Takes effect on 1 October 2026.

Privacy Policy

Rinkadia Oy · Version 0.5 · 1 October 2026

1. Data Controller

Rinkadia Oy

Business ID: 3637270-3

Finland

For privacy-related inquiries, please contact: privacy@rinkadia.com

2. Legal Basis for Processing

The primary legal basis for processing personal data is the performance of a contract, including pre-contractual measures and the execution of the contractual relationship. This legal basis applies insofar as the processing of personal data is necessary for creating a user account, providing and using the Service, and fulfilling the contractual relationship between the user and the data controller.

Secondarily, processing may be based on the data controller's legitimate interest, arising from a relevant and appropriate relationship with the data subject. Legitimate interest may be relied upon where processing activities cannot be based on the contractual relationship.

The processing of personal data may also be based on the consent of the data subject.

3. Purposes of Processing

Personal data is processed for the following purposes:

  • User registration
  • Provision of the platform service
  • Management of representation relationships
  • Electronic communications, including communications and messaging between users through the Service
  • Analytics and statistics
  • Customer support, business operations, and service development

4. Legitimate Interests

We process personal data on the basis of legitimate interest when necessary for maintaining, developing, and securing the Service, enabling communication between users, managing customer relationships, and preventing misuse and security incidents.

We have assessed that these processing activities are balanced against the rights and freedoms of the data subjects.

5. Categories of Personal Data Processed

We process different categories of personal data depending on the data subject's role within the Service.

Players

  • Name
  • Nationality
  • Age
  • Playing position
  • Left/right-handedness
  • Height and weight
  • Language skills
  • League, match, and statistics history
  • Playing style
  • Roles and expertise
  • Salary expectations
  • Contract status
  • Availability status
  • Free-form profile description provided by the user
  • User account identification and login information
  • Profile photograph
  • CV or résumé information
  • Links to social media profiles, personal websites, and other online profiles provided by the user
  • Information relating to representation relationships
  • Representation status
  • Country of residence
  • Telephone number
  • Information relating to clubs excluded or blocked by the user

Coaches

  • Name
  • Nationality
  • Language skills
  • Certifications and licenses
  • Roles and responsibilities
  • Educational and employment history
  • Skills and tools used
  • Availability status
  • Free-form profile description provided by the user
  • User account identification and login information
  • Profile photograph
  • CV or résumé information
  • Links to social media profiles, personal websites, and other online profiles provided by the user
  • Date of birth
  • Country of residence
  • Telephone number
  • Information relating to clubs excluded or blocked by the user

Club Users

  • Name
  • Position, role, or function within the club
  • Information relating to the club
  • Email address
  • Billing information
  • Service usage and search log data

Agents

  • Name
  • Email address
  • Agency name
  • Free-form profile description provided by the user
  • Information on representation relationships
  • Representation status and history
  • Agency VAT number or registration number
  • Telephone number
  • Agency country
  • Agency website
  • Licence or certification information

Verification Data

We may process the following information related to user verification:

  • Verification result
  • Date and time of verification

Identity verification is carried out by iDenfy, a third-party identity verification service provider engaged by Rinkadia. Where identity verification is required, identity documents, facial images, and other information necessary for the verification process are submitted to iDenfy.

In addition, Rinkadia may provide iDenfy with certain account information supplied by the user, such as the user's name and date of birth, for the purpose of verifying that the identification document corresponds to the user account.

The processing of identity verification data is based on the performance of a contract and, where applicable, Rinkadia's legitimate interest in preventing fraud, ensuring user authenticity, maintaining information security, and protecting the rights and interests of Rinkadia and its users.

Rinkadia receives and stores only the verification result and related verification metadata, such as the date and time of verification. Rinkadia does not store copies of identity documents, facial images, or other identification documents.

Visitor Statistics

We may process limited technical information relating to visitors in order to determine the country from which the Service is accessed and to produce aggregated visitor statistics.

Rinkadia retains only aggregated country-level statistics and does not store IP addresses for this purpose.

Special Categories of Personal Data

Where voluntarily provided by the user and subject to the user's explicit consent, we may process health-related information provided by the user insofar as the user wishes to include such information in their profile or otherwise make it available to other users of the Service.

User Communications

We may process communications exchanged between users through the Service, including:

  • Messages sent and received through the Service;
  • Information contained in such messages;
  • Attachments and files shared through the Service;
  • Metadata relating to communications, including the sender, recipient, date, time, and delivery status of messages.

This information is processed for the purpose of providing the communication functionality of the Service, maintaining information security, preventing misuse, providing customer support, and complying with legal obligations.

Representation Relationships

We may process information relating to representation relationships established through the Service, including:

  • the identities of the Player and Agent;
  • representation status;
  • dates relating to the establishment and termination of representation relationships;
  • availability information managed by the Agent through the Service; and
  • representation-related notes created by the Agent through the functionalities of the Service.

This information is processed for the purpose of providing the representation functionality of the Service, facilitating communication between Players, Agents, and Clubs, maintaining information security, preventing misuse, and complying with legal obligations.

6. Recipients of Personal Data

Profile information may be displayed to sports clubs, agents, coaches, and other users registered with the Service to the extent necessary to fulfill the purpose of the Service.

User communications may be processed by Rinkadia and its service providers to the extent necessary for providing the communication functionality of the Service, maintaining information security, investigating misuse, providing customer support, and complying with legal obligations.

Rinkadia does not routinely review or monitor the content of user communications, but authorized personnel may access such communications where reasonably necessary for the purposes described in this Privacy Policy.

Personal data may be disclosed or made available to the following categories of recipients:

  • Registered and verified sports clubs for the purposes of the Service;
  • Registered agents in accordance with the Service's functionalities;
  • Registered coaches in accordance with the Service's functionalities;
  • IT, hosting, cloud service, analytics, and communication service providers engaged by Rinkadia;
  • Identity verification service providers engaged by Rinkadia for user verification purposes, including iDenfy;
  • Public authorities where disclosure is required by law or official order.

Personal data is not sold to third parties.

7. Sources of Personal Data

We collect personal data directly from users.

Information may also be collected from publicly available sources, including:

  • Club websites
  • League and match statistics
  • Registers published by sports governing bodies
  • Other publicly available sources

Not all categories of personal data described in this Privacy Policy are necessarily collected from all of the above sources. The source of the information depends on the data subject's role within the Service and the purpose of processing.

8. Transfers of Personal Data Outside the EU and EEA

Personal data may be transferred outside the European Union or the European Economic Area.

Where personal data is transferred outside the EU or EEA, we ensure an adequate level of protection by implementing appropriate safeguards, including contractual arrangements concerning confidentiality and the processing of personal data as required by applicable legislation.

Transfers are based on the European Commission's Standard Contractual Clauses (SCCs) and transfer impact assessments where required.

Information regarding the safeguards used may be provided upon request.

9. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy.

  • User account data is retained for the duration of the user account.
  • Following account deletion, data is generally deleted or anonymized within 12 months.
  • Information relating to contacts of corporate customers is retained for the duration of the customer relationship and for up to six (6) years thereafter.
  • Usage and log data is generally retained for 12 months from collection.
  • User communications are retained for the duration of the user account and are generally deleted or anonymized within 12 months following account deletion.
  • Health data processed on the basis of user consent is retained until the user deletes the information or withdraws consent. However, where such information has been reported by a user or is otherwise subject to moderation, copies of the reported content and related moderation records may be retained only for as long as necessary to investigate reports, enforce the Service rules, comply with legal obligations, or establish, exercise, or defend legal claims.
  • Files provided by the user, such as a photograph or curriculum vitae, are removed from the user's profile immediately upon deletion by the user or upon account deletion, and are deleted from our storage provider within seven (7) days thereafter.
  • Limited records relating to representation relationships may be retained for up to six (6) years following account deletion where necessary to document the operation of the Service, investigate misuse, resolve disputes, comply with legal obligations, or establish, exercise, or defend legal claims.
  • Records relating to profile access history may be retained for up to six (6) years where necessary to investigate misuse, resolve disputes, or establish, exercise, or defend legal claims.
  • Records relating to identity verification decisions and verification review notes may be retained for up to six (6) years where necessary to document verification decisions, investigate misuse, comply with legal obligations, or establish, exercise, or defend legal claims.

Data may be retained for longer periods where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

10. Rights of the Data Subject

Right of Access and Rectification

The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and to access such data.

Users may review their basic personal information through the Service.

The data subject also has the right to request correction of inaccurate personal data.

The data subject has the right to request restriction of processing and to object to processing under applicable law.

The data subject has the right to object to the processing of personal data for direct marketing purposes and may opt out of electronic stakeholder communications.

Right to Erasure

The data subject has the right to request that the data controller erase their personal data.

Deletion of personal data may affect the user's ability to use the Service.

Certain sports-related historical, competition, statistics, and performance data may be retained following a deletion request where retention is based on the data controller's legitimate interest, archiving requirements, or other applicable legal grounds.

Right to Data Portability

The data subject has the right to request that personal data they have provided to the data controller be transferred to another system in a commonly used and machine-readable format.

This right applies only to data provided directly by the data subject.

Requests concerning access, rectification, erasure, restriction, data portability, objections, or other data subject rights may be sent to: privacy@rinkadia.com

11. Consent Regarding Special Categories of Personal Data

Users may voluntarily provide health-related information, such as information concerning injuries, rehabilitation, medical restrictions, or other health matters relevant to their sporting career.

The provision of such information is entirely voluntary and processing is based on the user's explicit consent obtained before the information is stored.

Failure to provide health data does not prevent use of the Service and does not place the data subject at any disadvantage compared with other users.

Consent may be withdrawn at any time by deleting the information from the user's profile or by submitting a request to: privacy@rinkadia.com

12. Refusal to Provide Personal Data

Certain personal data is necessary for creating a user account and providing the Service.

Failure to provide optional information does not prevent use of the Service.

13. Automated Decision-Making

Personal data is not subject to automated decision-making or profiling within the meaning of Article 22 of the General Data Protection Regulation (GDPR) that would produce legal effects concerning the data subject or similarly significantly affect them.

14. Cookies

The Service uses cookies and similar technologies for the operation, security, and functionality of the Service.

Where only strictly necessary cookies are used, such cookies do not require consent under applicable law. Where the Service uses cookies or similar technologies that require consent, users will be informed and, where required, asked to provide their consent through an appropriate consent mechanism.

Users may manage cookies through their browser settings. Disabling necessary cookies may affect the functionality of the Service or prevent certain features of the Service from operating properly.

15. Supervisory Authority

Data subjects have the right to lodge a complaint with a competent data protection authority if they believe that the processing of their personal data violates applicable data protection legislation.

In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800

FI-00531 Helsinki

Finland

Email: tietosuoja@om.fi

Website: https://www.tietosuoja.fi

16. Changes to this Privacy Policy

This Privacy Policy will be updated as the Service and applicable legislation evolve.