the notices on the club's behalf. Your choice of notices belongs to your account and is our responsibility.

4 e. Check-in

Applies when the club has switched on check-in for the child's group.

  • The club can let guardians check in the children when they arrive at the session. Check-in is off until the club switches it on for a group.
  • You scan a code at the leader's with your phone and choose the child. The code on the leader's screen changes every 30 seconds and is valid for at most one minute. The club can instead put up a poster with a code for the group that is valid for the whole term.
  • You can check in from half an hour before the session until the session ends.
  • Only a guardian who has connected their account can check in, and only children who have a place in the group that day. A participant can check themselves in only from 18. Children under 18 never check themselves in.
  • You log in to check in. While you log in, we keep the code in a cookie for ten minutes, see section 10.
  • A check-in counts as present. No absence notice is then sent. The presence notice goes to the other guardians who have chosen it, never to you who checked in.
  • The leader's mark goes first. The leader sees that the child is checked in and when, but not who checked in, and can change and undo it. If the leader has already marked the child, your check-in changes nothing, but the leader sees it.
  • We store who checked in, which child and when. The club's office sees who checked in. We store no location, no IP address and no picture. The camera is your phone's own, and we never get the picture. Against misuse we derive a code from your IP address, and it is deleted after five minutes.
  • The poster's code is removed when the term is over. The check-ins are kept and deleted like the attendance.

4 f. Invitations and email from the club

Applies when the club sends invitations or email in Playsa.

Invitations

  • The club can invite the child to a match, a cup, a camp, an extra session or a session in the schedule. The invitation is shown under Home and comes by email to the guardians who have connected their account to the club. If you have not connected your account, you see the invitation when you have done so, see section 4 a.
  • You reply yes, maybe or no in Playsa. The buttons in the email open the invitation, and the reply is stored only when you are logged in.
  • We store the reply, who replied and when. Both guardians can reply, and the latest reply applies.
  • The leaders see the child's full name, the reply and when. Which of the guardians replied is seen only by the club's office and by you. Other parents only see how many have replied yes, maybe and no.
  • The reply has no text field, so that nothing about health ends up in the invitation.
  • If you reply no close to the meeting time, by default less than 24 hours before, the leaders get an alert with the child's name.
  • If the club has chosen a reminder, we remind you once, 24 hours before the reply date, if none of you has replied or if you have replied maybe.
  • The email has the child's first name, the group and the day. You see the time, the place and the club's message when you have logged in.

Email from the club

  • The club can email a group. The recipients do not see each other, and replies go to the club's shared address.
  • If the participant is under 16, the guardians get a copy. That also applies to leaders and assistant leaders under 16. From 16, the email goes to the participant directly if they have their own email in the register. For a participant who is 16 or 17, you get a copy only if you switch it on under Account. If the participant has no email of their own, the email goes to the guardians until they turn 18.
  • The club sees whether the email arrived, and whether you have opened the message in Playsa or pressed a link in the email. This is not based on any tracking pixel, so the club does not see whether you read the email in your email app.

Your choices and quiet hours

  • Under Account you choose for each child whether you want emails about new invitations and reminders. Emails from the club and messages about cancelled sessions are always sent.
  • We do not send new invitations, reminders or emails from the club between 21 and 07. They go at 07. Messages about cancelled sessions and attendance notices go straight away. You can switch off quiet hours under Account.

4 g. The calendar in your phone

Applies when you switch on the calendar under Account.

  • You can get the child's booked trial sessions and the deadline for an offer in the queue in your own calendar, for example in Google or Apple. If the club takes attendance in Playsa, the child's sessions are included too, from 30 days back to eight weeks ahead.
  • The sessions are included only for children the club has connected to you, that is when you who switched on the calendar are a connected guardian of the child. If the child has protected personal data, the sessions are not included.
  • The calendar shows the group, the club, the time and the place, with the name and street of the venue. For lessons at the teacher's, it shows only the district, like the search site. It never shows the child's name, your name, leaders or other children.
  • If a session is cancelled, it is shown as cancelled. If you report absence, for example with a no to an invitation, the session disappears from the calendar.
  • The calendar has a secret address. Anyone who has the address can see the times and places without logging in. Do not share it. You can change the address or switch off the calendar whenever you want, and the old address stops working straight away.
  • We are responsible for the calendar feed: the secret address, that the feed exists and that you have chosen it. The groups and sessions in the feed are the club's data, which we show on the club's behalf.
  • We work out the calendar each time your calendar fetches it, and do not store the content. Your calendar service keeps a copy under its own terms.

4 h. The interest list

Applies when the club has the interest list.

  • If there is no group that fits the child's age, you can register interest with a club that has taken over its page on Playsa. We store the child, the club, the activity and the status.
  • The club only sees how many have registered interest for each activity and age. Never names, and never a number under 3.
  • If the club starts a group that fits, it can invite you. You get an email with the child's first name and put the child in the queue yourself. The place in the queue counts from the day you registered interest. We never put the child in a queue without you pressing.
  • You can register interest in at most 5 activities with the same club and 20 in total.
  • The interest is valid for one year. We delete it 12 months after you registered it, or after the invitation if it came later. You can remove it yourself under Queues or on Home.

4 i. The club's logo and descriptions

  • Clubs can upload their logo and write a description of the club and of each group, with links. It is the club's presentation on the search site.
  • If the club writes names or phone numbers in a description, they are visible on the search site.
  • Lessons at the teacher's show only the district, never the street. Lessons at the pupil's home and online show no place.

4 j. If you are a leader or work in a club

Applies when the club uses Playsa's register.

  • Your account with us is our responsibility: email, name, role and logins. The club decides your role and which groups you lead. Administrators, office and treasurers log in to the portal with two-factor authentication. Leaders log in to the leader view with email and a code.
  • As a leader you see the children in your own groups as long as the term is running: the full name and year of birth. Never email, phone numbers, sex, home municipality or fees. Children with protected personal data are shown without names.
  • If you need to reach a guardian, you press Call. The number of the guardians who have connected their account is then fetched, never for children with protected personal data. Each fetch is logged, without the number.
  • What you mark is stored with your name and the time.
  • The families see the leaders' names in invitations and at check-in, but only for leaders from 18. If the club's register has no birth details for you, your name is not shown to the families, and the club's office sees that.
  • The criminal record extract. The club only records that it has seen your extract: the date of the extract, on which day the club saw it, who saw it and until when the check applies, by default six months from the date of the extract. The extract is never uploaded and never stored with us, and there is no negative status. You, the office and the club's administrators see the status. The club gets an alert before the check expires. If the check has expired, or is missing when you lead a group with children, you do not see the children's names and attendance and cannot call the guardians until the club has recorded a new check.
  • If you search in the club's register, we store the search term in a cookie for at most 15 minutes. See section 10.
  • We read the club's register only with the club's permission for a matter, or in an incident or when the law requires it. See section 8.

5. If you are a child

This part is written for you.

  • Playsa helps your parents find things you can do in your free time, like football, dance or swimming.
  • We know your first name and the year you were born. We need that so the leader knows who you are and that you fit in the group.
  • We do not know your personal identity number. We do not know where you live.
  • We never sell anything about you. We show no advertising to you.
  • Only your family and your club see your name. In the club, that is the leaders in your group and the people who work in the club's office.
  • Your club can use Playsa to keep track of who takes part. The club then knows your full name and the day you were born.
  • When you come to training, the leader marks you, or a parent checks you in with a code in the phone. Your parents can then get a message that you are there. If the leader marks that you did not come, your parents can get a message an hour after training ended.
  • Other children and their parents never see whether you were there or not.
  • From the year you turn 16, your parents get no such messages, unless they have chosen it themselves.
  • Before a match or a cup, the club can send an invitation to your parents, and they reply whether you are coming. The leaders see your name and the reply. Other parents only see how many are coming.
  • Your parents can see your training sessions in their calendar. Your name is not there.
  • Your club can upload photos where you can be seen, if your parents have said yes. If you are a bit older, you also get to say yes or no. Your name is never shown with the photo.
  • Do you not want to be seen in a photo? Press the button next to the photo, or ask an adult to write to us. We look at the photo by the next weekday. If your parents have not said yes, we hide it.
  • Do you want to know what we have about you, or do you want us to remove something? Talk to your parents, or write to us yourself. If it is about your club, you can also talk to the club.

6. Who we share data with

  • The organiser you book with gets the child's first name and year of birth and your contact details, so that the booking works.
  • The club you enrol the child with gets what is set out in section 4 b.
  • The club you connect your account to gets the email address and the phone number you choose to send. Otherwise the club gets nothing from your account. If you check in a child, the club learns that you did and when. If you register interest, the club only gets numbers, never names.
  • Other parents never see your child's name. In an invitation they only see how many have replied.
  • Your calendar service, for example Google or Apple, fetches the child's times if you add the calendar there. You choose the service, and its terms apply to the copy.
  • Our suppliers help us run the service. They may only use the data to help us, and we have agreements with them.
  • Public authorities get data only when the law requires it.

We never disclose data for marketing.

Supplier Helps us with Where
Supabase Database, login and queues for scheduled messages The database is in Stockholm. The company is based in Singapore and the USA.
Vercel Running the website and the portal, and running scheduled messages The functions run in Stockholm. The company is based in the USA.
Vercel Web Analytics Visitor statistics without cookies The company is based in the USA. Vercel does not state where the data is stored.
Brevo Email, including receipts, invoices, notices and the club's emails EU, France and Germany
Sentry Error reports without IP addresses, cookies and query strings EU, Frankfurt. Accounts and some metadata in the USA.

Before we start using a new supplier, for example for SMS, apps, payment or BankID, we update the policy and let you know at least 30 days in advance.

7. Data outside the EU

Some of our suppliers are American companies, and Supabase also has a company in Singapore. Data may therefore be accessed from or stored in the USA or Singapore. Email goes through a supplier in the EU. We send as little as possible outside the EU, and never health data or personal identity numbers in email or notices.

The transfers are protected in one of these ways:

  • The supplier is certified under the EU-U.S. Data Privacy Framework, which the European Commission has approved.
  • We have the European Commission's standard contractual clauses with the supplier.

Contact us if you want to know more about the protection for a particular supplier.

8. How we protect the data

  • Each organiser's data is kept separate from everyone else's. Automated tests check this with every change to the code.
  • Sensitive data is encrypted with a separate key for each organiser.
  • Administrators log in with two-factor authentication.
  • We log who does what, so that we can see if something is wrong.
  • An external security firm tests Playsa every year.
  • If an incident affects you, you will be told.
  • A club never sees your account, another club's data or the id we have for you or the child.
  • Everyone who works in the club's portal logs in with two-factor authentication. A leader only sees the children in their own groups, and only as long as the term is running.
  • People with protected personal data are shown without names to everyone in the club except the administrators. Each time an administrator shows the name, it is logged.
  • Only the club's administrator can export the register, the fee basis, the basis for grants and the invoices with names. Each export is logged.
  • We read a club's register, enrolments, fees and attendance for a matter only with the club's permission, for a limited time. The permission and each reading are logged. In an incident or when the law requires it, we read without permission and tell the club afterwards.

9. Your rights

You have the right to:

  • find out what data we have about you and your child, and get a copy,
  • correct errors,
  • erase data,
  • restrict how we use data, for example while we investigate whether something is wrong,
  • move the data. You get it in a format that other systems can read.
  • object to what we do on the basis of legitimate interest,
  • withdraw consent, for example to newsletters,
  • complain to IMY, the Swedish Authority for Privacy Protection. Address: Box 8114, 104 20 Stockholm, Sweden. Web: imy.se.

How to do it

  • Write to hej@playsa.se from the email address you have in the account. Then we know it is you.
  • We reply within one month. If the request is large, it may take up to two more months. We will then tell you within one month.
  • It costs nothing.

What you do yourself in the account

  • Remove a connection to a club.
  • Send a changed email address and phone number to the clubs you choose.
  • Choose which notices you get about each child, and whether quiet hours should apply.
  • Change the address of the calendar or switch it off.
  • Remove an interest.
  • Withdraw an enrolment before it is admitted.
  • Sign out on all devices.

The child's rights. The rights are also the child's. When the child is young, you use the rights on the child's behalf. The older the child gets, the more the child can decide. An older child can contact us directly.

The club's data. If the question concerns the club's register, an enrolment you have sent, the fees, the invoices, the attendance, the check-in, the notices or the invitations, contact the club. If you write to us, we pass your request on to the club within five working days and help the club to reply.

10. Cookies

We only use cookies that are needed for the service to work: to keep you signed in when you have an account, for a search in a club's portal and for check-in. No consent is needed for them. If you search without an account, we set no cookies. We measure visits with Vercel Web Analytics, which does not set cookies, does not store your IP address and does not follow you between websites. We use no cookies for advertising.

Searching in the club's portal. If you search in the club's register, among the leaders or in a group in the portal, we store the search term in a cookie in your browser for at most 15 minutes, so that the search applies when you browse and change page. The cookie cannot be read by scripts on the page and applies only to the page where you searched. It is removed when you press Clear or sign out. We never store the search term with us.

Check-in. If you scan a code to check in, we store a proof of the code in a cookie for ten minutes, so that you have time to log in and choose the child. The cookie has the session, who you are if you have logged in, the time and a signature, never a name. It cannot be read by scripts on the page.

The read receipt in the club's email. The club seeing that a message in the club's email has been opened is not based on any tracking pixel. The club only sees it when you open the message in Playsa or press a link in the email.

11. Automated decisions

The queue is sorted automatically by when you put the child in the queue and by the organiser's priority rules. The rules are shown before you put the child in the queue. It is the organiser who decides who gets a place. You can ask the organiser to review a decision.

When enrolling, the club can choose that children are admitted automatically when there is a place, first come first served within each priority class. The priority class is worked out automatically from the club's rules, for example whether the child has already been in the group or has a sibling there. The price is calculated according to the club's rules, and you see it before you send. It is the club that decides who gets a place, and you can ask the club to review a decision.

If the club invites from the interest list, the place in the queue counts from the day you registered interest. The rule is shown among the group's queue rules.

We make no other automated decisions about you or your child.

12. Changes

If we change the policy in a way that affects you, we will tell you by email at least 30 days in advance.

13. Contact

Hodla AB, which is changing its name to Playsa AB, Vimpelgatan 1, 211 14 Malmö. Email: hej@playsa.se. We do not have a data protection officer.