1. Data Controller • Name: William Arts • Business ID: 2061379-5 • Email: vvjarvilehto@gmail.com • Contact form: kiekki.fi/contact 2. Register Name User Register of Kiekki 3. Purpose and Legal Basis of Processing Personal data is processed for the following purposes: • Creating and managing user accounts — performance of a contract (GDPR Art. 6(1)(b)) • Storing and displaying rounds, results, tournaments, and series — performance of a contract (Art. 6(1)(b)) • Friend features and sharing results between friends — performance of a contract (Art. 6(1)(b)) • Sending service-related email and push notifications — performance of a contract (Art. 6(1)(b)); notifications can be turned off in profile settings • Handling feedback and user communication — legitimate interest (Art. 6(1)(f)): developing the service and supporting users • Service maintenance, security, and prevention of misuse — legitimate interest (Art. 6(1)(f)) • Visitor statistics and analytics — user consent (Art. 6(1)(a)) 4. Data Collected • Email address (required) • Password (stored as a hash in Firebase Authentication; the Service never sees it in plain text) • Username and profile picture (optional) • Rounds and results: courses, per-hole throw counts, dates, comments, and reactions • Tournament and series participation with results • Friendships and friend requests • Names of guest players saved by the user (people who do not use the Service themselves) • Disc bag contents and settings • Feedback content and the technical data stored with it (browser information and page URL) • Push notification identifiers (FCM tokens), if notifications are enabled • Data request log: records of your own data downloads and account deletion • Location data (browser only, not stored on the server) • Technical sign-in data such as IP address and user agent, processed by Firebase Authentication 5. Data Sources Data is obtained directly from the user during registration, use of the Service, or feedback submission. Guest player names are obtained from the user who enters them. 6. Location Data Kiekki uses browser location only to show nearby courses and to center the map. Location data is not stored on the server and is not used for any other purpose. 7. AI-Assisted Image Processing When you read a scorecard from a photo or identify a disc from a photo, the image is sent to Google Vertex AI (region europe-north1, EU) for processing. A scorecard photo may contain the names of other players. Google acts as a processor on behalf of William Arts under the Google Cloud data processing agreement and does not use the images to train its own AI models. The image is not stored in Kiekki's database or file storage — it is sent for recognition only. Use of these features is voluntary. Legal basis: performance of a contract (Art. 6(1)(b)). 8. Cookies and Browser Storage Kiekki uses a strictly necessary cookie to manage the sign-in session. It is required for the Service to function and does not require consent. In addition, your cookie consent status and language preference are stored in your browser's local storage. The Service may use Google Analytics for Firebase to collect visitor statistics if you have given consent. It collects data such as pages visited, session duration, and device type. This data is pseudonymous: it is tied to device and user identifiers, not directly to your name or email address. Legal basis: user consent (GDPR Art. 6(1)(a)). You can give or withdraw consent at any time: in the cookie banner shown on your first visit, or later in your profile settings under “Analytics”. Withdrawing consent is as easy as giving it. 9. Processors and Disclosure User data is not sold and is not disclosed to third parties for marketing purposes. The following processors are used to provide the Service: • Google (Firebase, Google Cloud) — database, file storage, authentication, push notifications, and application hosting • Google Cloud Vertex AI — AI image processing (europe-north1) • Resend, Inc. (United States) — delivery of emails sent by the Service (for example password resets and tournament notifications); processes the recipient's email address and the message content • Google Analytics for Firebase — visitor statistics, only with consent Data may also be disclosed to authorities where required by law. 10. Public Visibility Within the Service • Tournament pages and their leaderboards are public: they are visible without signing in and may appear in search engine results. The username and results are publicly visible. • A series leaderboard can be shared via a public share link, making it visible to anyone with the link. • A personal player profile is visible only to friends the user has accepted. • Email addresses are never shown to other users. 11. Data Location and Transfers Outside the EU • The database (Firestore) is located in the EU (europe-north1), file storage (Storage) in the EU multi-region, and the application runtime in the Netherlands (europe-west4). • AI processing takes place in the EU (europe-north1). • According to Google's own documentation, Firebase Authentication runs only from data centers located in the United States. Your email address, password hash, and technical sign-in data (IP address, user agent) are therefore processed in the United States. The location of this service cannot be chosen. • The push notification service (Firebase Cloud Messaging) is a global service. • Email delivery (Resend) takes place in the United States. Transfers outside the EU are based on the Standard Contractual Clauses (SCC) approved by the European Commission and on the providers' data processing agreements. 12. Data Security • Connections are encrypted (HTTPS). • Passwords are stored as hashes; the Service cannot see them. • The sign-in session cookie is HttpOnly and Secure. • Access to data is restricted by database rules and limited to administrators. 13. Retention • Account and related data: for as long as the account exists. • After account deletion, personal data is erased without undue delay and at the latest within 30 days. The data request log, profile pictures, and push identifiers are deleted at the same time. • Games, tournaments, and series that include other players are retained because of those players' results. The deleted user's data is detached from them. If there are no other participants, the content is deleted. • Feedback: retained for as long as it is needed to develop the Service. When an account is deleted, the sender's identifying data is removed from the feedback, after which it can no longer be linked to a person. • Technical logs held by providers (Google Cloud, Resend) are retained according to each provider's default settings. 14. Data Subject Rights Users have the right to: • Access their data (Art. 15) — you can download your own data from profile settings in JSON or HTML format • Rectify inaccurate data (Art. 16) — profile data can be edited in settings • Erase their data (Art. 17) — you can delete your account from profile settings • Data portability (Art. 20) — the same download in machine-readable JSON format • Restrict processing (Art. 18) • Object to processing based on legitimate interest (Art. 21) • Withdraw consent at any time (Art. 7(3)) — analytics in profile settings, push notifications in settings or browser permissions • Lodge a complaint with the Finnish Data Protection Ombudsman (https://tietosuoja.fi/en) Requests: the contact form at kiekki.fi/contact or the email address above. A response will be given within one month at the latest. 15. Automated Decision-Making The Service does not carry out automated decision-making or profiling that produces legal effects concerning the user. AI is used only for image recognition at the user's request (section 7). 16. Minors The Service is intended for users aged 13 and above only. Users under 13 cannot create an account. 17. Changes This policy may be updated as needed. The latest update date is indicated at the top of this document.