This policy describes how Breakout Sports AB processes personal data in the Breakout app and on breakoutsports.se. It is written purpose by purpose: for each thing we do, you can see which data is needed, on what legal basis, who receives it and how long it is kept. Because Breakout is used by people from age 13, special safeguards apply to anyone under 18 — they are marked in each section, and a simpler version of this information is available at breakoutsports.se/integritet-ung.
The essentials
We only collect what the service needs: account, profile, your clips and what is generated as you use the app. We never sell your data.
If you are 13–17 your account is private from the start and you are not visible to scouts or trainers until you choose to be.
Every clip is screened automatically as a child-safety measure before it is shown. Flagged content is assessed by a human.
All core data is stored within the EU/EEA. You can export your data or delete the account directly in the app at any time.
Questions or complaints: dataskydd@breakoutsports.se. You always have the right to contact the Swedish Authority for Privacy Protection (IMY).
Each section states its purpose in plain text. The details — data, legal basis, recipients and retention per processing operation — sit behind “Show in detail”, or expand everything at once.
Breakout Sports AB, company reg. no. 559585-5445, Mannerfelts väg 8B, SE-504 31 Borås, Sweden, is the controller for the processing described in this policy, except where stated otherwise.
We have not formally appointed a Data Protection Officer. Data protection matters are handled by the company and reached at dataskydd@breakoutsports.se.
When a club or trainer uses Breakout to administer their team — rosters, events, chat and squad selections — the club is the controller and we process the data on the club’s behalf. The same applies to scouts’ own notes, watchlists and ratings. For questions about that processing, the club or scout is your first point of contact; we will always help pass the question on. Sections 6 and 7 show which processing this concerns.
Parts of this policy are advance notice. What B9 (clip suggestions in the Home feed), B10 (Players near you) and D9 (the coach’s overview of their own players) describe comes to the app no earlier than 16 October 2026. Trainers with premium getting the scout radar (D3), the changes to contact requests (D8) — guardians being notified, and an accepted request being able to give the sender contact details — the clip-type suggestion when you upload (B11), a parent being able to create their child’s account (G6), players being able to apply for a blue check (B13) and you being able to share your player CV as an image (B14) apply no earlier than 21 October 2026. Tagging in clips and Match clips (B15) apply no earlier than 28 October 2026.
Sections 3–12 list each processing operation separately. Each card states the purpose, the data involved — including data generated as you use the app, such as points and view statistics — the legal basis under Article 6 GDPR, recipients, retention and who is responsible. Providers processing data on our behalf are referred to by category (for example “our email provider”); section 13 names them and shows where they process the data. Where the basis is legitimate interests, the interest we rely on is stated; you can request a copy of the balancing assessment via dataskydd@breakoutsports.se.
One important difference applies if you are under 18: we do not rely on contract as the legal basis, because a person under 18 has limited capacity to enter binding contracts. Instead, the core processing rests on a documented balancing of interests, for which the safeguards in section 9 are a precondition. Data you choose to add is always optional: all a player account requires is an email address or mobile number, password, name and date of birth. Leaving anything else blank only affects how your profile appears — never your access to the app.
Create and administer a user account so that you can sign in, recover a forgotten password and access your own data. How the account was created is also used to count, without names, how many people per sign-up method complete registration.
Who it concerns
All users
Personal data
Email address, password in hashed form, internal user ID, time of email verification, how the account was created (for example with email, Apple or Google), language preference, country, and the time and version of terms acceptance. The country governs which age limit applies and is set at registration.
Legal basis
Performance of a contract (Art. 6(1)(b))For users under 18 we do not rely on contract, because a minor cannot enter a binding contract without their guardian’s approval.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to offer 13–17-year-olds the sports service they sought out themselves, with the safeguards for minors described in section 9.
Recipients
No external recipient — the data is stored with our hosting provider within the EU/EEA, and our email provider handles delivery of the verification code. The providers are named in section 13.
Retention
Retained for as long as the account exists. On deletion the data is removed after a 30-day grace period.
Confirm that the email address belongs to you — when you register and when you add or change the address on your account — so nobody can tie an account to someone else’s address.
Who it concerns
All users
Personal data
Email address, six-digit one-time code, validity period and number of attempts. During a registration in progress also the password in hashed form, the terms choice and any referral code. A code for an address you add or change to is stored only in hashed form.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Preventing accounts from being created on other people’s email addresses.
Recipients
Our email provider (delivery of the code).
Retention
The code is valid for 15 minutes. A registration that is not completed is deleted no later than one day after the last activity. Expired codes are deleted every night, no later than two days after expiry.
Responsibility
Breakout is the controller
A3Create and verify a trainer, scout or club account
Purpose
Create an account for a trainer, scout or club and check that the person or organisation really is who they claim to be, before access to player profiles is granted.
Who it concerns
Trainers, scouts and club representatives
Personal data
Organisation, job title, licence details (type, licence number, expiry), an uploaded licence or certificate document as a PDF or an image — a screenshot of the licence is enough, which also means the document more often contains more than the licence itself — review status, and the reviewing administrator and their notes. For club accounts also club name, company registration number, contact person, phone number, address and postcode.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Protecting players, especially minors, by checking who is allowed to search for and view their profiles.
Recipients
The document is stored encrypted with our file-storage provider within the EU/EEA and is only reachable via time-limited links valid for 30 minutes. Breakout’s administrators and support staff.
Retention
The document is retained for as long as the verification applies and the account exists. We do not request a copy of an identity document — only a licence or certificate evidencing the authorisation.
Assign and administer roles and permissions, including clubs’ trainer licences, so that each user only reaches what belongs to their role.
Who it concerns
All users
Personal data
Role, administrator and manager flags, whether staff have let the account test sports not yet launched, the link between a club account and a trainer account, and the licence status. When a club invites an account that already exists we also store who sent the invitation, when it was sent and when it was answered. For the club’s overview of its own trainers also the number of sign-ins and the time of last activity.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Ensuring that only authorised parties gain access to player data.
Recipients
The club account sees this data about its own trainers.
Retention
Retained for as long as the account exists. An invitation nobody answers is deleted after 14 days.
Keep you signed in, handle password resets, and be able to sign out every device if an account is suspected of being compromised.
Who it concerns
All users
Personal data
Access tokens, IP address and user agent for sessions, and one-time password-reset codes with validity period and number of attempts.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Protecting accounts against unauthorised access.
Recipients
Our email provider when a reset code is sent.
Retention
Reset codes are short-lived and are deleted every night, no later than two days after expiry. An access token remains valid until you sign out or we revoke it.
Being able to demonstrate that you accepted the terms of service and read the privacy policy, and which version applied.
Who it concerns
All users
Personal data
Type of acceptance, whether it was given, version identifier, timestamp, and IP address and user agent.
Legal basis
Legal obligation (Art. 6(1)(c))Accepting the terms of service is not in itself consent under the GDPR. We log the acceptance to meet our accountability obligation under Art. 5(2) and Art. 7(1).
Recipients
No external recipient — the log is stored with our hosting provider within the EU/EEA.
Retention
IP address and user agent are removed after 12 months. The acceptance itself — type, version and timestamp — is retained for as long as the account exists.
Let a user apply to change account type — for example from player to trainer — and let us assess the application before the change is made.
Who it concerns
Users applying to change role
Personal data
The current and requested role, a free-text motivation the user writes themselves, the status of the application, who decided it and when, and any reason given on rejection. The free-text field is required and is read by us — what it says is up to the user.
Legal basis
Performance of a contract (Art. 6(1)(b))
Recipients
Our administration.
Retention
Retained for as long as the account exists, as a record of why a role was changed.
Responsibility
Breakout is the controller
If you are 13–17
Some roles cannot be applied for by anyone under 18 — the application then cannot be submitted.
Let you create an account and sign in with an account you already have, instead of choosing yet another password.
Who it concerns
Users who choose to sign in with Apple or Google
Personal data
Which provider was used, the user ID the provider gives us for Breakout specifically, and the email address present when the link was made. We never receive the password. If you use Apple’s option to hide your address, we receive a relay address instead of your real one.
Legal basis
Performance of a contract (Art. 6(1)(b))The processing takes place so you can sign in the way you chose. If you choose email and password instead, it does not take place at all.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving the young person a way to sign in that does not require yet another password to remember, which is the most common reason an account becomes inaccessible.
Recipients
Apple and Google respectively, as identity provider for the sign-in you start yourself (named in section 13). Data goes to them only at the moment you sign in, and they receive nothing about what you do in the app or on the website. On the website only Google is offered, as a redirect to Google’s own sign-in page: none of our pages loads anything from Google. Breakout’s support staff see which sign-in methods are linked to the account and which email address the provider gave, so they can help you if you cannot get in.
Retention
The link is retained for as long as the account exists or until you disconnect the provider. It is deleted when the account is deleted.
Responsibility
Breakout is the controller
If you are 13–17
Age is checked in Breakout and not at the provider. An account created via Apple or Google goes through the same age question and the same limits as one created with email — the sign-in method is never a way around them.
Let you create an account, sign in and reset a forgotten password with your mobile number instead of an email address, and confirm with a one-time code by text message that the number is yours.
Who it concerns
Users who choose to use a mobile number, or who add a number to their account
Personal data
Mobile number, when the number was verified, six-digit one-time code, validity period, number of attempts and when the code was last sent. During a registration in progress also the password in hashed form, the terms choice, any referral code and language preference. For the account we store that it was created with a mobile number. A code for a number you add or change to is stored only in hashed form.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))The processing only takes place if you choose a mobile number yourself. If you choose email, Apple or Google, it does not take place at all.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving young people a way to create an account and get back in that does not depend on an email address they rarely read, and preventing accounts from being tied to someone else’s number.
Recipients
Our SMS operator delivers the code (named in section 13). It is a Swedish telecoms operator and an independent controller for the delivery under the Electronic Communications Act; it keeps the traffic data the law requires but not the message. The number is never shown to other users, except when you share it yourself: from 21 October 2026 you can choose to share it with the verified scout or trainer whose contact request you accepted (D8). Breakout’s support staff can see the number and look up the account by it, so they can help you if you cannot get in.
Retention
The mobile number is retained for as long as the account exists and is deleted with it. The code is valid for 10 minutes. A registration that is not completed is deleted no later than one day after the last activity, and expired codes are deleted every night, no later than two days after expiry.
Responsibility
Breakout is the controller
If you are 13–17
The mobile number is never visible to others — not to scouts, trainers or clubs either — unless the player shares it themselves. From 21 October 2026 a player, including one under 18, may choose to share their confirmed number with the verified scout or trainer whose contact request they accepted, and a guardian may share their own; nothing is preselected (D8). The age question and the limits are the same whether the account is created with email, a mobile number, Apple or Google.
Show who you are in the app with a name and profile picture, and determine your age because it governs which safeguards apply to the account.
Who it concerns
All users except club accounts
Personal data
First name, last name, exact date of birth, gender (optional) and profile picture. Derived: your age, which is calculated from the date of birth and not stored separately.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Providing the player profile the young person created the account for, with the safeguards for minors switched on from the outset.
Recipients
Other users, according to your visibility settings. The profile picture is screened automatically by our content-screening provider (EU) — see sections 8 and 13.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
If you are 13–17
The first time a date of birth is entered for someone under 18, the account is set to private and visibility to scouts and trainers is switched off. The age then follows the visibility of the profile: while the account is private, outsiders see no age at all, and those you let in — followers you have accepted, verified trainers and scouts you have opened up to, and you yourself — see your age in years.
Let you complete your player profile with the sports details you choose yourself, so the profile shows what you want it to show.
Who it concerns
Players, trainers and scouts
Personal data
Position and other positions, club and club history, league or division, shirt number, preferred foot (in floorball, stick hand instead), strengths and weaknesses, bio, height, weight, nationality, region and city. For trainers and scouts also licence details, specialisations, years of experience and scouting networks.
Legal basis
Performance of a contract (Art. 6(1)(b))Every field is optional. Leaving them blank only affects how well your profile appears in search — never your access to the app.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting the young person decide for themselves what the profile shows, which is the service they sought out.
Recipients
Other users, according to your visibility settings. City and region are never listed as details on your profile, but they are used in search, under “Players near you” (B10), for the clip suggestions in the Home feed (B9) and when we send a message to everyone in a city or region (H3). There the other person’s own town is shown as the reason — for example “Near you in Borås” — which makes it apparent that you live in the same place. Search, including by city and region, is open to everyone who is signed in.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
If you are 13–17
Also applies to 13–17-year-olds who have made their account public themselves: they can appear under “Players near you” and with the location reason in the Home feed for others in the same town. A private account — the default for everyone under 18 — never appears under “Players near you”, and its clips reach only approved followers, a linked guardian, the coach of a team the player belongs to and — if the player has switched on Visible to scouts or Visible to trainers — verified scouts or trainers respectively.
Store and display the training clips you choose to publish.
Who it concerns
Players, and other people appearing in the clips
Personal data
Video file and thumbnail, title, description, location if you provide one, and the classifications you choose: position, skill category, match context, foot, phase of play, level, your own attribute words, type of clip, what happens in the clip, shirt number and shirt colour, game format, camera angle, opposition level and recording date. None of the selectable values says anything about your health. Generated: internal video ID, counters for likes, comments and views, and the clip’s duration and picture size. The recording date is prefilled for you from the file’s own creation date where there is one — you can always change it. From the recording date and your date of birth we also derive how old you were in the clip.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Providing the core feature — publishing and displaying training clips — for the young person who created the account for exactly that.
Recipients
Other users according to your settings. The video file is stored with our file-storage provider within the EU/EEA and screened automatically (see section 8).
Retention
Retained until you remove the clip or delete the account. The file is then also removed from the file-storage provider.
Responsibility
Breakout is the controller
If you are 13–17
How old you were in the clip follows the same rule as the age on your profile (B1): while the account is private outsiders do not see it, and those you have let in do.
Let you comment on, like, follow and block other users.
Who it concerns
All users
Personal data
Comment text with thread structure and any edit timestamp, likes, follow relationships per sport, follow requests and blocks. Your name and profile picture are shown alongside what you write.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Enabling the social interaction around content that the user sought out the service for.
Recipients
Other users. Blocks are only visible to the person who blocked. Breakout’s administrators and support staff see comments, likes, followers and blocks when reviewing an account (J4).
Retention
Comments are retained until you remove them or delete the account. A comment you remove disappears for others straight away but stays with us, where staff can read and restore it, until the account is deleted.
Count how many times a clip has been viewed and calculate what is popular right now.
Who it concerns
All users
Personal data
One row per view with video ID, user ID where available, a session identifier and how long the clip was watched. Separately, how often a clip was shown in each feed is counted per day — those rows hold no information about who saw it. Generated: aggregated counters per clip and a trending score.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to show relevant content and give the uploader feedback on its reach.
Recipients
Aggregated counters are shown to other users. Individual view rows are never shown to others. How often a clip was shown in the feeds is visible only to the person who uploaded it. The coach of a team you belong to sees the number of views of your clips for the last week or month (D9). Clips you have already watched come last among the clip suggestions in the Home feed (B9).
Retention
Individual view rows are deleted after 12 months, feed-impression counters after 13 months. Aggregated per-clip counters are retained.
Order the content in the Latest, Popular and Following tabs, and apply your choice of gender-matched feed if you made one.
Who it concerns
All users
Personal data
Trending score per clip, your follow relationships, your sport selection, your blocks and the gender-matched feed setting.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Showing content that is relevant to you, without profiling you for advertising purposes.
Recipients
Other users, but never content from a private account: clips from private accounts appear in Latest and Popular only to those who follow the account, to a linked guardian and to the account itself. Verified scouts and trainers the player has let in reach the clips through search and the Home feed, and the coach of the player’s team through the profile — never through these tabs.
Retention
The trending score is recalculated every hour and replaced.
Responsibility
Breakout is the controller
Automated processing
Popular is ranked automatically based on views, likes, comments, new followers and how many trainers and scouts have viewed the profile, with weight decaying over time (seven-day half-life). This concerns the popularity of content, not individual advertising profiling. There is no advertising and no ad SDK in the app.
Let you share a link to an individual clip outside the app.
Who it concerns
Players who share a clip
Personal data
The clip’s title, description, thumbnail and video file, plus the uploader’s name and profile picture.
Legal basis
Performance of a contract (Art. 6(1)(b))The feature is not available to minors: a share link does not work if the uploader is under 18 or has a private account.
Recipients
Anyone who has the link.
Retention
The link stops working when you remove the clip or make the account private.
Summarise your own activity day by day so you can follow how your account develops over time, even after the underlying rows have been pruned. Between 1 December and 31 January the year is also shown as “Your year”: a few cards only you see, built from this summary together with your own clips, your XP (C1), your matches (E9) and your training log (C7). The daily check-in and absence reasons are never included, and nothing is turned into comparisons with others.
Who it concerns
Players
Personal data
One row per day and sport with number of views, unique viewers, total watch time, likes, likes from scouts and trainers, comments, profile visits, number of people who visited the profile, new followers, total follower count, watchlist additions, published clips and how often the clips were shown in the feeds. No other users’ names are included.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
So you can see your own development over a longer period than the individual rows are kept. The summary is less intrusive than the raw data it replaces: it contains only counts, no information about who did what.
Recipients
Only you see the summary, and it is not used in feed ranking. The coach of a team you belong to sees some of the same figures for the recent period, counted directly from the view and visit rows — see D9.
Retention
The summary is deleted after 36 months, or when you delete your account. Outliving the individual rows is its whole purpose — otherwise your history would disappear after a year.
Select and order other users’ clips in the Home feed based on what you have entered and done in the app, and show under the clip why it is suggested when the suggestion is based on a reason. Our team may also feature a clip as Clip of the week.
Who it concerns
The person opening the Home feed, and the players whose clips are suggested
Personal data
About you: role, active sport, who you follow, position and other positions, league, club, city and region, date of birth, the tags on your own clips — or the strengths you entered if you have not uploaded anything — and which clips you have watched in the last 90 days, so they come last. For trainers and scouts instead your saved clip searches, your watchlist and the tags on clips you liked; for guardians your linked children. About the uploader: the details that decide whether the clip fits — position, league, city, region and whether their date of birth is within two years of yours. Generated: a temporary suggestion list with one reason for each clip a named group picked.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Showing you clips that are relevant to you, without advertising profiling. The balance rests on every suggestion based on a reason showing it, on the list not being stored, on the same visibility rules applying as in search, and on the Latest, Popular and Following tabs remaining without personalisation.
Recipients
The viewer sees the clip and the reason. The reason can say something about the uploader: “Near you in {city}” and “In {region}” show that they live in the same town or region as you, and “Your age” that they are at most two years older or younger. Clips from a private account are suggested only to those already allowed to see them: approved followers, a linked guardian and — if the account has switched on Visible to scouts or Visible to trainers — verified scouts or trainers respectively. A clip featured as Clip of the week is shown at the top for everyone allowed to see it, with name and profile picture.
Retention
The suggestion list is not stored. It is calculated when you open the Home feed and kept for at most 15 minutes in a temporary cache; the first page is kept on your phone until you sign out. The data it is built from is kept according to its own entries.
Responsibility
Breakout is the controller
Automated processing
Suggestions are chosen automatically from named groups — for example same position, same league, near you or your age — and the group that weighs most is shown as the reason under the clip. After them come the other clips you are allowed to see, newest first and without a reason. Clips you have already watched come last. This is profiling, but it is used only to order content in the app, never for advertising, and has no legal or similarly significant effects on you.
If you are 13–17
Clips from accounts under 13 are never suggested. If a 13–17-year-old has made their account public, their clips may be suggested to anyone, including with the location and age reasons. A private account — the default under 18 — reaches only those listed above.
Show players with a public account in the same city, region or country you entered yourself, so you can find and follow players nearby.
Who it concerns
Players with a public account, and the viewer
Personal data
Your own city, region and country — or your nationality where no country is set. For each player shown: name, profile picture, sports profile and whether they live in the same city, the same region or only the same country as you; your own town is the heading on the card. Recently active players are shown first.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting players find other players nearby. The balance rests on only public accounts being shown, on no exact location or coordinates being used, on blocks applying both ways, and on anyone who does not want to appear here being able to make their account private.
Recipients
All signed-in users who have entered a city, region or country themselves — players, guardians, trainers and clubs, and scouts with premium.
Retention
The list is calculated on each request and is not stored.
Responsibility
Breakout is the controller
If you are 13–17
Accounts under 13 and private accounts — the default for everyone under 18 — are never shown. A 13–17-year-old who has made their account public can be shown to everyone signed in in the same town, region or country.
Preselect the question “What does the clip show?” when you upload a football clip, so you don’t have to fill it in yourself. The preselection is only made when it can be told reliably (a match clip, or football on the street or at home) and you can always change it. Applies no earlier than 21 October 2026.
Who it concerns
The uploader, and the people visible in the clip
Personal data
Six small still frames from the clip, taken on the phone when you pick it. From them only the number of people visible and whether the setting looks like a street are worked out — never age, gender or who anyone is.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Making uploading quicker. The balance rests on nothing being stored, only a suggestion coming back, and the same provider already screening every uploaded clip (F1).
Recipients
Our automated content-screening provider, the same as in F1 (named in section 13).
Retention
Nothing is stored. The frames are sent, analysed and dropped in the same request; neither the frames nor the analysis are kept by us, and only the suggestion goes back to the app.
Responsibility
Breakout is the controller
Automated processing
The suggestion is automatic but is only a preselection in the form; nothing is published and you decide.
If you are 13–17
The same for 13–17-year-olds: the frames are not kept and nothing about the people in the clip goes any further.
Let you as a player apply for a check next to your name showing that our staff have confirmed you are a real person and that your name and club are right, so scouts, trainers and others can trust the profile. The check says nothing about how good you are, and applying is voluntary. Applications open no earlier than 21 October 2026.
Who it concerns
Players who apply, and in the review also their linked guardians and the coaches of their teams
Personal data
The application: when you applied, its status (pending, approved or rejected), which member of staff decided it and when, and on a rejection the reason, which you are shown. The check: when you were verified. Whether you meet the requirements to apply is worked out from the profile each time and not stored: profile picture, name and date of birth filled in, at least three approved clips, a confirmed email address or mobile number, and an account at least 30 days old. In the review, staff see your profile picture, your name, date of birth and age and whether you are under 18, sport, club and position, when the account was created, your latest approved clips, which teams you play in, who coaches them and whether they are verified, and the names of linked guardians and whether their identity has been checked.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))Contract for an adult player who applies. Legitimate interests for 13–17-year-olds and for the details about guardians and coaches that staff see in the review.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving the player the verification they applied for themselves, and protecting scouts, trainers and other players from fake profiles. The review relies on what the account already shows and no identity document is requested. In the app the check is never shown to anyone who may not open the profile, and it disappears when the name or club changes.
Recipients
The check: everyone who sees your name in the app — on the profile, in feeds and search, in comments, follower lists and the scout radar — and on the image of your player CV if you share it (B14). Anyone who may not open a private profile sees no check for that player anywhere — not on the profile, in search or next to the name on a comment. Someone searching for players can choose to see only verified ones (D2), and a private profile the searcher may not open is then left out. The application and the evidence: Breakout’s administrators and support staff (J4).
Retention
The check stays until you change your name or club or until staff remove it; you can then apply again. After a rejection you can apply again after 14 days. The applications, with the reasons for rejections, are kept for as long as the account exists and are deleted with the account.
Responsibility
Breakout is the controller
If you are 13–17
The same requirements and the same review for 13–17-year-olds. On a private account — the default under 18 — only those you have let in see the check in the app, also next to your name on a comment, and only they find you when searching for verified players. Staff see that you are under 18 and which guardians are linked, but the guardian does not have to approve the application and is not told about it.
Let you share your player CV for the active sport as an image in other apps, for example as a story. Applies no earlier than 21 October 2026.
Who it concerns
Players who choose to share
Personal data
Your name and profile picture, sport, position, club and level, the check if you are verified (B13), up to six details from the profile (for example league, previous clubs, height, shirt number, preferred foot and nationality), up to three strengths and three figures: matches, goals and assists if the season’s matches are registered, otherwise the number of clips, likes and your average rating from scouts and trainers (D6) or the number of followers. Never age, town or weight. An app without support for the image shares a line of text with a link to breakoutsports.se instead.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
So you can show your player profile outside the app if you want to. The image is made on the phone, previewed, and shared only when you tap share.
Recipients
The apps and people you choose to share with yourself. We do not receive the image and do not keep it.
Retention
Nothing is stored by us: the image is made on the phone and leaves the app only when you share it.
Responsibility
Breakout is the controller
If you are 13–17
The same for 13–17-year-olds, even with a private account. The image then shows details that a private profile otherwise shows only to those you have let in, for example club and position. Age, town and weight are never included, and you decide whether and where the image is shared.
Let whoever uploaded a clip — a player or a trainer — tag players from their own teams who appear in it, and let the tagged player decide for themselves whether the clip is shown under Match clips on their profile. Applies no earlier than 28 October 2026.
Who it concerns
Players who are tagged, and the player or trainer who uploaded the clip and tags them
Personal data
The tag: which clip, who is tagged, who tagged them and when, its status (pending, approved or declined) and when the tagged player answered. The request to the tagged player: an in-app notification and a push notification with the name of the person who tagged them (H2, H3). Generated: the Match clips tab on the tagged player’s profile, which is put together from the approved tags and not stored separately.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))Contract for what an adult does themselves: tags in their own clip, or approves a tag so the clip shows on their own profile. Legitimate interests for the request to the tagged player before they have answered — which they did not ask for themselves — and for 13–17-year-olds.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting teammates show clips in which several of them appear, without anyone ending up on someone else’s profile against their will. Only players on the uploader’s own teams and in the clip’s sport can be tagged, only in clips that have passed moderation, and at most ten per clip. Nothing shows on the tagged player’s profile until they say yes. A no stands, so the same player cannot be asked again about the same clip, and the tagged player can remove an approved tag at any time.
Recipients
The request: the tagged player. The uploader sees every tag on their clip and whether it is pending, approved or declined, and can remove one that is pending or approved. Nobody else sees who is tagged in the clip. Match clips on a profile are seen only by someone who may open the profile — a private profile shows them only to those you have let in — and each clip only if the viewer may also see it on the uploader’s settings (B3) and the clip has passed moderation. Someone who has blocked you, or whom you have blocked, cannot tag you.
Retention
The tag is deleted when the clip is deleted or when either account is deleted, and when the uploader removes it. A declined tag — including an approved one you have removed — is kept for as long as the clip exists, so that you cannot be tagged in it again. Tags are included in the data export: those you are tagged in and those you made yourself.
Responsibility
Breakout is the controller
If you are 13–17
The same rules for 13–17-year-olds. You decide yes or no yourself — your guardian does not have to approve and is not told about the tag. A private account, the default under 18, shows Match clips only to those you have let in. Who is tagged is never shown on the clip itself, only under Match clips on your own profile.
Breakout includes game elements that help you follow your development: experience points (XP) for activities, levels calculated from the points, achievements for milestones, and streaks for consecutive days. The cards below show exactly what data this creates and what is visible to others.
Show all 9 processing operations in detail
C1Experience points, levels, achievements and streaks
Purpose
Let you follow your own development in the app over time.
Who it concerns
Players
Personal data
Experience points (XP) you earn from activities in the app, such as uploading a clip, gaining a follower or being viewed by a scout. One history row per point-earning event with amount, event type and what caused it. Level and level tier calculated from the points. Achievements you have unlocked. Streaks: how many consecutive days you have been active in a sport, and — if you use the check-in — how many consecutive days you have done it (see C6).
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving the young person feedback on their own development, which is one of the features the account was created for.
Recipients
Level, level tier and total points are shown to other users on your profile. The history behind the points is shown only to you.
Remind you to complete your profile, and award points once it is complete.
Who it concerns
Players with an incomplete profile
Personal data
Which fields are missing, the time of the last reminder, the number of reminders, and whether points for a completed profile have been awarded, per sports profile.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Helping you get a profile that works for its purpose, with a cap on how often we remind you.
Let the player rate each morning how their body feels, and derive a daily figure and a personal baseline to compare against — so the player can see their own patterns over time.
Who it concerns
Players who switch the feature on themselves, and in some cases their guardians filling it in for them
Personal data
Hours of sleep, plus ratings on a five-point scale of sleep quality, fatigue, muscle soreness, mood and stress. An optional note about the day. Whether the player marked themselves available to train. Date, time zone and the time the answer was given, plus the time consent was given. Derived and stored: a daily figure calculated from the ratings, which formula version was used, a baseline calculated from the player’s own earlier answers, and the deviation from it. Every row records both who the answer is about and who submitted it, so a guardian can fill it in for a younger child. The ratings and the note are data concerning health. In addition a streak that belongs to you rather than to a sport: how many days in a row you have done the check-in, your longest streak and the date of your latest check-in — never what you answered.
Legal basis
Consent (Art. 6(1)(a))Explicit consent under Art. 9(2)(a). The feature is off until the player switches it on, the consent is logged with a timestamp on every row, and it is withdrawn by switching the feature off. No other part of the app requires it — had it done so, the consent would not be freely given.
Recipients
Nobody but the player, unless the player expressly shares with their team — see E8. A guardian with an approved link sees the summary for children under 16, and the individual answers and the note only for children under 13.
Retention
Three clocks, the shortest for the most sensitive. The player’s own note is deleted after three months — it is the one field where someone can write something we never asked for, such as a diagnosis or a family situation, and no purpose needs it three months later. The ratings are emptied after twelve months while the row remains with its date and its daily figure, because that is what a personal development curve is made of. The row itself is deleted after three years. Everything is deleted the moment the account is deleted. If you switch the check-in off, your answers and your streak are deleted immediately, and sharing with your teams ends. If you pause it instead, your consent and answers stay with the same time limits, but you get no questions or reminders until you turn it back on.
Responsibility
Breakout is the controller
If you are 13–17
Most people using the feature are aged 13–17. Age governs what a guardian may see: under 13 the guardian sees everything including the note, from 13 to 15 only the summary, and from 16 nothing unless the young person shares it themselves. The line exists so that a 15-year-old can write the truth about how they feel without it reaching home — a check-in the parent reads is a check-in nobody fills in honestly.
Let the player log how long and how hard each session was, and derive the week’s total load and how it compares with the weeks before.
Who it concerns
Players who log their sessions, and in some cases guardians logging for them
Personal data
The session’s date, time zone and type, which sport it was, its length in minutes and an exertion rating on a ten-point scale. An optional note about the session. Whether the session was logged after the fact. Which of the team’s events the session belonged to, where it did. Derived and stored: the session’s load as length times exertion, and weekly totals calculated from the rows.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving the young person a picture of their own training volume over time, and the coach a basis for planning the week without adding more work than the body has kept up with.
Recipients
The player sees everything. A guardian with an approved link to a child under 13 can log sessions for the child and read the child’s sessions and weekly totals, but never the note; for children aged 13 and over the guardian sees nothing. A coach of a team the player belongs to sees the weekly total per player and how much of it came from the team’s own sessions — never the individual sessions, their type, their dates or the note. A session logged outside the team therefore appears only as part of a weekly total. For one of the team’s own sessions the coach also sees how many logged it and, once at least three have, their average, lowest and highest exertion, without names. Expressly not the club, not even for teams the club itself owns. Load is never presented as a risk or a warning.
Retention
The note on a session is deleted after three months, on the same clock as the check-in note: "knee has hurt since Tuesday" is a sentence about a body whichever table it is written in, and the table it landed in must not decide how long we keep it. The rest of the session is performance data of the same kind as attendance and is kept until the account is deleted — the whole point of a development curve is that it outlives the weeks it was measured in. Everything is deleted when the account is deleted.
Responsibility
Breakout is the controller
If you are 13–17
A guardian can log a session for a child under 13, and the row then records both who the session is about and who wrote it. The note belongs to the child, even when the guardian wrote it, and is not shown to the guardian.
Let a coach draw up drills and moves and save them for the next session.
Who it concerns
Coaches who create tactics boards
Personal data
The board’s name, which sport it is for, and the drawing itself: the positions of the pieces, arrows, lines and colours. Each piece may carry a label of at most three characters — a shirt number or a pair of initials — which is not room for a name or a message, and is why the board does not need to be screened as content.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Providing the drawing feature the coach chose to use.
Recipients
Nobody. A board is visible only to whoever created it — the server refuses every attempt to read someone else’s.
Retention
Retained until the coach removes the board or deletes the account.
Let a coach write their own drills and use them in their training plans, and, if the coach wants, publish them in a library where other coaches can find, use and vote on them.
Who it concerns
Coaches who write their own drills, and users who vote on a drill.
Personal data
The drill’s text (title, description, purpose, setup, area, how it is done, time and number of players), any tactics board, which sport it is for, whether and when it was published, and whether it has been deleted. For whoever votes: the vote, like or dislike. Generated: the number of likes and dislikes, the number of reports, and, for the coach who wrote the drill, how many other coaches and plans use it.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Providing the drill feature the coach chose to use, and a library where coaches share drills with one another.
Recipients
An unpublished drill can be read by those on a team with the coach, which is how the team sees it in a training plan. A published drill is visible to every signed-in user, without the name of whoever wrote it. Votes are shown only as counts, and nobody sees who voted. Reports of drills are handled under F2 and F3.
Retention
Retained until the coach deletes the drill or the account. When a drill is deleted, its text and tactics board are erased at once. Only the fact that the drill existed remains, so that plans using it can show that it was removed. A vote is kept until it is withdrawn or the account is deleted.
This is the core of Breakout: players being seen by trainers, scouts and clubs. It is also where your choices matter most. Verified trainers and scouts differ from ordinary users in that we have manually reviewed their identity and credentials, and in that they have search and monitoring tools others do not. What they can see is governed by your settings.
Make your profile and clips available to verified trainers, scouts and clubs, so that you can be discovered.
Who it concerns
Players
Personal data
Name, profile picture, age, gender, nationality, height, weight, the entire sports profile, your clips, and counters for followers, likes and number of clips.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Offering the exposure to trainers and scouts that is the whole point of the young person creating the account, limited by the safeguards for minors.
Recipients
Verified trainers, scouts and club accounts. What sets them apart from other users is that these accounts have been manually reviewed by us and have access to search and scouting features that ordinary player accounts do not.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
If you are 13–17
Accounts for 13–17-year-olds are private by default, and the settings Visible to scouts and Visible to trainers are OFF by default. A minor is therefore not visible to trainers and scouts outside their own teams until they switch visibility on themselves. If they make the account public, the profile and clips are visible to everyone who comes across them, but scouts and trainers still cannot find them in search, the radar or suggestions while the setting is off. The default is applied the first time a date of birth is entered. A verified coach of a team the player joined themselves sees the profile and clips regardless of the setting, and counts of views and scout visits, but never who (D9). The team does not make the player searchable for the coach.
Let users search for players and filter on the details the player entered themselves — for trainers and scouts as a tool for finding players, for others to find each other.
Who it concerns
Players
Personal data
Age, gender, nationality, city and region, position, preferred foot, height, weight, league and club. In the clip search also the clip’s own tags: type of clip, what happens in it, game format, camera angle, opposition level, the attribute words you wrote yourself, whether the clip points out a player by shirt number, and when it was filmed — both as a range and as a most-recently-filmed sort. No searchable detail concerns health.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting users find players matching what they are looking for, with an age floor of 13.
Recipients
All signed-in users; scouts need premium. Scouts and trainers only find players who have Visible to scouts or Visible to trainers switched on, among players and among clips alike, and a private account only if they are verified. The scout or trainer following the player does not change that. What a match shows follows the player’s visibility settings: a private account shows only name, profile picture, role, points and challenge placings to those not let in (B1).
Retention
The search itself is not stored, other than when the scout actively saves it (see D4).
Responsibility
Breakout is the controller
If you are 13–17
Players under 13 never appear in search results, and a specified age range cannot be set lower than 13.
Give scouts and trainers with premium automatically generated suggestions of players who are getting attention, right now or overall (the scout radar).
Who it concerns
Players
Personal data
Number of profile views from trainers and scouts over the last seven days, the total likes on the sports profile and views on clips since they were uploaded, and the player's trend score: a score per clip calculated from likes, likes from scouts and trainers, comments from others, views, new followers and profile views over the last 30 days, with older activity counting for less (halved every week). Hidden clips do not count. The player is shown with name, age, position, club, nationality, followers, likes and number of clips.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Highlighting players who are active — the feature scouts and trainers pay for and which gives players exposure, also in small clubs where the trainer is the one scouting.
Recipients
Verified scouts with premium, and from 21 October 2026 verified trainers with premium.
Retention
The lists are calculated continuously and are not stored.
Responsibility
Breakout is the controller
Automated processing
The suggestions are generated automatically, and each list has its own basis: Other scouts are watching is based on how many trainers and scouts opened the profile over the last seven days, Trending right now on the trend score above, Most viewed on the total views of the player's clips, and the Players in table on the total likes on the sports profile. No selection is made by hand. Appearing in a list is no promise of contact, scouting or recruitment.
If you are 13–17
Players under 13 are never included. A player is included only if they have Visible to scouts switched on (for a scout) or Visible to trainers (for a trainer). That applies to a public account too, and even if the viewer already follows the player. A private account — the default for everyone under 18 — is in addition included only for a verified scout or trainer. Someone who only switched on Visible to scouts is therefore not shown to trainers. Both settings are off from the start for everyone under 18.
Let a scout save a search for players or for clips, be notified when new players or clips match it, and see new matching clips in the Home feed (B9).
Who it concerns
Players matching the search, and players whose clips match a saved clip search
Personal data
Whether the search is for players or clips, the search filters, whether notifications are on, the time of the last notification and the number of matches at the last run. The notification about new players names up to five of them with name, position and club; the one about new clips gives only the number.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Preserving the scout’s work and notifying them when new players match the criteria the scout chose.
Recipients
The scout who created the search — as a push notification, in the notification list and by email via our email provider (section 13).
Retention
Retained until the scout removes the search or deletes the account.
Responsibility
Breakout is the controller
If you are 13–17
Players under 13 and their clips are never included. A player is included only if they have Visible to scouts switched on, even with a public account and even if the scout already follows them. A private account is in addition included only for a verified scout. The same rule as in search.
Let a scout or trainer keep their own notes on players, collect them in a watchlist and compare them with each other, and let a scout add dated reminders.
Who it concerns
Players
Personal data
Which player was added, a free-text note written by the scout, which players are set against each other in a comparison and in which sport, and the scout’s own reminders: title, any note, date and any time, which player the reminder concerns if any, when it was ticked off and when it was sent as a notification.
Legal basis
Legitimate interests (Art. 6(1)(f))The scout, trainer or club is the controller for their own notes and determines the purpose and legal basis. Breakout processes the data on their instruction under a data processing agreement.
Our legitimate interest
The scout’s or club’s interest in documenting their own assessment work.
Recipients
Only the scout, trainer or club who created the note. A reminder’s title is sent to the scout as a push notification. Who has a player on their watchlist or in a reminder is never shown to the player and is not included in the player’s data export, because that information primarily reveals the scout’s work. The export only contains the number of new watchlist additions per day, in the daily summary.
Retention
Retained until the scout removes the entry, or until either account is deleted. A reminder concerning a player loses its link to the player when the player’s account is deleted, but the title and note the scout wrote remain until the scout removes the reminder or their own account.
Let verified trainers and scouts rate a player’s attributes on five scales, and show the player an average.
Who it concerns
Players
Personal data
Ratings for defence, passing, strength, shooting and technique, who gave the rating, and in some cases a free-text comment. Generated: an average rating that is calculated and shown on the sports profile.
Legal basis
Legitimate interests (Art. 6(1)(f))The trainer, scout or club is the controller for their own assessment. Breakout is the controller for the average we calculate and display.
Our legitimate interest
The trainer’s or scout’s interest in documenting their assessment, and the player’s interest in receiving feedback on their development.
Recipients
The player sees ratings they have received. Other trainers and scouts see ratings on player profiles. Other players never see ratings. Breakout’s administrators and support staff see ratings given and received when reviewing an account (J4).
Retention
Retained until either account is deleted. You can switch off future ratings in settings; ratings already given can be hidden from the profile but remain in the system.
Show you which trainers, scouts and clubs have visited your profile.
Who it concerns
Players and the trainers/scouts who visit profiles
Personal data
One row per visit with who visited, who was visited, sport and timestamp.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving the player insight into who is showing interest, which at the same time makes scouts’ activity transparent to the person they are looking at.
Recipients
The player themselves, provided they have an active subscription. Aggregated statistics are also used in feed ranking and in player suggestions, and — as a count of distinct visitors from outside the team, without names — in the coach’s overview of their own players (D9). Breakout’s administrators and support staff can see individual visits — both who visited a player and which profiles a trainer or scout visited — when reviewing an account (J4).
Retention
Individual visit rows are deleted after 12 months. The number of visits per day lives on in your statistics summary (B8), without any record of who visited.
Let a verified trainer or scout send a contact request with a message to a player, and — if the player or their guardian wishes — give the sender a way to reach them once the request is accepted.
Who it concerns
Players, the sending trainers/scouts, and the guardians who share their contact details
Personal data
Sender, recipient, message text, status and when the response was seen. From 21 October 2026 also which contact details were shared (confirmed email, mobile number) and by whom. The addresses are not copied: they are read from the sharer’s account when the sender looks.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Enabling the contact that is the purpose of the service, inside the app where it can be moderated rather than outside it, and letting a player give a reviewed scout or trainer a way to reach them — a player’s chances should not depend on whether their parents use the app. The safeguards for 13–17-year-olds: only reviewed senders, nothing is preselected, a linked guardian is told what was shared and with whom, and the details disappear when the request is removed.
Recipients
The player and the sender. From 21 October 2026, a linked guardian of a player under 18 gets a notification with the sender’s name, role and organisation — never the message. From the same day the sender sees the contact details the player, or the guardian of a player under 18, chose to share when the request was accepted, until either of them removes the request. If a player under 18 shares their own, the linked guardian is told what kind of detail was shared and with whom, never the detail itself. Breakout’s administrators and support staff see who sent a request to whom and its status when reviewing an account — never the message (J4).
Retention
Retained until either account is deleted.
Responsibility
Breakout is the controller
If you are 13–17
From 21 October 2026, every guardian linked to a player under 18 is notified when someone sends the player a contact request. The notification says who sent it, not what it says. The player still answers it. A player under 18 may choose to share their confirmed email or mobile number when accepting; nothing is preselected and the app asks them to share only if they feel safe. If the player has a linked guardian, the guardian is told what kind of detail was shared and with whom. If the player shares nothing, the guardian is asked whether to share theirs. A player with no date of birth counts as under 18.
Show a coach how the players on their own teams are doing on the platform — who is getting views, reactions and interest from scouts — so the coach can support them. In clubs without a scout of their own, the coach does that job.
Who it concerns
Players who are members of a team the coach owns or co-coaches
Personal data
Per player and sport: name, profile picture, position, number of clips and which of the coach’s teams the player belongs to. For the last 7 or 30 days, compared with the period before: views of the player’s clips, likes and comments from anyone but the player, and the number of distinct scouts and trainers outside the coach’s own teams who opened the player’s profile. Also the trending score of the player’s most-watched clip. No names of those who viewed or reacted are included.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting the coach see which of their own players are getting attention and support them. The player joined the team themselves, the coach sees counts only and never who, and the figures are derived from data that already exists.
Recipients
Coaches who own or co-coach a team the player is a member of. Not the club account, not teammates and not guardians.
Retention
Calculated on each view from the rows in B5 and D7 and not stored, beyond a five-minute temporary cache.
Responsibility
Breakout is the controller
If you are 13–17
Also applies to players aged 13–17, whether or not the account is private or Visible to trainers is on: what decides it is membership of the team, which the player accepted themselves. The coach sees counts, never who.
In this section the club or trainer is the controller and Breakout the processor, unless stated otherwise. The club is responsible, among other things, for informing people whose names are added to rosters without them holding an account.
Data concerning health occurs in two places in Breakout, and both are voluntary and based on your explicit consent (Art. 9(2)(a)). The first is reporting an absence: you may choose to give Sick or Injured as the reason, and you tick a box stating who will see it before the reason is sent. You can remove it by answering again and skipping the reason, as long as the event has not been cancelled and you are still on the team. After that the answer cannot be changed, and the reason is deleted six months after the event — or earlier if you email us. An absence can always be reported without a reason (E7 below). The second is the daily check-in, which stays off until you switch it on yourself and which you can choose to share with your coach (C6 in section 5 and E8 below). If you switch the check-in off, your answers are deleted.
Let a trainer or club create teams, invite players and keep the team roster up to date.
Who it concerns
Players in the team and the team’s trainers
Personal data
Team name, description, team image, who owns the team, memberships with role and join date, and invitations with status.
Legal basis
Performance of a contract (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))The club or trainer is the controller and determines the legal basis — usually the membership agreement or the association’s legitimate interest. Breakout processes the data on their instruction.
Our legitimate interest
The club’s interest in administering its teams.
Recipients
The team’s members and the trainer or club administering the team. A club account additionally sees the teams created by trainers on the club’s active trainer roster, because the club pays for those seats — read-only, and not teams the owner has marked private. The visibility is derived from the roster each time and never stored as a grant, so it ends the moment the trainer leaves the club.
Retention
Retained for as long as the team exists. If the team owner deletes their account, ownership is transferred so the team can continue.
Let a trainer add the names of players who do not yet have an account, so the roster and squad selections are complete.
Who it concerns
People who have no Breakout account, usually children in the trainer’s team
Personal data
First and last name as free text, and position. If the person has been selected for a match, the coach may additionally record minutes played, goals and assists against the name — see E9, where that data is dealt with separately. It counts towards the team’s total playing time, because a total that leaves them out makes everyone else’s share too high.
Legal basis
Legitimate interests (Art. 6(1)(f))The club or trainer is the controller and, under the terms of service (section 5), must inform the person, or a guardian, that the name has been added. The form reminds them every time. Breakout processes the data on their instruction.
Our legitimate interest
The trainer’s interest in a complete roster and accurate squad selections.
Recipients
The team’s members and trainers.
Retention
Retained until the trainer removes the entry or the team is deleted, and at most until the entry has gone 12 months without being picked for an event. It is then deleted automatically, together with the squad picks and match data recorded against the name.
Let a trainer create training sessions and matches, collect attendance responses, remind those who have not answered, make squad selections and share a link to the match film.
Who it concerns
Players in the team and their guardians
Personal data
The event’s title, type, location, date and times, opponent and recurrence pattern, whether the event was cancelled, players’ attendance responses, and who was selected. Every response records both who the answer is about and who submitted it, so that a guardian can answer for their child — the trainer then sees the child’s name with a note of who answered. From those responses a per-player summary is derived for a chosen period: how many attended, how many were absent and how many did not answer. Where a player has voluntarily given a reason for an absence, that reason is included in the summary too — see E7, where the reason is dealt with separately. The summary can be narrowed to training sessions only or matches only, because they answer different questions. Where the event is a match, the coach may additionally record the result and playing time — see E9. The trainer can set an answer deadline — 6, 12, 24, 48 or 72 hours or a week before the start — and that anyone who has not answered counts as coming. Generated: whether a player’s first answer came after the deadline, which is worked out from when the answer was given and not stored separately. For the reminders we store only which event, which kind of reminder, when it went out and to how many — never to whom. On a match, the team’s coaches can add a link to the match film on Veo, YouTube or Vimeo; we store only the link and never fetch the film.
Legal basis
Legitimate interests (Art. 6(1)(f))The club or trainer is the controller.
Our legitimate interest
The club’s interest in planning and running the team’s activities.
Recipients
The team’s members and trainers, and guardians of players in the team. A club account sees the events of the teams the club has visibility into under E1 — which since August 2026 also covers teams created by the club’s own trainers and not marked private — but never the per-player summary. Club accounts are additionally refused event chat, realtime updates and answering attendance, each separately in the code. Whether an answer came after the deadline is shown to the team’s coaches in the attendance list. The reminder “You haven’t answered” goes as a push notification and an in-app notification to players who have not answered — once a squad is picked, only those picked — and to approved guardians of the minors among them: at most twice automatically per event (48 hours after the event was created but not earlier than a week before the deadline, and 24 hours before the deadline), and when the trainer taps Remind, which is possible at most once every six hours. It goes only to people who have push and event reminders switched on (H2), and never when anyone who has not answered counts as coming. The link to the match film is seen by everyone who sees the event.
Retention
Retained for as long as the team and the event exist.
Let clubs, trainers and scouts advertise tryouts and players apply, requiring guardian approval for the youngest.
Who it concerns
Players who apply and their guardians
Personal data
The tryout’s details (club, contact person, coach, address, city, gender, division, which positions are sought, number of places, age range, deadline and date), the application’s status and notes, and which guardian approved it and when. Generated: when the person who advertised the tryout first opened the application.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Connecting tryouts with players seeking them, with guardian approval as a safeguard for the youngest.
Recipients
Whoever advertised the tryout — club, trainer or scout. Where an approval was required, they also see the guardian’s name and email address. The applicant sees their own application’s status, when it was opened and when the decision was made. Breakout’s administrators and the marketing staff who run tryouts see applicants’ name, email address, date of birth, position and club and can change the application’s status.
Retention
Retained until the account is deleted.
Responsibility
Joint controllership
If you are 13–17
For players under 15 an approved guardian link is required and the guardian must approve the application. After approval there is a 24-hour delay before the club sees the application, so the approval can still be withdrawn.
Let someone follow their own team events in an ordinary calendar app instead of in Breakout, through a subscription link.
Who it concerns
Players, trainers, guardians and club accounts who have created a link themselves
Personal data
A random, secret string tied to the account, plus the events the account already has access to: title, type, location, date, times and whether the event was cancelled.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
That someone who wants to see their training sessions alongside the rest of their life should be able to. The link is created only at the user’s own request and can be replaced at any time, which immediately renders the old one useless.
Recipients
Nobody except whoever holds the link. Calendar clients cannot carry a login, so the link is itself the key — anyone who obtains it can read the schedule without signing in. It should therefore be treated like a password, and it can be replaced in settings.
Retention
The link exists until the user replaces it or deletes their account. The feed shows events from the last two months onwards.
Let whoever reports an absence voluntarily say why, so the coach can plan the session and take an illness or injury into account.
Who it concerns
Players in the team who choose — themselves or through their guardian — to give a reason
Personal data
One of the options Sick, Injured or Other, an optional message of up to 200 characters, and the time the consent was given. Sick and Injured are data concerning health. The message is free text and may contain whatever the person writing it chooses to write. The reasons are also totalled per player in the coach’s season overview: how many were sick, injured, other, or gave no reason.
Legal basis
Consent (Art. 6(1)(a))Explicit consent under Art. 9(2)(a) for the health data. Consent is given in the app, in a box that must be ticked before the reason can be sent, and is withdrawn by answering again without a reason — which deletes the reason, the message and the record of the consent. That is not possible once the event has been cancelled or the player has left the team, since the answer can then no longer be changed; the reason is then deleted by the pruning six months after the event, or earlier if you email us. The club or coach is the controller; the consent is obtained in the app on their behalf.
Recipients
The team’s coaches, and the player the answer concerns together with their linked guardian — who see the reason on their own row only. Expressly not the club: a club account never receives these fields, not even for teams the club itself owns. The other players and guardians in the team see names only, never the reason.
Retention
The reason, the message and the record of the consent are deleted six months after the date of the event, while the absence report itself remains — a coach plans around next week’s absences, not around who had a cold two seasons ago. They are also deleted the moment the answer is changed without a reason, and when the event, the team or the account is deleted. Giving a reason is never required — an absence can always be reported without one.
Responsibility
Breakout is the processor
If you are 13–17
Most people giving a reason are aged 13–17. The reason may be given by the player themselves or by a guardian answering for their child, and either of them can remove it again as long as the event has not been cancelled and the player is still on the team. No reason is required in order to report an absence, and skipping it has no consequences.
Let a player who wants to show their coach how their body feels, so the coach can adapt the session to how the squad actually arrived.
Who it concerns
Players who choose to share their wellness with a particular team
Personal data
What the coach sees is governed by the level the player chose. At the lower level: a colour band saying whether today’s figure is near or below the player’s own baseline, and whether the player has answered today. At the higher level, additionally: the daily figure as a number, the baseline, the deviation, the individual ratings of sleep, fatigue, soreness, mood and stress, and the player’s own note about the day. The choice itself is stored as a row with a timestamp each time it changes.
Legal basis
Consent (Art. 6(1)(a))Explicit consent under Art. 9(2)(a), given per team and per level. The default is that nothing is shared. Consent is withdrawn by turning the sharing off, and the coach loses access immediately. Not sharing has no consequences for the player’s place in the team.
Recipients
The coaches of the team the player chose, and nobody else. Expressly not the club, not teammates and not guardians — the latter is governed by the age rules in C6 and is unaffected by this sharing. A team trend is shown only when at least three players in the team share, because an average over one or two players is those players. For the same reason, a day on which fewer than three of them answered gets no average in the trend, only the number who answered.
Retention
The choice is stored as a history where the latest row applies, so it can be shown when sharing was turned on or off. The data itself is not stored a second time but read from the player’s own rows, and is therefore pruned on the clocks in C6 — a note older than three months cannot be shown to the coach either. Everything is deleted when the account or the team is deleted.
Responsibility
Breakout is the controller
If you are 13–17
Most people sharing are aged 13–17. The decision is the young person’s own and does not require a guardian’s involvement; sharing with the coach and sharing with home are two separate choices that do not affect each other.
Let a coach record how the match ended and how long each player was on the pitch, so the squad and the player themselves can see how playing time was distributed over the season.
Who it concerns
Players in the team, and people without an account listed on the roster — see E2
Personal data
About the match: home or away, type of match, the score for and against, and the match’s actual playing time in minutes. Per player: whether they started, came on, sat unused on the bench or were not there, minutes played, goals and assists, and who recorded the entry. Derived from this: the player’s share of the time they could have played, share of the team’s total playing time, number of starts, and goals or assists per ninety minutes.
Legal basis
Legitimate interests (Art. 6(1)(f))The club or coach is the controller. The data is performance data of the same kind as attendance — it says what a person did, not what their body is — and is therefore not covered by Art. 9.
Our legitimate interest
The club’s interest in following and showing how playing time is distributed, which is the question players and guardians ask most often, and the player’s own interest in seeing their season.
Recipients
The score is seen by the whole team, and by the club if the team belongs to the club under E1 — everyone present saw it. The distribution of minutes between players is seen only by the team’s coaches. The player themselves sees their own minutes, goals and assists and their share of the team’s total playing time, never a teammate’s row. That share is an aggregate and identifies nobody.
Retention
Retained for as long as the event and the team exist. That the data outlives the season is the intention — a development curve across three seasons is the whole point — and there is no free text here that would require a shorter period. The data is deleted when the account is deleted. For a person without an account it is deleted with their roster entry, see E2.
Responsibility
Breakout is the processor
If you are 13–17
The entry is written by an adult about a child, and the child sees it themselves in the app. That is deliberate: a figure about a young person that the young person cannot see is worse than no figure at all, and it therefore appears in the player’s own statistics the moment the coach saves it.
Screen every uploaded video, cover image and profile picture automatically, to prevent sexual, violent or otherwise inappropriate content from being published and contact details (phone numbers or messaging-app usernames) from being written into the image — above all to protect children. A clip with contact details is reviewed by a person before it is shown; a cover or profile picture with contact details is not accepted.
Who it concerns
Everyone who uploads content, and people appearing in that content
Personal data
Six still frames from each video are sent for analysis, of both the picture and any text in it. Generated and stored by us: which categories were flagged, the confidence per category and frame, whether contact details were found (only the kind, never the detail itself), the screening status, and the number of screening attempts.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Protecting children and other users from inappropriate content. The interest weighs particularly heavily because the service is directed at minors and hosts user-uploaded video.
Recipients
Our automated content-screening provider (EU, Stockholm — named in section 13). Breakout’s moderators.
Retention
The screening result is retained for as long as the clip exists.
Responsibility
Breakout is the controller
Automated processing
The screening is fully automated. The frames are analysed by our screening provider in Stockholm and no copy is retained by the provider. Flagged content is hidden and then reviewed by a human. You may request one re-review, and on repeated flagging the case is always escalated to manual assessment. The decision has no legal effect on you.
Receive and handle reports of clips, comments, users and drills that trainers share. Every report goes into a queue where our staff confirm or dismiss it. A confirmed report of a clip removes the clip from the feeds; a confirmed report of a person removes that person’s clips from the feeds and from what others see on the profile; a confirmed report of a drill hides the drill from others. A decision can be undone.
Who it concerns
Reporters and reported users
Personal data
Who reported, what was reported, the stated reason, the case status (pending, dismissed or confirmed), and which member of staff decided it and when. Staff see the name, email address and age of the reporter and the reported person. Generated: a counter of rejected clips.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Maintaining a safe service for minor users and being able to act on what other users report.
Recipients
Breakout’s administrators and support staff. The reported person is never told who reported them.
Retention
Retained for as long as the account exists and deleted with the account. Suspended accounts are not deleted while the suspension needs to be enforced. Reports of a clip are also deleted when the clip is deleted. You can withdraw your report of a clip as long as it has not been decided.
Responsibility
Breakout is the controller
F3Automatic hiding after a very large number of reports
Purpose
Remove a user’s clips, or a single clip, from the feeds and from what others see on the profile once a very large number of distinct users have reported it, pending review of the reports by our staff. The same applies to a drill a trainer has shared. Below that limit a report hides nothing until staff have confirmed it (F2).
Who it concerns
Reported users and their clips
Personal data
The number of distinct users who have reported a person or a clip, excluding reports staff have dismissed. For a clip we store that it was hidden, why and when.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to quickly limit the spread of content many users experience as harmful, before a human has had time to review it.
Recipients
Breakout’s administrators and support staff.
Retention
For a person the assessment is made on each request and is not stored. For a clip the marking is kept until staff have decided the reports or the clip is deleted.
Responsibility
Breakout is the controller
Automated processing
The measure is applied automatically only at a high threshold — by default 100 distinct users reporting the same person or the same clip. All reports also go into a queue for our staff, and if staff dismiss them the content is shown again. The decision has no legal effect and the account otherwise works as normal.
Breakout may be used from age 13. Player accounts for people under 13 are not permitted: registration is stopped when the date of birth indicates an age below 13, and if we discover such an account afterwards we delete it. Age is based on the date of birth you provide — we do not require identification, because a heavier check would process more data about every child than it protects. Once entered, the date of birth can only be changed with our approval.
We want to be honest about one limitation: at registration there is currently no technical check that a guardian has approved the account. Users aged 13–17 are expected to use the app with their guardian’s knowledge. The protection instead rests on the defaults below, on a guardian being able to link a guardian account with control over the child’s account at any time, and on guardians always being able to request deletion via dataskydd@breakoutsports.se. A verified approval mechanism is under development.
Link a guardian’s account to a child’s account, after one of them requested the link and the other approved it.
Who it concerns
Children and their guardians
Personal data
Which two accounts are linked, who requested the link, the status, and when it was answered. The link is made using the accounts’ internal IDs, and the two accounts must have different email addresses.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Giving guardians a real ability to exercise their responsibility for the child’s account — one of the safeguards that carries the balancing test for 13–17-year-olds.
Recipients
The two linked accounts. Breakout’s administrators and support staff see the link and its status when reviewing an account (J4).
Retention
Retained until either party removes the link or deletes their account.
Determine whether you are at least 13 and whether you are under 18, because age governs which safeguards apply to the account.
Who it concerns
All users who provide a date of birth
Personal data
Exact date of birth, which you provide yourself. Derived: your age.
Legal basis
Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to apply the minimum age of 13 and the stricter safeguards for minors. We need an exact date of birth because both the 13 and the 18 threshold must be determined reliably; an age bracket would not suffice. The information is not verified against any document — a heavier age check would mean processing more data about every child than it would protect.
Recipients
None. The age is used internally and shown on the profile according to your visibility settings.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
If you are 13–17
Player accounts for people under 13 are not permitted. Once a date of birth has been entered you cannot change it yourself — a change must be requested and approved by us, which gives traceability.
Set accounts for players under 18 to private from the outset and switch off visibility to scouts and trainers, so the child does not have to activate the protection themselves.
Who it concerns
Players aged 13–17
Personal data
The private-account, visible-to-scouts and visible-to-trainers settings, and your derived age.
Legal basis
Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Meeting the data-protection-by-default requirement in Art. 25 when the service is directed at children.
Recipients
None.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
If you are 13–17
The settings are applied the first time a date of birth is entered. You can change them yourself in settings, and a banner in the app explains that the account is private. Accounts created before the rules were introduced have not been changed retroactively.
Let a parent create a player account for their child aged 13 to 17, and set a new password for the child if they have forgotten theirs. Applies no earlier than 21 October 2026.
Who it concerns
Children aged 13–17 and their parents
Personal data
The child’s name, date of birth and email address, a password chosen by the parent which the child must change at first sign-in, the link to which parent account created it, and the parent’s statement that they are the child’s guardian (stored with time, IP address and device). We do not check the parent’s identity, for example with BankID.
Legal basis
Performance of a contract (Art. 6(1)(b))The parent’s own account rests on contract. Because we do not check that the parent really is the guardian, the child’s account rests on the same balancing of interests as for a 13–17-year-old who registered themselves — not on a contract with the guardian.
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Letting families start the child’s account together. The balance rests on the account getting the same protection as other 13–17-year-olds’ accounts (private from the start), on the child changing the password at first sign-in, and on the child always being notified when the parent sets a new password.
Recipients
The child receives the account. Our email provider delivers the sign-in details. The parent who created the account can set a new password for the child; the child is then always notified, signed out, and must choose their own password again.
Retention
The link to the parent account is retained for as long as the child’s account exists. If the parent’s account is deleted the link is removed but the child’s account continues to exist. The statement is kept as proof for as long as the parent account exists; IP address and device are removed after 12 months.
Responsibility
Breakout is the controller
If you are 13–17
Applies only to children aged between 13 and 18, and to a limited number of children per parent.
Beyond the cards above, for everyone under 18: clips from private accounts never appear in the public feeds for anyone but approved followers and a linked guardian; players under 13 are always filtered out of scouts’ search results and saved searches and out of scouts’ and trainers’ automated suggestions, and a 13–17-year-old only appears there if they have switched on Visible to scouts themselves (in trainers’ suggestions: Visible to trainers) — making the account public is not enough; share links outside the app do not work for minors’ clips; and we never use minors’ data for advertising or ad profiling — the app contains no advertising at all. The emails in H5 are not advertising: they come from us, concern our own service, are not based on any profile of you, and we do not measure how you behave in them. Nor are the website visitor statistics (section 12) advertising: they require your yes, they are configured so that they cannot be used for ads, and they do not exist in the app.
Send notifications to your device about activity concerning you.
Who it concerns
Users who enabled notifications
Personal data
Device token, device type, and when the token was last updated. Your notification settings: whether you want reminders before training sessions and matches and how far in advance they should arrive (the same setting governs the reminder when you have not answered an event, E3), whether you want to know when an event is moved or cancelled, whether you want to receive messages from the club, and for players whether you want the Sunday weekly summary, which also covers the once-a-year notice that your year is ready to see. The settings are included in the data export.
Legal basis
Consent (Art. 6(1)(a))Notifications are never enabled automatically. You give consent in the dialog shown by the operating system, and can withdraw it at any time in your phone settings.
Recipients
Our push relay and Apple’s and Google’s notification services (named in section 13).
Retention
The token is retained until you turn off notifications, change device or delete the account. Invalid tokens are removed automatically.
Show in-app notifications about things concerning you — for example followers, comments, ratings, tags in clips, teams and events, tryouts and challenges, for players a weekly summary of their own statistics, and for scouts matches on saved searches and their own reminders. Messages from us to all users or to a group — all players, all scouts and trainers, or everyone in a particular city or region — also arrive here. Anyone with push switched on also gets them as a notification (H2).
Who it concerns
All users
Personal data
Notification type, title, body, associated data, and when the notification was read.
Let a club account send one and the same message to several of its own teams at once — for example about an annual meeting or the office being closed.
Who it concerns
Players, guardians and trainers in the teams the club selected
Personal data
The message’s subject and text, which teams and which recipient groups the club selected, how many were reached and when it was sent. The club sees the number of recipients, never a list of names. The content is written by the club and may contain whatever the club chooses to write.
Legal basis
Legitimate interests (Art. 6(1)(f))The club is the controller for the content of the message; we deliver it.
Our legitimate interest
The club’s interest in reaching the families in its teams with information about its activities. A recipient can switch these messages off in settings without losing notice that a match has been cancelled, and a club may send at most five messages per 24 hours.
Recipients
The selected recipients in the selected teams, and our push notification provider — named in section 13.
Retention
The message in the recipient’s notification list is pruned after 30 days. The club’s own send log — subject, text, selected teams and recipient count — is retained for as long as the club account exists, as a record of what the club actually sent.
Send an email when a new challenge opens, and occasionally about news in the app. To players it is about being able to submit an entry; to guardians, that their child can compete for the prizes.
Who it concerns
Players and guardians with a verified email address who have not opted out
Personal data
Email address, first name, your language setting, your role, whether you have Premium (which decides which text you get) and — for guardians — that you have a child with a player account. The email contains a random key identifying your unsubscribe link. The links in the email go straight where they say — they are not rewritten so they can be measured. If you say no, that is recorded with the time and the policy version in force. If an email bounces or you report it as spam, your address is kept in a suppression list so we do not email you again. We do not measure whether you open the email or click in it.
Legal basis
Legitimate interests (Art. 6(1)(f))You do not have to opt in, but you can always opt out — with one click in every email, or with the toggle under Settings in the app. If you say no the emails stop, and we do not weigh the reason.
Our legitimate interest
Our interest in telling someone who already has an account that a new challenge has opened, even when the app is not installed or notifications are switched off — that is the only remaining route to that group. Against it stands the fact that you did not ask for the email. So the emails are few and tied to something actually happening, the copy contains no purchase appeals directed at children, we do not measure your behaviour in the email, and unsubscribing is one click and needs no login.
Recipients
Our email provider (named in section 13), which processes these emails within the EU. The emails are sent from a separate sending domain, kept apart from the one carrying verification codes and password resets.
Retention
We do not store the emails. Your objection is kept for as long as the account exists, as evidence of what you chose. The unsubscribe key and the suppression list are deleted when the account is deleted.
Responsibility
Breakout is the controller
If you are 13–17
People under 18 also receive the email without having opted in first, and can opt out in the same way as anyone else. The copy is kept plain: no deadlines constructed to create urgency, and a challenge that requires Premium says so in the email rather than the recipient discovering it at the point of submission.
Handle purchases and subscriptions and give you access to the features your tier includes.
Who it concerns
Subscribers
Personal data
Subscription tier, validity period, product ID, a RevenueCat customer ID corresponding to your internal user ID, and receipt and event data from the store. We never store card details.
Legal basis
Performance of a contract (Art. 6(1)(b))The purchase is made in Apple’s or Google’s store and is subject to their age and payment rules. For minors, Swedish law normally requires the guardian’s approval for the purchase itself.
Recipients
Our subscription provider (named in section 13) plus the Apple App Store and Google Play.
Retention
Subscription history is retained for as long as the account exists.
Meet the statutory bookkeeping obligation for the revenue the service generates.
Who it concerns
Subscribers
Personal data
The records required under the Swedish Bookkeeping Act. The records come from Apple and Google and, for purchases on the website, from Stripe, and are handled in our bookkeeping, not in the app.
Legal basis
Legal obligation (Art. 6(1)(c))
Recipients
Our bookkeeping and, where required, the Swedish Tax Agency.
Run time-limited competitions, rank the entries and award prizes.
Who it concerns
Players taking part in a challenge
Personal data
Your entry in the form of a video, the answers you give in the challenge form, and the likes, comments and views the score is based on. Generated: score, placement, whether you won, and a competition tier shown as a badge on your profile.
Legal basis
Performance of a contract (Art. 6(1)(b))
Legal basis, ages 13–17
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to run the competition and award the prize to the right person.
Recipients
All users see the challenge leaderboard with your name, profile picture, placing and score, and can play the entries in the challenge’s clip feed. If the account is private — including if you made it private after submitting — the row stays for everyone, but the clip plays only for those allowed to see the account: approved followers, a linked guardian, the coach of a team you belong to and, if you have switched on Visible to scouts or Visible to trainers, verified scouts or trainers respectively. The answers in the challenge form are seen only by you and the staff who run challenges. The entry stays until you remove it. Where there is a prize we may need to contact you to deliver it.
Retention
Retained for as long as the account exists.
Responsibility
Breakout is the controller
Automated processing
The score is calculated automatically from likes, likes from trainers and scouts, the number of distinct commenters, and views. In some challenges our team sets the score manually instead.
If you are 13–17
The app requires a public account to upload to a challenge. A minor with a private account therefore cannot take part without first making the account public — a deliberate choice we have identified as a residual risk.
Use a clip you uploaded in our own marketing, for example on social media or on our website.
Who it concerns
Players whose clips are used
Personal data
The clip and your name to the extent you approved.
Legal basis
Consent (Art. 6(1)(a))We always ask first, by email, and publish nothing before you say yes. You can withdraw your consent at any time.
Recipients
The channels where the material is published.
Retention
For as long as the consent applies. Material already published externally cannot always be retracted.
Responsibility
Breakout is the controller
If you are 13–17
If a player under 18 appears in the material, the guardian’s express approval is required before we publish anything — the child’s own yes is not sufficient for commercial use of their name and image.
Sell the same subscriptions as in the app on breakoutsports.se: take payment, renew and end the subscription, handle the right of withdrawal, and link the purchase to the right Breakout account so premium applies in the app.
Who it concerns
The person buying premium on the website and the person whose account the premium is for. Usually the same person; when a guardian buys for a child, two.
Personal data
A Stripe customer ID stored on your account. At Stripe: the account’s email and name, the billing address needed for the correct VAT, the chosen plan and account type, your user ID (also as your RevenueCat customer ID), your confirmation that you are an adult or a guardian approving the purchase, that you accepted the terms (with the terms version) and asked for the service to start immediately, and payments, receipts, cancellation and any refund. Card and Klarna details are handled by Stripe and Klarna respectively and never reach us.
Legal basis
Performance of a contract (Art. 6(1)(b))In the purchase flow the buyer confirms being 18 or older, or the guardian of the account holder approving the purchase, since under Swedish law a minor normally cannot enter the contract alone.
Recipients
Our payment partner and our subscription provider (named in section 13). Klarna if you choose to pay with Klarna.
Retention
The customer ID on the account is deleted with the account, and an ongoing web subscription is then ended. Payments and receipts are kept with Stripe for seven years under the Bookkeeping Act (see Accounting).
Responsibility
Breakout is the controller
Prizes in challenges are sometimes given as gift cards tied to a named store or chain, with a value that does not exceed the Swedish Tax Agency’s threshold for tax-free competition prizes (SEK 1,800 per prize occasion; applies for 2025 and 2026). The gift cards cannot be redeemed for cash. The prize is therefore tax-free for the recipient, and we do not need to collect personal identity numbers or report the prize to the Tax Agency. Should the value of a prize ever exceed the threshold, we contact the winner — and for a minor winner their guardian, in the same way as for tryout approvals — before the prize is handed over, since we may then need to process a personal identity number in order to file a statement with the Tax Agency.
Record when you were last active, so a club can see whether the trainer licences it pays for are being used and so we can assess whether an account is abandoned, and so that recently active players are shown first under Players near you (B10). Also record which version of the app you last used, so that features and notifications that need a newer app — for example the weekly summary (H2) — are sent only to apps that can show them.
Who it concerns
All users, and club-affiliated trainers in particular
Personal data
Time of last activity. For club-affiliated trainers also the number of sign-ins. The app version your app last reported and when it was seen: the app sends its version number with every request, and we store it when it changes and update the time at most once a day.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
The club’s interest in seeing whether assigned trainer licences are used, our interest in being able to assess inactive accounts, and our interest in not sending a feature or notification to an app that cannot show it.
Recipients
The club account sees the last activity of its own trainers. The app version is not shown to any other user; it is included in your data export.
Retention
The timestamp and the app version are overwritten when they change and are deleted with the account.
Let our staff review verifications, handle reports, correct inaccurate data, manage accounts and look into how an account behaves towards others — for example whether an adult contacts, follows or visits the profiles of many children.
Who it concerns
All users
Personal data
All account data is accessible to authorised staff. The account page also gathers what is connected to the account: clips (including hidden and rejected ones), comments (including removed ones), likes, followers and followed accounts, family links whatever their status, teams, blocks and reports in both directions, ratings given and received, contact requests (sender, recipient and status — not the message), profile visits in both directions, tryout applications and XP history. For every other person who appears, their name, email address, profile picture, role and age are shown. Health data and chat messages are never shown. The staff member’s own sign-in time and IP address are recorded.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to operate and moderate the service and meet the obligations we have as a service provider.
Recipients
Breakout’s administrators and support staff. Marketing staff cannot open the account page.
Retention
The data is deleted with the account.
Responsibility
Breakout is the controller
If you are 13–17
Staff see the age of every person who appears, so that adults’ contact with children can be spotted. Every time a member of staff opens an account or a part of it, this is logged (J8).
Receive and handle your requests for a data copy, erasure, rectification and changes to date of birth or club affiliation.
Who it concerns
Users exercising their rights
Personal data
Your email address or mobile number, your request and stated reason, the IP address when the request is made via the web form, the handling status, and who decided the case.
Legal basis
Legal obligation (Art. 6(1)(c))
Recipients
Our data protection function and the support staff who handle deletion requests. Our email provider when we notify the team and when we reply.
Retention
Closed or rejected cases are deleted after 12 months. Pending cases are retained.
To be able to show afterwards which member of our staff opened, changed or downloaded data about an individual, so that improper internal access can be detected and investigated — and so that you can be told if you ask.
Who it concerns
Our staff with access to the administration tool. The data concerns their actions; the users the actions related to appear as an internal ID number and, where staff searched for someone, also as the name, email address or mobile number they searched for.
Personal data
Timestamp, which member of staff acted, their email address and permission role, which action it was and which part of an account was opened, which internal ID it concerned, whether it succeeded or was refused, IP address, browser signature, and any search filters used. The content of what was displayed is never stored — the log records that a record was opened, not what it said.
Legal basis
Legitimate interests (Art. 6(1)(f)) and Legal obligation (Art. 6(1)(c))
Our legitimate interest
Being able to detect and investigate improper internal access to data about children. Without such a log there is no way to answer the question "who has looked at my child’s data" — and the Article 32 obligation to protect the data cannot be demonstrated.
Recipients
Nobody outside Breakout. The log can only be read by administrators — expressly not by support staff, since one of its purposes is to hold them accountable. In the event of an incident, its contents may be provided to the Swedish Authority for Privacy Protection.
Retention
Kept for 24 months and then pruned automatically. Longer than our other logs, because improper internal access is usually discovered long after the fact — normally because someone gets in touch. If you delete your account the entries are not removed: they describe staff actions, and your ID then points at nobody. A search term staff typed — your name, for example — does however remain until the entry is pruned.
To be able to reply to someone who got in touch through the form on the website’s club, coach and scout pages, and to follow the conversation up from there. The free-text answer about what the club wants solved is also used as input when we decide what to build next — that is the whole point of asking.
Who it concerns
Representatives of sports clubs, coaches and scouts who filled in the form themselves. The form creates no account and the enquiry is not linked to any user, even if the person has an account. Anyone who wants an account signs up separately: clubs, coaches and scouts then choose their role themselves, and the account awaits our review (A3).
Personal data
What the person writes: the club’s name, the contact person’s name, email address, and optionally a company registration number, country, phone number, their role at the club and the number of teams. In addition the free text about what they want solved and an optional further message. Automatically stored: which of the three pages the enquiry came from, the language the page was shown in, the sender’s IP address, and the case status with our own notes.
Legal basis
Legitimate interests (Art. 6(1)(f))
Our legitimate interest
Being able to reply to someone who asked. The person made contact themselves and provided the data for exactly that purpose, the data concerns them as a club representative rather than their private life, and a reply is precisely what they expect. Any contract that follows is entered into with the club as a legal person, not with whoever filled in the form — which is why this rests on legitimate interests rather than on contract. Against the processing stands the fact that the data remains for a time after the conversation ends; that is offset by the retention period being fixed and enforced by a job, by the IP address being there only as a guard against abuse of an open form, and by anyone who wants earlier erasure being able to ask for it.
Recipients
Nobody outside Breakout. The enquiry is sent as email to our contact address and stored in our database, where only administrators and support staff can read it in the administration tool. The person who filled in the form receives a receipt at the address they gave.
Retention
The enquiry is automatically deleted 24 months after it was received. An enquiry we have marked as spam is deleted after 30 days. If you want it removed sooner, just get in touch.
To see how many people visit breakoutsports.se, which pages they read and where they came from, so we can decide which pages need rewriting and which channels are worth spending time on. The statistics are never used for advertising and never to assess an individual visitor.
Who it concerns
Visitors to the website who said yes to measurement. Anyone who says no, or does not answer, is not measured at all. App users are not covered — the measurement exists only on the web.
Personal data
A random visitor id in two cookies (_ga and _ga_<measurement id>), which pages were visited and when, the page language, the referring page, an approximate location at country and region level that Google derives from the IP address, plus browser, operating system and device type. In addition, which buttons were clicked: get the app on the App Store or Google Play, the buttons at the top of the home page (download the app and learn more), the download button in the header and the button on the pricing cards, open the app from a shared page, submit an interest enquiry (only which audience page it came from), that an interest enquiry did not go through (only an error code, never what was written), create a scout account, follow a guide’s onward link, click an email address (only which topic, never the address), and whether a shared clip was played halfway and how long the clip is. Every event, not just the page view, is sent with the page address without its query string, and on pages carrying a content id in the address — a shared clip or a challenge — the pattern is sent instead of the id, and the page title is replaced by the same pattern because the title of a shared clip is set by the player themselves. We never send a name, an email address, an account id or anything you typed into a form, and the visitor id is never linked to a Breakout account.
Legal basis
Consent (Art. 6(1)(a))Storing this in your browser requires consent under the Swedish Electronic Communications Act (Chapter 9, Section 28), since it is not necessary for a feature you requested yourself. The basis under the GDPR follows the storage: processing of what is collected therefore rests on consent (Art. 6(1)(a)) and not on legitimate interests. Nothing is loaded from Google and nothing is measured before you tap yes, and if you withdraw your consent the measurement stops immediately.
Recipients
Google Ireland Limited as processor (named in section 13). Google Signals and Google Ads linking are switched off, so the data is not used by Google for its own purposes and not for advertising.
Retention
The visit data is deleted at Google after two months, which is the shortest retention the tool offers. The cookies in your browser expire after 180 days, or earlier if you withdraw your consent or clear your browser.
Responsibility
Breakout is the controller
If you are 13–17
No difference in what is measured, but the protection lies in the configuration: since Google Signals and Ads linking are switched off, the measurement cannot become advertising material for anyone, whatever their age. The promise on the cookie page that nobody under 18 ends up in behavioural advertising is therefore kept in the setting, not only in words.
We never sell personal data, and only share it with the processors needed to run the service, with other users according to your settings, and with authorities where the law requires. Every processor is bound by a data processing agreement and may only process data on our instructions. Apple and Google are independent controllers for payments in their stores and, if you choose to sign in with their account, for that sign-in. Stripe, which takes payment for purchases on the website, is an independent controller for parts of the payment – including fraud prevention and anti-money-laundering checks – and if you choose Klarna, Klarna is an independent controller for its payment. 46elks, which sends text messages with one-time codes, is a Swedish telecoms operator and an independent controller for the delivery under the Electronic Communications Act.
Service
What it does
Where
Laravel Cloud
Hosting, API and database
EU (Frankfurt)
Cloudflare R2
Videos, images and documents
EU endpoint; SCC/DPF
AWS Rekognition
Automated content screening
EU (Stockholm)
Resend
Transactional email and challenge emails, from separate sending domains
Transactional email: USA, SCC/DPF. Challenge emails: Ireland (EU)
46elks
Text messages with one-time codes at sign-up, password reset and when you add or confirm a mobile number — independent operator, not a processor
Sweden
Laravel Reverb
Real-time chat
EU via Laravel Cloud
Sentry
Error and crash monitoring
USA; SCC/DPF
RevenueCat
Subscription status
USA; DPF
Stripe (Stripe Payments Europe Ltd)
Payment, receipts and cancellation for purchases on the website
Ireland (EU); onward transfer to Stripe Inc. in the USA, DPF and SCC
Expo Push / APNs / FCM
Push notifications
USA; SCC/DPF
Vercel
The breakoutsports.se website
US company, EU region; SCC/DPF
Google Analytics (Google Ireland Ltd)
Website visitor statistics — only if you consented
Ireland (EU); onward transfer to Google LLC in the USA, DPF and SCC
Payload CMS (Railway)
Editorial content in the app — the Home feed, challenges and drills. The app fetches the content directly from here, so every user’s IP address reaches the provider in the USA; that transfer is protected by SCC/DPF. Beyond that no player data; a clip we feature as Clip of the week is referenced by its ID number
USA; SCC/DPF
All core data — the database and your files — is stored within the EU/EEA. Some processors are US-based; transfers to them are protected by the EU Commission’s Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework (DPF). You can obtain a copy of the safeguards via dataskydd@breakoutsports.se. One recipient in the list receives data only if you said yes to it: the website visitor statistics. If you say no, or do not answer, nothing is sent there.
You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe we process your data incorrectly: imy.se, +46 8 657 61 00. You do not need to contact us first — but we hope you will, so we get the chance to put it right: dataskydd@breakoutsports.se.
Right
How to use it
Access and copy (Art. 15)
“Export my data” in the app settings, under My account at breakoutsports.se/konto, or email us
Rectification (Art. 16)
Edit directly in the profile; date of birth via a change request
Erasure (Art. 17)
“Delete account” in the app — everything is erased after a 30-day grace period
Restriction (Art. 18)
Email dataskydd@breakoutsports.se
Portability (Art. 20)
The export is delivered in a machine-readable format
Objection (Art. 21)
Against processing based on legitimate interests — email us; for visibility, the app toggles also apply. Against challenge emails you have an unconditional right to object: the link in the email or the toggle under Settings, and the emails stop without us weighing the reason
Withdraw consent (Art. 7)
Push notifications: your phone settings. Marketing using your content: reply to the request or email us. Website statistics: Cookie settings at the bottom of every page — saying no is as easy as saying yes
We respond within one month (Art. 12(3)). The export covers all personal data we hold about you. Other people’s data is included only in the form you already see it in the app — for example the names of your followers, but not which scouts have you on their watchlists, since that is primarily information about the scout’s work. Withdrawing consent does not affect the lawfulness of processing already carried out.
We make no decisions with legal or similarly significant effects solely by automated means (Art. 22). Four automated features do affect what is shown: content screening (section 8), which is always followed by human review before an action stands and where you can request reassessment; feed ranking (section 4), where the Latest, Popular and Following tabs order content by time and popularity; the clip suggestions in the Home feed (section 4), which are chosen from your own profile and what you have done in the app — for example position, league, location and age — and show the reason under the clip when the suggestion is based on one, which is profiling but only steers what the app shows you; and scouts’ and trainers’ automated suggestions (section 6), which are based on how many trainers and scouts opened the profile over the last seven days, on a trend score where the latest week counts the most and on total views and likes, where players under 13 never appear and a player only does if they have Visible to scouts or Visible to trainers switched on, which for a 13–17-year-old requires that they switched it on themselves. You can object to the clip suggestions by emailing us (section 14). No profiling is carried out for advertising purposes, for any user. The website visitor statistics (section 12) are no exception: they measure pages and visits in aggregate, they stay switched off until you consent, and the two settings that could turn them into advertising material — Google Signals and Google Ads linking — are switched off on our side. The statistics do not cover the app, are never linked to your account, and are never used to assess an individual visitor.
The website sets no cookies until you have said yes. Four strictly necessary entries are always stored: three for sign-in and registration, and one that remembers your answer to the cookie question. Beyond those we measure visitor statistics with Google Analytics — only after your consent, never in the app, and never linked to your account. We load nothing from Google before you tap yes, and you can change your mind at any time via Cookie settings at the bottom of the page. A complete list with names, purposes and lifetimes is at breakoutsports.se/cookies.
For material changes we notify you by email or in the app at least 14 days before the change takes effect. The version number at the top changes with every material revision, and previous versions can be requested via dataskydd@breakoutsports.se.