Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have questions about how we handle your data, you can reach us at the address above. We aim to respond to all data-related enquiries within 30 days.

2. Categories of Personal Data

We collect and process the following categories of personal data:

Account data

Name, email address, and hashed password that you provide when creating an account. If you sign up through a third-party provider, we receive your name and email from that provider.

Organization and league data

Organization name, season settings, schedule rules, and membership roles (such as Admin, Core, or Reserve) that you or your organization administrator configure within PadelRoster.

Activity data

Attendance status, match scores, player statistics, leaderboard positions, and session participation records generated through your use of the platform.

Payment data

If you subscribe to a paid plan, payment processing is handled by Stripe. We store your Stripe customer ID and subscription status but do not store credit card numbers or full payment details on our servers.

Technical data

IP address, browser type, device information, and access timestamps collected automatically when you use the platform. This data is used for security, rate limiting, and service reliability.

3. Purpose and Legal Basis

We process your personal data for the following purposes and legal bases under GDPR Article 6(1):

4. Recipients and Subprocessors

We share your personal data only when necessary to operate the platform or when required by law. The following categories of recipients may receive your data:

We do not sell your personal data. Data shared with subprocessors is limited to what is strictly necessary for them to perform their service.

Within your organization

Other members of your PadelRoster organization can see your name, membership role, attendance status, match scores, and statistics. Organization administrators have additional visibility into membership management. This sharing is inherent to the collaborative nature of the platform.

5. Data Retention

We retain your personal data only as long as necessary for the purposes described above:

• Active accounts: Your data is retained for the duration of your account. If your account is inactive for more than 24 months, we may contact you before deleting the account and associated data.
• Deleted accounts: When you delete your account, we remove your personal data within 30 days. Certain data may be retained longer where required by law (for example, financial transaction records under Danish bookkeeping rules are retained for 5 years).
• Technical logs: IP addresses and access logs are retained for up to 90 days for security and debugging purposes, then automatically deleted.
• Aggregated data: We may retain anonymized, aggregated statistics indefinitely, as these cannot be linked back to individual users.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data. You can exercise these rights by contacting us at privacy@padelroster.com.

• Right of access (Art. 15): You can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You can ask us to correct inaccurate or incomplete data. You can also update most information directly in your account settings.
• Right to erasure (Art. 17): You can request deletion of your personal data, subject to legal retention requirements.
• Right to restriction (Art. 18): You can request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You can request your data in a structured, machine-readable format.
• Right to object (Art. 21): You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

If you believe your rights have been violated, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

7. Cookies and Local Storage

The PadelRoster application uses browser local storage to maintain your authentication session and user preferences. When you accept analytics consent, Google Analytics may set first-party measurement cookies on our domains to help us understand product adoption.

The marketing website (padelroster.com) shows a consent banner before analytics is loaded. If consent is declined, we do not load analytics for marketing-site measurement.

8. International Transfers

Our primary infrastructure is hosted within the European Union (Hetzner, Germany/Finland). Where data is transferred to subprocessors outside the EU (specifically Stripe and Postmark in the United States), we ensure appropriate safeguards are in place through EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

9. Children

PadelRoster is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at privacy@padelroster.com and we will delete the data promptly.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you through the platform or by email. The "Last updated" date at the top of this page indicates the most recent revision.

11. Contact

For any questions, concerns, or requests related to this privacy policy or your personal data, please contact us:

We aim to respond to all privacy-related requests within 30 days. If your request is particularly complex, we may extend this period by an additional 60 days and will inform you of the extension.