Privacy policy

Version 2026-09-09.1. This notice is for the Sports Video Platform at sports.obiss.dk, operated by OBISS ApS. It is operational, not a legal opinion. Operator identity: Legal.

Who we are

For accounts, authentication, and billing identity we are the controller. For match and training video uploaded by a workspace we are the processor; that workspace organisation is the controller.

If you use the service on behalf of an organisation, we treat that use as being in the organisation’s interest. The organisation remains controller of video it uploads.

What we process

Email and password are required to create an account. Name is used to identify you in the product. We do not ask for a phone number and we do not buy or enrich personal data from brokers or other third-party sources. We share personal data only as described here.

• Account: name, email, password hash, MFA secrets, consent record
• Workspace membership and personal workspace metadata
• Video and session recordings only as processor for the workspace
• Security logs (audit, system, quality) and sign-in IP as recorded by the auth service — without secrets or card data

Lawful bases

• Art. 6(1)(b) contract — creating and using an account
• ePrivacy — strictly necessary cookies (session, CSRF, remember-device)
• Art. 6(1)(f) — security logs and sign-in IP
• Art. 28 — club video on the controller’s instructions

Retention

We keep personal data only as long as needed to run the service or as required by law. You can erase the account from Profile, subject to the last-Owner rule below.

Your rights

Signed-in users can export a machine-readable copy of their account data, update name, timezone and avatar, and delete the account from Profile. You may also write to privacy@obiss.dk to access, rectify, restrict, object, or request portability. Erasure does not delete other people’s workspace video. Club/processor requests go through the workspace organisation. You may complain to the Danish Data Protection Agency (Datatilsynet). Operator identity: Legal.

Last Owner of an organisation must transfer the workspace or schedule it for deletion first.

Subprocessors

The parties below process personal data only to provide the listed task. They are not permitted to use it for their own purposes.

• AWS SES — transactional email
• Stripe — card payments when billing is enabled; we never store card numbers
• Bitwarden.eu — human custody of break-glass secrets — not customer video

Hosting, databases, and object storage run on our own infrastructure in Denmark and are not subprocessors. Video is not used to identify people biometrically and is not used to train third-party AI models. There is no analytics, advertising, or marketing pixel. We do not operate a native mobile app and we do not connect to social-media accounts.

Transfers

Video and application data stay on self-hosted infrastructure in Denmark. AWS SES may process verification and reset email outside Denmark under the safeguards AWS documents (SCC / DPF). We do not transfer personal data to other countries as a product feature.

Legal disclosure

We may disclose personal data if required by law, a court order, or a competent authority, or if we must protect the security or integrity of the service.

Security

We use access control, encryption in transit, and self-hosted storage in Denmark. No transmission or storage method is completely secure. We do not guarantee absolute security.

Cookies

Only strictly necessary cookies and similar storage. Detail: Cookie policy.

Other sites

Pages may link to sites we do not operate. Their privacy practices are their own.

Minors

Self-serve accounts are for people 18 or older. Footage of youth athletes is processed only for the club as processor.

Changes

We may update this notice. The version date at the top is the published copy. Material changes are posted on this page.

Contact

OBISS ApS
Ringager 4A, DK-2605 Brøndby
CVR DK36024925
Privacy: privacy@obiss.dk
Security: security@obiss.dk
DPO: not appointed