PRIVACY POLICY

Who will process your personal data?

Your personal data will be processed by The Padel Alliance Limited (hereinafter also referred to as “The Padel Alliance”, “we”, “us”, or “our”), with registered office at:

121a Grenville Street, Stockport, United Kingdom, SK3 9EU

The Padel Alliance acts as the Data Controller, meaning we are responsible for determining how and why your personal data is processed.

You can contact the Data Controller at the following email address:
hello@thepadelalliance.com

Personal data may also be processed on behalf of The Padel Alliance by third parties (hereinafter referred to as “Data Processors”), which are carefully selected and contractually bound to comply with applicable data protection laws.

These Data Processors may include:

Hosting and cloud service providers
Software and application providers
Payment processing providers
Analytics and performance tools
Communication and messaging service providers
Marketing and email distribution platforms

A full list of Data Processors is available upon request.

At present, The Padel Alliance has not appointed a formal Data Protection Officer (DPO). However, any data protection enquiries can be directed to the contact email above, where they will be handled by the appropriate internal team.

How and why, we process your personal data

Your personal data will be processed for specific purposes related to the provision and improvement of our services, including the operation of our website and mobile application.

Specifically, your data will be processed for the following areas of activity:

Use of The Padel Alliance platform (including account creation, bookings, leagues and competitions)
Player development features (including rankings, statistics, and performance tracking)
Community engagement (including messaging and player connections)
Transactional services (including payments, subscriptions, and merchandise purchases)
Communication (including service updates, support, and marketing communications where consent is provided)
Platform improvement (including analytics, performance monitoring and user experience optimisation)

Each of these activities is described in detail in the data processing tables below, including the categories of personal data used, the legal basis for processing, and the applicable data retention periods.

Purpose / Activity	Categories of Personal Data	Lawful Basis	Retention Period
Account registration & profile management	Name, email, phone number, password, profile image, player level	Contract (service delivery)	Duration of account + up to 2 years inactivity
League participation & competition management	Name, rankings, results, match history, stats	Contract	Duration of participation + 5 years
Player rankings & statistics tracking	Match results, performance data, rankings, form metrics	Contract / Legitimate Interest	Duration of account
Public player profiles & match visibility	Name, stats, rankings, match participation	Contract	While account is active
Email communications (service updates)	Email address, communication logs	Contract	Duration of account
Marketing communications	Email, preferences, behaviour data	Consent	Until consent is withdrawn
Payments & subscriptions	Payment details (processed by third-party providers), billing info	Contract / Legal obligation	Up to 10 years
Customer support & enquiries	Name, email, phone number, support messages	Contract / Legitimate Interest	Up to 2 years
Analytics & app improvement	Device data, usage data, IP address	Legitimate Interest / Consent (cookies)	Up to 2 years
Security & fraud prevention	Device info, IP, login data	Legitimate Interest / Legal obligation	Up to 5 years

Future / Upcoming Features

Purpose / Activity	Categories of Personal Data	Lawful Basis	Retention Period
Contact syncing (invite friends)	Phone contacts (emails, numbers)	Consent	Until consent withdrawn
Location services (finding courts/events)	GPS/location data	Consent	While feature active
Push notifications	Device tokens, preferences	Consent	Until disabled
Match bookings & court reservations	Name, contact details, booking details, attendance history	Contract	Up to 10 years
Messaging between users	Messages, timestamps, user IDs	Contract / Legitimate Interest	Up to 2 years
Merchandise purchases (shop)	Name, delivery address, payment info, order history	Contract	Up to 10 years

Data Sharing

Recipient Type	Purpose
Hosting & cloud providers	Infrastructure and storage
Payment providers	Processing payments securely
Clubs / coaches / partners	Delivering bookings, leagues, events
Analytics providers	Improving platform performance
Legal / regulatory authorities	Compliance with legal obligations

All processors operate under contractual agreements to ensure data protection (as required under GDPR principles)

Your Rights

You have the right to:

Right	Description
Access	The data subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him are being processed, and, where that is the case, access to the personal data and to the following information: purpose of management, categories of processed data, recipients (if any), transfer and adequate guarantees (if any), period for which personal data will be stored, rights of data subjects, existence of an automated decision-making process (if any). The Data Controller provides a copy of personal data. If the request is made by electronic means, information are supplied in a commonly used electronic format, unless otherwise indicated.
Rectification	The data subject has the right to obtain the rectification of wrong personal data and the integration of incomplete personal data.
Erasure	The data subject shall have the right to obtain from the Data Controller the erasure of his personal data in the following cases: the personal data are no longer necessary in relation to the purpose for which they were collected or otherwise processed, withdrawal of consent (and there is no other legal bases for the processing), he opposes the processing for the reasons related to his particular situation (and there are no overriding legitimate grounds for the processing), he opposes the processing for direct marketing purposes, the personal data have been unlawfully processed, the personal data have to be erased for compliance with legal obligation, the data have been collected in relation to the offer of information society services. The right shall not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purpose in the public interest, scientific and historical research purpose or statistical purpose, for the establishment, exercise or defence of legal claim.
Restriction Of Processing	The data subject shall have the right to obtain from the Data Controller the restriction of processing if: the accuracy of the personal data is contested by the data subject (for a period enabling the Controller to verify the accuracy), the processing is unlawful (but the data subject opposes the erasure of the personal data and requests the restriction of their use rather than erasure), the personal data are required by the data subject for the establishment, exercise or defence of legal claim, although the Data Controller no longer needs it, he exercised the right to object (while the Data Controller verifies the existence of legitimate and prevailing reasons).
Data Portability	The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data Controller, in a structured, commonly used and machine- readable format (applicable to automated decision- making processes).
Objection	The data subject shall have the right of object to processing of personal data if (i) it is based on public interest or legitimate interest and (ii) if personal data are processed for direct marketing purpose, including profiling.
Withdrawal	The data subject has the right to withdraw the consent any time without affect the lawfulness of processing based on the consent before withdrawal.
Complaint	The data subject has the right to pledge a complaint with a supervisory authority.

Data Protection Principles

We follow key GDPR principles:

Data is processed lawfully, fairly and transparently
Data is collected only for specific purposes
Only necessary data is collected (data minimisation)
Data is kept accurate and secure
Data is retained only as long as required