Privacy notice

1. Who is responsible?

The operator responsible for data processing in Volleykit is Christoph Mayer, Zähringerstraße 1, 76131 Karlsruhe, Germany.

Email: chrisi.mayer@gmail.com · Phone: 0721 60903701

Volleykit is an independent, non-commercial project run for a self-organised group of volleyball trainers. It is not an official KIT service. This notice covers Volleykit, not the official course website.

2. Which data, from where, and why?

• Course organisation: names, official person IDs, course assignments, dates and locations. Trainers import these from mein-hochschul.sport.kit.edu using access they already have for their courses. Public trainer assignments may also be imported.
• Training records: attendance, cancellations, agreed training obligations, their status and necessary notes. These come from you and the trainers. Change records show who changed what and when.
• Account access: your chosen name, role, language, passkey public credentials, credential/device labels, technical device category, sign-ins, invitations and recovery links. Volleykit does not receive your fingerprint or face scan. Your device or passkey provider handles those checks.
• Operation and security: connection information, including IP address, requested resource and time, and technical error information as described below.

We use this data to organise training, keep understandable attendance records, manage access and protect the service. We rely on legitimate interests under Article 6(1)(f) GDPR: practical course organisation and secure, restricted access. These interests must be balanced against participants' rights; you can object as explained below.

Creating a personal login is optional. Not creating one does not prevent your trainer from keeping course and attendance records. Without a login you cannot use the app's self-service features; contact your trainer instead. There is no automated decision-making with legal or similarly significant effects and no advertising profiling.

Please do not enter diagnoses, medical details or other sensitive information in notes. A cancellation does not require a medical explanation in Volleykit.

3. Who can see the data?

Administrators manage accounts and courses. Authorised trainers and assigned substitutes can see the records needed for their courses or sessions. Participants can see their own records and, where applicable, the first names of other expected participants—not their surnames, attendance decisions or obligations.

The application runs on an IPAX VPS in Vienna, Austria. Encrypted backups are intended for an IONOS VPS in Berlin, Germany. These locations are within the EU. Hosting and backup providers are used as processors under Article 28 GDPR; the applicable processing agreements must cover the services used. Volleykit does not send participant records back to the official course system.

No advertising or analytics services are embedded. Fonts and QR-code generation are provided locally.

If you email us, your contact details and message are processed to answer your request (Article 6(1)(f) GDPR, or Article 6(1)(c) for statutory data-subject requests). The contact mailbox uses Google Gmail. Email processing can take place outside the EU, including in the USA. Google describes its transfer safeguards, including the EU–US Data Privacy Framework and standard contractual clauses, in its data-transfer information. Please avoid sending unnecessary sensitive course records by email. Correspondence is deleted when the request is resolved and no legal obligation or documented need requires further retention.

4. Cookies, passkeys and offline storage

The necessary vk_session cookie keeps you signed in for up to 30 days, unless you sign out or access is revoked earlier. It is not used for tracking.

The app stores course data, pending changes and, for authorised trainers, invitation cards in the browser so requested offline features work. It also caches application files and settings. This uses browser databases and caches, not just cookies. Necessary storage for the requested service is based on Section 25(2)(2) TDDDG; subsequent personal-data processing follows the GDPR basis above.

Signing out clears the app's locally saved account data and pending changes. Your passkey itself remains in your device or password manager unless you delete it there. Device providers may synchronise passkeys under their own terms.

Use a locked, personal device. Revoking access cannot remotely erase a browser that is offline. Clear site data on a device you no longer control or use. Deleting browser data can also lose changes that have not yet synced.

5. Server logs

Connection information is needed to deliver pages and protect the server. The deployment configuration disables routine nginx access logs for Volleykit. Error logs can contain IP addresses, request paths, timestamps and technical errors. They are rotated daily with a seven-day retention limit; relevant extracts may be retained longer to investigate a specific security incident.

Application error logs contain technical error codes and request IDs. Request bodies, official login credentials and full imported responses must not be logged. Logs are used for troubleshooting and security, not behavioural analysis, based on Article 6(1)(f) GDPR.

6. How long do records stay?

• Courses and training history: deleted by scheduled maintenance 12 months after the teaching period ends. This allows corrections and follow-up across course changes.
• Inactive participant access: passkeys and sign-ins expire after 12 months without use if there is no current enrolment. Names remain while associated course history is retained; participant accounts without remaining memberships are then deleted. Staff accounts are managed manually.
• Temporary imports: previews are valid for 15 minutes. Expired previews and links are removed by scheduled maintenance. Official login credentials and access tokens are used only for the immediate import and are not intentionally saved.
• Technical action receipts: retained for up to 400 days to recognise repeated offline submissions; deleted by maintenance afterwards.
• Backups: encrypted snapshots can retain previously deleted records for up to a further 30 days. They are not used as a live archive.
• Browser copies: remain until sign-out, removal of site data or browser eviction. Offline copies do not automatically disappear when server records are deleted.

Removing login access or unlinking an imported identity does not erase its training records. For an erasure request, use the contact details above.

7. Your rights and how to get help

You can ask for access to your data, correction, erasure or restriction of processing. Where the legal conditions apply, you also have a right to data portability. These rights are subject to the GDPR's conditions, not unconditional promises to delete every record immediately.

You may object to processing based on legitimate interests for reasons relating to your particular situation (Article 21 GDPR). Contact Christoph Mayer using the details above. We will review the request and explain any reasons for continuing the processing. We may need to verify your identity; requests are normally answered within one month.

You can complain to a data protection supervisory authority, in particular where you live, work or believe a violation occurred. In Baden-Württemberg: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI).

8. Information before registration

Imported records may exist before you create an account. Trainers must provide this notice when they inform you about Volleykit, no later than the applicable GDPR deadline—normally within one month after import, and earlier if required by the first communication or disclosure. The invitation card includes the privacy address; please ask your trainer if something is unclear.