Privacy Policy
Last updated 18 October 2026
This explains what personal data Sports Business Portal collects, why we collect it, who it reaches, and what you can ask us to do with it. It describes what the service actually does — nothing is collected that isn't listed here.
lib/legal.ts and have it reviewed before the portal takes real sign-ups.Who is responsible
TODO — registered legal name, TODO — registered address (TODO — company or VAT number), is the data controller for the personal data described here. For anything to do with your data, write to privacy@sportsbusinessportal.com.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Your name, email address and password | To create your account and sign you in. Passwords are stored only as a bcrypt hash — we cannot read them. | Performance of a contract (Art. 6(1)(b)) |
| Optional profile details: headline, bio, organisation, website, location, avatar | To show who is behind a listing. You choose whether to provide these, and they are publicly visible. | Consent (Art. 6(1)(a)) — you can clear them at any time |
| The listings you publish | To display them on the portal. Listings are public by design. | Performance of a contract (Art. 6(1)(b)) |
| Enquiries: the name, email and message of whoever contacts a listing | To pass the message to the person who published the listing, and to let them reply to you. | Performance of a contract (Art. 6(1)(b)) and our legitimate interest in running a marketplace (Art. 6(1)(f)) |
| Password reset requests | To let you back into your account. We store only a hash of the reset link, valid once and for one hour. | Performance of a contract (Art. 6(1)(b)) |
| Server logs kept by our hosting provider (IP address, request, timestamp) | To keep the service running and to investigate abuse and faults. | Legitimate interest (Art. 6(1)(f)) |
| Aggregate page-view counts (page, country, browser, referrer) | To see which parts of the portal get used. Collected without cookies and without an identifier that follows you — we cannot tell who visited, only how many did. | Legitimate interest (Art. 6(1)(f)) |
We run no advertising, we do not track you across other websites, we do not profile you, and we make no automated decisions about you. The page-view counts above are aggregate only. We do not buy or receive personal data about you from anyone else.
What is public
Your name, any profile details you fill in, and the listings you publish are visible to anyone on the internet and can be indexed by search engines. Your email address is never shown publicly. When someone sends you an enquiry we pass their message and their email to you so you can reply; your own address stays hidden unless you choose to reply.
Who else processes it
We keep the number of third parties small. Each one acts as our processor under a data processing agreement, and the ones below are all we use:
| Who | What for | Where |
|---|---|---|
| Vercel | Hosting, server logs, and cookieless page-view counts | EU region (Frankfurt), with US parent company |
| Neon | The database holding everything above | EU region (Frankfurt) |
| Resend | Sending enquiry notifications and password reset emails | EU/US — see transfers below |
| Stripe | Payments. Not currently active — the portal is free, and nothing reaches Stripe until paid plans launch. | EU/US |
Where a provider processes data outside the EEA, that transfer relies on the European Commission's Standard Contractual Clauses. We never sell personal data, and we never share it for anyone else's marketing.
How long we keep it
- Your account and profile — until you delete the account, then removed.
- Your listings — deleted with your account.
- Enquiries — deleted when the listing they belong to is deleted.
- Password reset links — expire after one hour and are cleared once used.
- Server logs — kept by our hosting provider on their own short rolling schedule.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider in a portable form. Where we rely on your consent you can withdraw it at any time, which doesn't affect what we did before you withdrew it.
Much of this you can do yourself: edit or clear your profile in your dashboard, and delete any listing from the same place. For anything else write to privacy@sportsbusinessportal.com and we will respond within one month. If you think we have handled your data badly you can complain to the Hellenic Data Protection Authority (dpa.gr), or the authority in your own EU country.
Cookies
One cookie, for keeping you signed in. No advertising cookies, and our page-view counting sets none either — which is why you aren't asked to accept anything. The details are on the cookie page.
Children
The portal is for sports business professionals and is not intended for anyone under 16. We don't knowingly collect their data; if you believe we have, tell us and we will delete it.
Changes
If we change how we handle personal data we will update this page and its date. Where a change matters to you, we will tell registered users by email rather than relying on you to notice.
Questions about this page? Write to hello@sportsbusinessportal.com.