Privacy
Last updated 26 August 2026
lassenius.com Oy, Hattula, Finland operates Kavalkad. Contact: kavalkad@lassenius.com
Kavalkad shares photographs taken at sports events. Most people who appear in those photographs are not the people using the app, so this page is written for both: what happens to your data if you use Kavalkad, and what happens to your picture if someone photographs you.
Who is responsible
Two different roles, and which applies depends on what the data is.
- Photographs and event rosters. The club or organiser running the event decides what is photographed, who may see it and for how long. They are the controller; Kavalkad acts as processor on their instructions. Questions about a specific event's photographs are best directed at its organiser, and we will help you reach them.
- Your account. lassenius.com Oy decides how accounts work and is the controller for them.
What is collected, and why
| Data | Why |
|---|---|
| A device identifier created when you first open the app | So the app can remember which events you joined and let you reopen a finished one. It contains no personal data and is not linked to you unless you sign in. |
| Your name, if you enter one | Shown as the credit on photographs you upload. Optional, and free text — a nickname is fine. |
| An identifier from Apple or Google, or your email address | Only if you sign in. It is what lets you reach your account from a new phone. Apple's Hide My Email relay works normally. |
| Which events you joined, and in what role | Your event list, and the visibility rules for each event. |
| Photographs you upload, and their capture time and location | Capture time and place are checked against the event's time window and geofence, so photographs taken elsewhere cannot be added to an event. From the file's technical data we keep only camera make and model, capture time, exposure, aperture and ISO. If a photograph carries no capture time — some apps strip it when saving — the app may ask, on iOS, for permission to read that one detail from your photo library; it is used for nothing else, the library is never browsed, and declining only means an organiser approves the photograph instead. A photograph with no capture time at all is shown to the event only after the organiser approves it. |
| Which photographs you liked, shared, saved or reported | Likes and counts shown in the gallery; reports so an organiser can review them. |
| Actions taken by organisers | An audit record of moderation decisions, so they can be accounted for. |
There is no advertising, no analytics or tracking service, no profiling, and nothing is sold or shared for marketing. There are no third-party trackers in the app.
Photographs of you
If you appear in a photograph someone else took:
- Only watermarked, size-reduced copies are ever shown or shared. The original file stays private to the photographer.
- Every photograph can be reported from the app. Reporting hides it immediately, before any human looks at it, and sends it to the organiser for review.
- Ask the organiser, or us, to have a photograph removed. We can delete the file itself, not only hide it.
Children, and protected events
Events involving young people can be run in protected mode. There, the general event code does not work at all: each family receives its own code, and sees only photographs that have been assigned to their own participant. Photographs not yet assigned are visible to nobody but the photographer who uploaded them and the organiser. Guardian consent is collected by the club as part of registration, and a participant can be opted out, which prevents any photograph being assigned to them.
Kavalkad itself holds no ages and cannot tell who is a child; the club decides who needs consent and obtains it. For reference, a young person may consent to an online service themselves from 13 in Finland and Sweden (16 in some other EU countries), while publishing an identifiable photograph of a minor is normally done on a guardian's consent — Finnish club practice being to ask up to the age of 18.
No face recognition. Ever. Photographs are matched to participants by hand, or by reading a printed bib number — never by analysing anyone's face. Biometric identification is a category of processing this service stays out of entirely (GDPR Article 9), and that is a design decision, not a setting.
Legal bases
- Contract — running your account and showing you the events you joined.
- Legitimate interests — keeping the service working and secure, and moderating reported content. For photographs at public adult events, the organiser's legitimate interest in documenting their event, balanced against the right to object below.
- Consent — for protected events, guardian consent collected by the club at registration.
How long things are kept
- Photographs are deleted automatically once the event's retention period ends. The organiser sets it per event; the default is 90 days after the event finishes. Deletion removes the files, not just their visibility.
- Your account lasts until you ask us to delete it.
- Moderation records are kept after the photographs they refer to are gone, so a decision remains accountable. They identify the organiser who acted, not the subject of the photograph.
Who else is involved
| Service | What it sees |
|---|---|
| Apple, Google | Only if you choose to sign in with them, and only that you signed in. We tell them nothing about you. |
| Microsoft | Sends the one-time sign-in code if you use email sign-in, so it handles your email address. |
| OpenStreetMap | Supplies map tiles in the organiser's console. Used by organisers, not by the app. |
Photographs are not sent to any of them. They are stored on infrastructure operated by lassenius.com Oy, and are not hosted with a third-party cloud provider.
You can delete your account and everything in it at any time — how to do that.
Your rights
Under the GDPR you may ask for a copy of your data, correction of it, deletion of it, restriction of how it is used, and you may object to processing based on legitimate interests — including to a photograph of you being shown. Write to kavalkad@lassenius.com and we will act on it. There is no charge, and we will not ask you to justify a deletion request.
You can also complain to a supervisory authority. In Finland that is the
Office of the Data Protection Ombudsman (tietosuoja.fi).
Security
All traffic uses HTTPS. Photograph originals are never served to anyone but the photographer who uploaded them. Sign-in codes are stored hashed, expire, and stop working after five wrong attempts. Access for organisers is account-based and scoped to their own events.
This is a pilot. The service is early software run at small scale. Two limits worth stating plainly: there is currently no off-site backup, so data loss from a hardware failure is possible; and a formal data protection impact assessment for protected mode is still to be produced.
Changes
If this page changes in a way that affects you, the date at the top changes with it.
Contact: kavalkad@lassenius.com