Privacy Policy

This translation is provided for your convenience. In case of discrepancies, the German version shall prevail.

Last updated: September 2026

1. Controller

The controller responsible for data processing on this website is:

Christoph Krämer
Hundert-Morgen-Straße 58
65451 Kelsterbach
Germany

2. General Information on Data Processing

2.1 Scope of Processing of Personal Data

We process the personal data of our users only to the extent necessary to provide a functional website and our content and services. The processing of personal data regularly occurs only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

2.2 Legal Basis for the Processing of Personal Data

Art. 6 (1) (a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.
Art. 6 (1) (b) GDPR serves as the legal basis for processing operations that are necessary for the performance of a contract (e.g., conducting official tests).
Art. 6 (1) (f) GDPR serves as the legal basis for processing that is necessary to protect our legitimate interests (e.g., error analysis, improving the website).

2.3 Data Deletion and Storage Duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also occur if provided for by European or national legal provisions.

3. Provision of the Website and Creation of Log Files

3.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. The following data is collected:

IP address of the user (anonymized)
Date and time of access
Websites from which the user's system reaches our website (referrer)
Websites that are accessed by the user's system through our website
Browser type and version
Operating system of the user
Device used (desktop, tablet, smartphone)

This data is stored in the log files of our system. This data is not stored together with other personal data of the user.

3.2 Legal Basis

The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR (legitimate interest).

3.3 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this, the user's IP address must be stored for the duration of the session. Storage in log files is done to ensure the functionality of the website and the security of our IT systems.

3.4 Duration of Storage

The data is deleted as soon as it is no longer required to achieve the purpose of its collection. Log files are deleted after 90 days at the latest.

4. Use of Cookies and Tracking Technologies

4.1 Free Practice Platform (referee.app)

On the free practice platform, we use cookies to improve functionality and user experience.

Cookies used:

i18next: This cookie stores your selected language so that the website is displayed in the correct language on your next visit. (Functional cookie)
PostHog: This cookie is used for analyzing website usage to improve our offer. It helps us understand how users interact with the platform. (Analytics cookie)
PostHog Session Replay: Records user interactions (clicks, scrolling, page navigation) to improve the user experience. Input field contents are masked by default. (Analytics cookie, separate consent)

Legal basis: The use of functional cookies is based on Art. 6 (1) (f) GDPR (legitimate interest in user-friendly design). The use of analytics cookies is based on your consent under Art. 6 (1) (a) GDPR.

Storage duration: The storage duration of cookies varies. Language cookies are generally longer-term, while analytics cookies are session-based or active for a defined period.

4.2 Official Test Platform (Federation Subdomain)

On the official test platform, we differentiate the use of cookies depending on the user's role.

For test participants: We only use a functional cookie for storing the language setting (i18next). No analytics or tracking cookies are set. Authentication is carried out via secure token-based procedures.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a user-friendly, multilingual test environment).

For federation administrators (management interface): For administrators who log into the management interface, the same cookie policies as for the free practice platform apply (see 4.1). Both functional cookies (i18next) and analytics cookies (PostHog) are used.

Legal basis: Art. 6 (1) (f) GDPR (functional cookies) and Art. 6 (1) (a) GDPR (analytics cookies, consent).

5. Use of the Free Practice Platform

5.1 Description and Scope of Data Processing

When using the free practice platform, the following data is collected:

Answered questions and selected answers (anonymous)
Test results and learning progress (anonymous, stored only locally on your device)
Selected language and question catalog

This data is not stored in a personally identifiable manner. Test results and learning progress are stored locally on your device (browser storage on the website, app storage in the mobile app) and are not transmitted to our servers. If you have consented to analytics, usage events about these activities are transmitted pseudonymously to PostHog (see 7.2). On the website, you can delete this data by clearing your browser's site data; in the app, by uninstalling it or clearing its app data.

5.2 Legal Basis

The processing is based on Art. 6 (1) (f) GDPR (legitimate interest in providing and improving the free practice offer).

5.3 Purpose of Data Processing

The anonymous collection of question statistics serves to improve the question catalog and to identify particularly difficult or ambiguous questions.

5.4 Mobile App (iOS and Android)

The "Handball Referee" app for iOS and Android offers the same free practice content as the website.

Local storage: XP, level, streaks, Leitner boxes, and answer history are stored only in the app's local storage on your device. This data is not transmitted to our servers; with your consent, usage events (e.g., answered questions, level-ups) are transmitted to PostHog (see 7.2). There is no user account, and uninstalling the app removes it. The question catalogs are part of the app and are not loaded from our servers.

Consent: On first launch, the app shows the same consent dialog as the website. Analytics (PostHog) and session replay start only after consent is given — no connection to PostHog is made before consent exists. Your choice is stored on the device and can be changed at any time via the privacy settings in the app.

Services used:

PostHog: consent-based, as described in section 7.2, including session replay with separate consent. PostHog does not store IP addresses (IP address discarding is enabled). A random, pseudonymous device identifier is stored on the device and deleted once consent is withdrawn or the app is uninstalled.
Sentry: always active and not consent-based (legitimate interest, Art. 6 (1) (f) GDPR, as described in section 7.3), for crash reports and performance data. Sentry does not store IP addresses.

Legal basis: Art. 6 (1) (a) GDPR (consent) for PostHog and session replay, Art. 6 (1) (f) GDPR (legitimate interest) for Sentry. For details on the processors used, see sections 7.2 (PostHog) and 7.3 (Sentry).

6. Official Tests (on behalf of federations)

6.1 Role of SEMSIS Solutions

When conducting official tests for federations, SEMSIS Solutions acts as a data processor in accordance with Art. 28 GDPR. The responsible body in the sense of data protection law is the respective federation that conducts the test. The data protection regulations of the respective federation also apply.

6.2 Description and Scope of Data Processing

When conducting official tests for federations, the following personal data is collected and processed:

Email address (for sending the test invitation)
Name of the participant (for identification)
Federation affiliation (for assignment to the respective federation)
Test results (score, answered questions, time required)
Test progress data (during the test for live monitoring by the test supervisor)

6.3 Legal Basis

The processing is carried out by the federation on the basis of Art. 6 (1) (b) GDPR (performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest of the federation in performance assessment).

6.4 Purpose of Data Processing

The data is processed exclusively for the following purposes:

Sending the test invitation by email
Conducting and monitoring the test
Documenting the test results for the federation

6.5 Duration of Storage

The test results are stored for the period specified by the respective federation (typically for the current season plus an archiving period). The exact storage period is determined by the respective federation in its data protection guidelines.

6.6 Recipients of the Data

The test results are transmitted exclusively to the conducting federation. There is no disclosure to third parties.

7. Use of Third-Party Services

7.1 Amazon Web Services (AWS)

We use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as a cloud infrastructure provider for the operation of the platform, data storage, and email dispatch.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and reliable operation)

Data processing: All data is stored and processed exclusively on servers in the EU (Frankfurt region).

Data processing agreement: A data processing agreement has been concluded with AWS in accordance with Art. 28 GDPR.

Further information: https://aws.amazon.com/privacy/

7.2 PostHog (Web Analytics)

We use PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, to analyze website usage. In the mobile app, cookies and local storage within the app are used for this purpose (see 5.4); the connection to PostHog is only established once consent has been given.

Functions used:

Usage analysis via cookies and local storage (on the website and in the app)
Error tracking to improve the platform
Session recordings (Session Replay): Recording of mouse movements, clicks, scrolling, and page navigation to improve the user experience. Input field contents are masked by default and are not recorded. Session Replay requires separate consent and is disabled by default.

Legal basis: Art. 6 (1) (a) GDPR (consent) for the use of analytics cookies and local storage, and Session Replay.

Data processing: We use PostHog's EU hosting (servers in Frankfurt, Germany). PostHog does not store IP addresses (IP address discarding is enabled). Insofar as data is transferred to the USA, this is done on the basis of the EU-U.S. Data Privacy Framework (DPF) or the EU Standard Contractual Clauses.

Data processing agreement: A data processing agreement has been concluded with PostHog in accordance with Art. 28 GDPR.

Further information: https://posthog.com/privacy

7.3 Sentry (Error Monitoring)

We use Sentry, Functional Software Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, to monitor and resolve technical errors — on the website and in the mobile app alike, always active and not subject to consent (see 5.4).

Functions used:

Collection of JavaScript errors
Error reports with technical information

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in ensuring technical functionality)

Data processing: We use Sentry's EU hosting (servers in Frankfurt, Germany). IP addresses are not stored. Insofar as data is transferred to the USA, this is done on the basis of the EU-U.S. Data Privacy Framework (DPF) or the EU Standard Contractual Clauses. Only technical error information is collected. Personal data (e.g., email addresses, names) is automatically removed from error reports.

Data protection: A Data Processing Agreement (DPA) has been concluded with Sentry in accordance with Art. 28 GDPR.

Further information: https://sentry.io/privacy/

8. Email Dispatch

For sending test invitations, we use Amazon Simple Email Service (SES), a service of Amazon Web Services EMEA SARL.

Data processed:

Email address of the recipient
Name of the recipient
Content of the test invitation (test link, federation name)

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)

Purpose: Sending test invitations to referees

Storage duration: Email metadata is stored for a maximum of 90 days.

9. Your Rights as a Data Subject

You have the following rights:

9.1 Right of Access (Art. 15 GDPR)

You have the right to request information about your personal data processed by us.

9.2 Right to Rectification (Art. 16 GDPR)

You have the right to demand the immediate correction of incorrect or completion of your personal data stored by us.

9.3 Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your personal data.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) (f) GDPR.

9.7 Right to Withdraw Consent (Art. 7 (3) GDPR)

If the processing is based on consent, you have the right to withdraw it at any time. The lawfulness of the processing carried out on the basis of the consent until the withdrawal remains unaffected.

9.8 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us.

Competent supervisory authority in Germany: Depending on the federal state – a list can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

10. Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or against unauthorized access by third parties.

Technical measures:

SSL/TLS encryption for all data transfers
Regular security updates
Access restrictions and authentication
Automatic data backup
Monitoring and error tracking

11. Actuality and Changes to this Privacy Policy

This privacy policy is currently valid and was last updated in September 2026.

Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed by you at any time on the website at https://referee.app/privacy.

Contact for data protection inquiries: christoph.kraemer@semsis.net