Privacy Policy

Who is responsible

The controller responsible for this website is Julian Yaman, Heiligenberger Straße 15, 88630 Pfullendorf, Germany. You can contact us about privacy or exercise your rights by emailing [email protected]. Further operator details are available in our Legal Notice (Impressum).

Download verification with Cloudflare Turnstile

We use Cloudflare Turnstile to protect logo downloads against automated abuse. The verification script loads from Cloudflare in the background on club pages with downloads. Cloudflare decides whether an interactive challenge is needed. Catalogue browsing and search pages do not load this widget.

When verification is enabled, Cloudflare processes technical signals such as your IP address, TLS fingerprint, browser user-agent, and the site identifier and associated origin to distinguish human visitors from bots. Our server sends the resulting verification token to Cloudflare and checks the response before providing a download. We do not store verification tokens in the catalogue database.

Our basis for this security processing is our legitimate interest in preventing abuse and maintaining the availability of downloads (Article 6(1)(f) GDPR). Cloudflare also describes processing to improve its bot detection. See its Turnstile Privacy Addendum and Privacy Policy for provider processing, cookies, and international transfers.

Hosting and delivery of the website

Handball Logos is hosted by Contabo GmbH, Germany. When you visit, your browser sends technical information needed to deliver the website, including your IP address, requested URL, date and time, browser and operating system information, and referring page where supplied. Requested URLs can include search terms and filters. This information may also appear in access or error logs used to diagnose problems and prevent abuse.

Logo assets are stored and delivered using Cloudflare R2. When your browser requests an asset directly, Cloudflare receives the connection information needed to deliver it, including your IP address and the requested file. Turso provides the catalogue database; the application does not add visitor IP addresses or browser identifiers to catalogue queries or download records.

We process technical request data on the basis of our legitimate interest in providing a reliable and secure website (Article 6(1)(f) GDPR). See Contabo’s privacy policy and Cloudflare’s privacy policy for information about these providers.

Website analytics

We use Vemetric, provided by seriouscode GmbH, to understand how visitors find and use the catalogue and to improve the website. Its script loads when you visit and records page views and technical usage information, such as visited pages, referrers, browser and device information, and approximate location derived from your IP address.

Our integration uses Vemetric’s default cookieless mode. According to Vemetric, it recognises visitors within a day using a hash derived from the IP address, user agent, and a daily rotating salt. This involves processing connection data even though no analytics cookie is set. We do not send names, email addresses, or account identifiers to Vemetric.

Our basis for this limited audience measurement is our legitimate interest in understanding and improving the catalogue (Article 6(1)(f) GDPR). You may object to processing based on legitimate interests by contacting us. For provider details, see Vemetric’s privacy policy and its documentation on cookieless analytics.

Theme preference and download statistics

If you choose a light or dark theme, we save that choice in your browser’s local storage under handball-logos-theme. It stays on your device until you replace it or clear the website’s stored data. This lets us remember the display preference you requested; it is not sent to our catalogue database. Our basis is our legitimate interest in remembering your chosen display setting (Article 6(1)(f) GDPR).

For completed downloads, the application updates daily totals by logo identifier, file format, and pixel size to calculate popular logos. These database totals contain no IP address, cookie identifier, account identifier, or individual download timestamp.

To limit requests and avoid repeatedly counting the same download, the server temporarily uses keyed hashes of the client IP address in bounded process memory. Repeat downloads of the same club and format are counted at most once per hour by each application process. These hashes are not stored in the catalogue database and their key changes when the process restarts. Technical request logs and analytics are separate.

Logo requests and email

Our logo request form is embedded on the request page and hosted by Tally BV, Belgium. Opening that page loads Tally’s form and embed script. Tally processes the form responses on our behalf. We receive the details you submit, including any contact details, club information, links, or attachments you provide, to review your request and respond where necessary. See Tally’s privacy notices and information about form data processing.

If you email us, including to request removal of a logo, we and our email service provider process your email address, message, attachments, and any information needed to verify and handle your request. Providing contact information is voluntary, but we may be unable to reply or resolve a request without sufficient details.

Our basis is our legitimate interest in maintaining the catalogue, answering enquiries, and handling rights holder concerns (Article 6(1)(f) GDPR). Where processing is necessary to meet a legal obligation, Article 6(1)(c) GDPR applies.

Public source and attribution details

Logo pages may display an author’s name or username and attribution obtained from the original source, such as Wikimedia Commons, a club website, or a contributor. We publish these details to document provenance and credit the source, based on our legitimate interest in maintaining an accurately attributed catalogue (Article 6(1)(f) GDPR). Each logo page links to its recorded source where available. Contact us to request correction of personal attribution details.

Recipients and international processing

Hosting, asset delivery, database, analytics, security verification, form, and email providers receive the information needed for their respective services. Information may also be disclosed where required by law or necessary to handle legal claims.

Some providers, including Cloudflare, operate internationally, so processing may take place outside the European Economic Area. Cloudflare describes its use of the EU–US Data Privacy Framework and standard contractual clauses in its privacy policy. You can contact us for information about the safeguards applicable to processing of your data and how to obtain a copy.

How long information is kept

Retention depends on the purpose and the service involved. Technical logs are needed for troubleshooting and security; analytics history is used to understand usage trends. Their actual retention depends on server settings and the analytics service plan. We do not specify a fixed number of days here because those periods have not been confirmed.

We retain requests and correspondence for as long as needed to resolve them and handle related follow-up or legal claims. Statutory retention obligations may require longer storage. Public attribution remains relevant while its source material is listed. Daily download totals are retained to calculate catalogue statistics and have no automatic expiry in the application. Turnstile tokens are used only for verification and are not added to download statistics. The theme preference remains in your browser until replaced or cleared.

Contact us if you need information about the retention of a particular request or record, or want to request deletion.

Your rights

Subject to the conditions in the GDPR, you can request access to your personal data, correction, erasure, restriction of processing, and data portability where applicable. You can object, on grounds relating to your particular situation, to processing based on legitimate interests. If processing is based on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

To exercise your rights, email [email protected]. You also have the right to complain to a data protection supervisory authority, particularly in the country where you live or work or where you believe an infringement occurred.