Your name, email address, optional phone and household name, subject, message, and permitted attachments. Child details are optional and should be shared only when needed to answer the registration question.
Do not send medical information, payment-card or bank details, identity documents, confidential safeguarding reports, or other unnecessary sensitive information by email.
Academy downloads and stores only the content of plain-text, JPEG, PNG, and WebP attachments within its size limits. For rejected PDF, Office, and other active document formats, Academy retains only bounded metadata such as the filename, type, size, and rejection reason; the file still passes through the email provider first. Permitted attachments are restricted and sanitised, but are not described as virus-scanned; do not send suspicious files.
These details are unverified prefill. A staff member must confirm them with you before creating a household, child profile, or account. This channel never creates a child login.
The club uses the information to take steps at your request before a possible membership agreement and, where necessary, for its legitimate interest in handling registration questions safely. Only authorized staff with CRM access can open the conversation.
Contakt provides the registration software. Render hosts the application and Supabase provides the EU-region database and private storage. Resend processes recipients, message content, attachments, and delivery metadata needed to receive and send registration email.
Resend (Plus Five Five, Inc., United States) processes sender and recipient addresses, subjects, message content, headers, attachments, and delivery metadata. The selected eu-west-1 region controls mail routing and dispatch, not data residency: Resend's primary processing and account-data storage take place in the United States. Resend's published data-processing agreement names the EU Standard Contractual Clauses and participation in the EU-US Data Privacy Framework as transfer safeguards. Resend may retain email data, including sent and received message content and metadata, for up to 30 days. Open and link tracking are disabled.
If you use the web form, Cloudflare Turnstile checks abuse. Network and browser data is sent to Cloudflare, including the IP address, user agent, site key, and page hostname; Cloudflare may derive technical signals such as a TLS fingerprint. Academy also sends the club slug as Turnstile cData and validates it on return. Upstash receives only HMAC-protected opaque limit keys, not readable email addresses or club names. These two services are not used when you contact the club only by email.
The conversation subject, message content, intake and event details, and attachment content are scrubbed after the ticket has remained closed for 365 days. The ticket and delivery record can retain contact and routing identifiers plus operational timestamps for security, audit, thread handling, and privacy-request enforcement until they are no longer needed. A non-reversible suppression record may remain to prevent an erased address from being reintroduced. A valid privacy request may require earlier action.
Request access, correction, restriction, objection, deletion, or a portable copy through play@higginstennis.nl. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). The club is the data controller; Contakt processes the data on the club's instructions and may ask Resend for assistance where a service copy remains. A provider service copy may remain for the provider-retention period described above.
Updated August 11, 2026