Privacy

Last updated 12 October 2026

This policy explains which personal data Kristiansund Ballklubb processes in the KBK app, in the KBK Partner portal and on this website, why we do it, and what rights you have. It applies to supporters, to sponsors and the people who work for them, and to KBK staff who administer the services.

In short

We store what we need to run the services: your account, your tickets, points, votes and notification settings, and for sponsors, what happens in the partner portal.
We do not sell personal data, and we do not use third-party advertising, tracking or analytics, in the app, the portal or on the website.
Sponsors only see data about you when you activate one of their benefits or win a giveaway they are behind, and only what they need to give it to you.
The data is stored in the EU, in Stockholm, Sweden.
You can ask for access, correction and deletion at any time at kbk@kristiansundbk.no.

Who is responsible

Kristiansund Ballklubb (org. no. 986 211 497) is the data controller for personal data in the KBK app, the partner portal and this website. You can reach us at kbk@kristiansundbk.no, by phone on +47 900 12 453 or at Magnar Isaksens Vei 1, 6514 Kristiansund N, Norway.

Samsari AS (org. no. 936 276 474), Hagbart Brinchmanns vei 20, 6510 Kristiansund N, Norway, develops and runs the services for KBK and processes the data on our behalf, as a data processor. Samsari AS can be reached at hei@samsari.no, but questions about privacy and your rights go to KBK at kbk@kristiansundbk.no.

The services and who uses them

This policy covers three services:

The KBK app for iPhone and Android, the supporter app with tickets, matches, games, points and benefits.
KBK Partner, the partner portal where KBK and its sponsors work together on benefits, activities, season cards and files.
This website, with information about the app, help and these pages.

The app and the portal use the same account. If you have an account in the app and are invited to the portal with the same email address, it is the same account.

What we store depends on who you are to us:

Supporter: you use the KBK app.
Sponsor: you work for a company or organisation that partners with KBK and have been invited to the partner portal. You may also get access to sponsor features in the app.
KBK administrator: you work for KBK and administer the app and the partner portal.
No account: we may hold data about you even if you do not use the services, for example if you have a season card, have been given a ticket or are signed up for an activity. See the section on that further down.

Your account

For everyone with an account we store:

Name and email address.
Password, stored encrypted. Nobody at KBK can read it.
Date of birth, which you give when you create an account in the app, to check that you are old enough.
Phone number, to find tickets you bought with your phone number and to contact you when needed.
Profile picture, if you upload one.
Language, and when you accepted the terms.
Account details: when the account was created, when you last signed in, whether your email address is confirmed and how you sign in.
Roles: whether you are a KBK administrator, which sponsor you are linked to, and in what role.
Suspension: if the account is suspended temporarily or permanently, we store when, for how long, the reason and who at KBK did it.

Supporters in the KBK app

When you use the app, we also store:

Tickets: when you open your tickets, we look you up at TicketCo with your email address and phone number to find your tickets and season cards. The latest answer is cached with us, and a copy is kept on your phone so your tickets work without a signal. The copy on the phone is deleted when you sign out.
Tickets you give away: if you give a ticket away, we store the ticket, your name and email address, the recipient's email address and what has happened to the ticket. The recipient gets an email from us with your name and email address and can reply to you directly. If you post a ticket anyone can claim, other signed-in users see your name on it.
Games and points: your predictions for the line-up, first scorer and result, the points you earn, and your points, level and redemptions in Ugle Arenaen.
Leaderboard: your first name, the initial of your last name and your points are shown to other app users.
Player of the match: who you voted for, so that each user can only vote once per match. Others only see how many votes each player got.
News likes: which news items you liked. Others only see the count.
Notifications: a device key (push token) and what kind of phone you have, if you turn notifications on, and which notifications you want, such as kick-off, line-up, goals and the match roar.
Match roar: if you send a match roar to everyone, we record that you did.
Benefits and giveaways: see the next section.

Benefits and giveaways

The benefits in the app come from KBK's sponsors. When you activate a benefit, we store which benefit it is, when you activated it, how many points you spent, and your name.

The sponsor giving the benefit sees your name and when you activated it in the partner portal. If the sponsor needs to contact you to give you the benefit, they also see your email address and phone number. The benefit says so before you activate it.

When you enter a giveaway, we store that you entered. If you win, we store that you won and what you won. Your name and the contact details needed to give you the prize are shared with KBK and with the sponsor behind the prize, and shown in the partner portal. We may also show your first name and the initial of your last name in the app as the winner.

The sponsor may only use the data to give you the benefit or the prize, not for marketing unless you agree to it yourself. What the sponsor does with the data once they have it is the sponsor's responsibility.

Sponsors in the partner portal

If you are a sponsor, we store the following in addition to your account:

The company: name, organisation number, address, contact email, logo, sponsor level and status. The logo is shown publicly in the app and the portal.
The people at the sponsor: name, email address, phone number and role for everyone with access, and invitations that have been sent (email address, role, who invited and status). Everyone with access at the same sponsor sees each other's names, email addresses and roles.
Benefits: the benefits you create, who submitted them, and whether KBK has approved them, with any comments.
Files: the files you and KBK share, with name, size, type and who uploaded them.
Year wheel activities: who you sign up (name and email address) and who signed them up, and activity suggestions and comments, with the name and email address of the person who wrote them. Everyone signed up gets an email with the activity details and the names of the others signed up from the same sponsor.
Season cards: the cards you add and hand out, with the name and email address of the person getting the card, and who gave it and took it back. The person getting the card receives it by email.
Log: the portal logs changes, such as invitations, access, benefits, files and season cards, with who did it and when. You see the log for your own company. KBK sees the whole log, and can also keep its own notes and record calls and meetings with you.
Ugla: if you use the AI assistant, see the section on Ugla.

KBK administrators

If you are a KBK administrator, we store your account like any other. In addition, what you do in the portal, such as invitations, approvals, notes and suspending accounts, is recorded with your name and the time. If you suspend an account, your name and email address are stored with the suspension.

KBK administrators have access to data about other users to give support, follow up the partnerships with sponsors and stop misuse:

The user list of all accounts, supporters included, with name, email address, phone number, date of birth, when the account was created and last used, and roles.
Everything about the sponsors, their people, benefits, files, activities, season cards and the whole log.
Participant lists for activities, which can be downloaded as a file.
Who has activated benefits and won giveaways.

Administrators can suspend and delete accounts. They cannot see passwords, and they cannot read other people's conversations with Ugla.

Ugla, the AI assistant in the portal

Ugla is an AI assistant in the partner portal that answers questions about the partnership. Ugla uses language models from OpenAI.

We store your conversations with Ugla, the files and images you send, and how much you have used Ugla in the last two days, so we can limit use. Only you can read your conversations; KBK administrators cannot either. If you delete a conversation, the files in it are deleted too.

To answer, Ugla sends this to OpenAI:

your question, the latest messages in the conversation and the titles of some of your other conversations
your name, email address and role
files, images and voice recordings you send (voice is turned into text)
data from the portal that Ugla looks up to answer, and that you have access to yourself. For a KBK administrator, this can include the names, email addresses and last sign-in of users, supporters included, and details about sponsors.

OpenAI does not use the data to train its models. Files are deleted at OpenAI after seven days, and OpenAI may otherwise keep requests for up to 30 days to detect misuse.

If you do not have an account

We may hold data about you even if you do not use the app or the portal:

Season cards and KBK+: we keep a copy of the season cards and KBK+ subscriptions in TicketCo, with name, email address, the last digits of the phone number, seat and validity, for buyer and holder. It is used to show the card in the app when you sign in, and to check season cards that sponsors add. Sponsors only see the match and the seat, not who holds the card.
Tickets you are given: if someone gives you a ticket in the app, we store your email address, the ticket and your name as it appears on the ticket, and send you an email.
Season cards from a sponsor: if a sponsor gives you a season card, we store your name and email address and send you the card by email.
Activity sign-ups: if a sponsor signs you up for an activity, or KBK adds you as a guest, we store your name and email address and send you a confirmation.
Portal invitations: if you are invited to the partner portal, we store your email address, which sponsor and role the invitation is for, and who invited you.

The data comes from TicketCo, from the person who gave you the ticket or card, or from the sponsor. You have the same rights as everyone else; see the section on your rights.

This website

This website does not use cookies, stores nothing in your browser and has no analytics or tracking. Fonts and images are loaded from our own server.

The website is delivered by Cloudflare. As with any website, the server needs your IP address and the page you ask for in order to send it to you. Cloudflare may log this for a short time for operations and security.

On your phone and in your browser

The app asks for these permissions, and you can say no or change them in your phone settings:

Notifications: to send match notifications and the match roar.
Location, only while the app is in use: to tell whether you are at the stadium. The location is only used on the phone and is not sent to us.
Photos: only when you pick a profile picture. Only the picture you pick is uploaded.
Brightness: the app turns the brightness up when you show the QR code on a ticket.

The app stores your sign-in, your tickets for use without a signal, language, light or dark mode and some choices you have made on the phone. The partner portal stores the sign-in, language, appearance and some choices in the browser. Neither uses cookies for tracking.

In the partner portal you can scan QR codes with the camera or from a PDF. This happens in the browser, and only the codes found are sent to us. The microphone is only used if you talk to Ugla.

Why, and on what basis

To provide the services: account, tickets, ticket transfers, games, points, votes, benefits and giveaways. The basis is our agreement with you, the terms (GDPR article 6(1)(b)).
To send notifications: the basis is your consent, which you give and withdraw in the app or in your phone settings (point (a)).
For the partnerships with sponsors: data about the people at the sponsors, activities, season cards and the log in the portal. The basis is our legitimate interest in running the partnership that follows from the agreement between KBK and the sponsor (point (f)).
To administer the services: the access KBK administrators have and the log of what they do. The basis is our legitimate interest in giving support, following up the sponsors and knowing who did what (point (f)).
For people without an account: the season card register, tickets and cards you are given, and sign-ups. The basis is our legitimate interest in delivering the ticket, card or activity to you (point (f)).
For Ugla: our legitimate interest in making the work with sponsors easier (point (f)).
For security and against misuse: technical logs, suspending accounts and the portal log. The basis is our legitimate interest in keeping the services safe (point (f)).

Where we rely on legitimate interest, we have assessed that our interest outweighs the drawback for you. You can object; see the section on your rights.

We do not use the data for profiling or automated decisions with legal effects for you. Points are calculated automatically by the rules in the app, and giveaway winners are drawn at random.

Transfers outside the EEA

Several of the providers are American companies: Supabase, Cloudflare, Resend, Expo, Apple, Google and OpenAI. When data is processed outside the EEA, it happens on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses (GDPR chapter V).

How long we keep data

Your account with profile, points, predictions, votes, likes and notification settings: until the account is deleted.
Push token: until you turn notifications off, delete the account or the token stops working.
Tickets: the cache with us is refreshed every time you open your tickets and is deleted with the account. The copy on the phone is deleted when you sign out.
Tickets you give away: until your account is deleted.
Benefits: activations are kept until your account or the benefit is deleted.
Giveaways: entries are deleted once the winner is drawn. Winners are kept for one year so we can document that the prize was delivered.
Season card register: until the card or subscription has expired.
Sponsors: data about a sponsor, its people, the log and the notes is kept for as long as the partnership lasts, and deleted no later than three years after it ends.
Sign-ups and guests: until the activity has taken place and been followed up, and no later than one year after.
Ugla: conversations and files until you delete them or the account. Usage data is deleted after two days.
Technical logs: up to 30 days.

Your name may stay in the portal log after your account is deleted, for example as the person who added a file or signed someone up. That is because the log has to show who did what. The log is deleted together with the sponsor.

Security

Data is sent encrypted. Each user only gets access to what their role allows, and that is enforced in the database, not just in the app. Files in the portal are private and shared through links that stop working after a short time. Passwords are stored encrypted. If a security breach could affect you, we notify you and the Norwegian Data Protection Authority as the law requires.

Your rights

You can ask to access, correct or delete your data, receive a copy of it, restrict processing, and object to processing based on legitimate interest. Email kbk@kristiansundbk.no from the address the account is registered to. We reply within 30 days.

Supporters can delete the account themselves in the app or on the Delete account page. Sponsors and KBK administrators ask for deletion at kbk@kristiansundbk.no. Deletion covers both the app and the portal, because it is the same account.

You can withdraw consent to notifications at any time in the app or in your phone settings.

If you disagree with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Age

You must be 13 or older to create an account, both in the KBK app and in the partner portal.

Changes

We may update this policy when the services change. Significant changes are announced in the app and in the portal. The date at the top shows the last change.