Scandinavian Crown 2027

Registration privacy notice

Version: SC2027-PRIVACY-2026-08-27 · Last updated: 27 August 2026

1. Who is responsible for your data?

The controller responsible for the processing described in this notice is Sebastian Kaczmarek – Västerås 9Pin Bowling. For privacy questions, requests or withdrawal of optional media consent, contact sebastian@9pin.se.

2. Information we collect

The information is collected directly from you when you complete the registration form. We collect:

• first and last name,
• gender/category,
• country,
• personal-best total (PB),
• email address,
• club name,
• preferred qualification time, and
• whether you want us to reuse a Scandinavian Crown profile from a previous year.

If you choose to create a new tournament profile, you may also provide a face photo and an optional club logo. If you give the separate optional publication consent, we also record that consent, when it was given and the wording/version that applied.

3. Why we use the information and our legal basis

Registration information is used to receive and administer your entry, reserve a qualification time, organise the competition, contact you about your entry, prepare participant information and handle necessary tournament follow-up. The intended legal basis is GDPR Article 6(1)(b): processing necessary to take steps at your request in connection with your tournament registration and participation.

We may also process limited technical or administrative information where necessary to protect the registration system, prevent duplicate or invalid registrations and maintain the security and integrity of the service. This is based on the organiser's legitimate interests under GDPR Article 6(1)(f) in operating a secure and reliable registration system.

Public use of your tournament profile is separate. If you tick the optional media-publication box, the legal basis for that public use is your consent under GDPR Article 6(1)(a). You can register even if you do not give this optional consent.

4. How the tournament profile is created

For a new profile, background removal and graphic composition are performed in your web browser using JavaScript, MediaPipe Selfie Segmentation, TensorFlow.js/body-segmentation tools and HTML Canvas. The system uses the photo to detect the player's outline and place it on the tournament background with the name, PB and optional club logo.

This is automated image processing, but it is not automated decision-making about your eligibility or participation, and the system does not generate a new fictional person or alter your identity. You see the finished tournament profile before registration is completed and can reject it and choose another photo.

The original face photo and optional club-logo file are used only to create the preview/profile in your browser. After you approve the profile, only the finished tournament-profile JPG is uploaded for storage. The original face photo and original club-logo file are not retained on the server.

5. Who receives or processes the information?

• Authorised Scandinavian Crown organisers/admins can access registration information needed to run the tournament.
• Supabase provides the database, authentication, server functions and private file storage used by the registration system.
• Resend provides email delivery. Registration details are included in confirmation/organiser emails. For a newly created profile, the approved tournament-profile JPG is attached to the organiser email. The original face photo is not emailed.
• Technical content providers such as jsDelivr and Google Fonts may receive ordinary connection data such as IP address, browser/device information and request metadata when your browser downloads libraries or fonts needed by the page.

We do not sell registration data, share it with advertisers or data brokers, use it for targeted advertising, or use your registration/photo to train our own AI models.

6. Storage location and international transfers

The main Scandinavian Crown registration database and private profile storage are hosted in the Supabase project region Central EU (Frankfurt / eu-central-1).

Email delivery is handled by Resend. Resend states that customer email data, including message content and delivery logs, is stored in the United States. Resend states that transfers from the EEA are covered by safeguards including the EU Standard Contractual Clauses and its participation in the EU–U.S. Data Privacy Framework.

7. Security

The registration service uses HTTPS in transit. Stored tournament-profile files are kept in private storage rather than being exposed through permanent public file URLs. Access to administrative registration data and private files is restricted to authorised accounts. When an organiser opens a stored profile through the admin interface, access is provided through a short-lived signed link.

No internet service can promise absolute security. If we become aware of a personal-data incident, it will be handled in accordance with applicable data-protection requirements.

8. Public profile use and optional consent

The registration form contains a separate optional choice allowing your tournament profile (new or reused), together with the information shown on it, to be used on official Scandinavian Crown channels such as the tournament website, tournament presentation graphics and official social-media communication.

If you do not give this consent, your registration can still be completed. Your privately stored profile may still be handled by authorised organisers where necessary to administer your registration, but it must not be published on the basis of that optional consent.

You may withdraw this consent at any time by contacting sebastian@9pin.se. Withdrawal does not make earlier lawful use invalid, but future publication based on that consent must stop. Where reasonably possible, material under the organiser's control will be removed from future/public use after withdrawal.

9. How long we keep information

Registration information is kept for as long as reasonably necessary to administer Scandinavian Crown 2027, deal with tournament follow-up and resolve questions relating to the event, and is then deleted or anonymised when it is no longer needed unless a legal obligation requires longer retention.

The approved tournament profile may be kept for tournament history and possible reuse in later Scandinavian Crown events where there is a valid legal basis for that continued use. You can request deletion or ask that a profile no longer be reused by contacting the privacy address above.

Email copies and delivery logs are also subject to the retention practices of the email provider. Resend currently states that email and log data on its standard plans is generally retained for 30 days, with backups retained for a shorter additional period.

10. Required and optional information

The form clearly marks which information is required to process a registration. If required registration information is not provided, Scandinavian Crown cannot reserve and administer your tournament entry through this form.

The club-logo upload is optional. A new face photo is not required if you select that an existing Scandinavian Crown profile should be reused. The media-publication consent is optional and is not required in order to register.

11. Your rights

Subject to the conditions in the GDPR, you may have the right to:

• receive information about and a copy of your personal data,
• have inaccurate information corrected,
• request deletion of information,
• request restriction of processing,
• object to processing based on legitimate interests,
• receive certain data in a portable format where the right applies, and
• withdraw consent at any time where processing is based on consent.

To exercise a right, contact sebastian@9pin.se. We may need enough information to verify that the request relates to the correct person.

12. Complaints

If you believe your personal data is being handled incorrectly, you can first contact us so we can investigate. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

13. Participants under 18

If you are under 18, please ask a parent or guardian to review the registration and this privacy notice with you. A parent or guardian should approve any optional public-profile consent where this is required for the participant.

14. Changes to this notice

If the registration process or the way personal data is used changes materially, this notice will be updated. The version shown at the top is recorded with new registrations so the organiser can identify which information was presented at the time of registration.