Privacy Policy

1. Who we are – the data controller

The Padel Tour platform (padeltour.ro) is operated by a natural person domiciled in Romania, hereinafter referred to as the “Controller”.

Contact details of the DPO / data protection officer:

• Email: claudiutigaroi@gmail.com

For any question about the processing of personal data or to exercise your rights, you can contact us at the email address above.

2. Categories of personal data collected

We collect and process the following categories of data:

2.1. Data you provide directly (when signing up or editing your profile):

• Full name;
• Email address;
• Phone number (optional, with the option to hide it);
• County and country of residence;
• Gender;
• Date of birth;
• Preferred playing position (left / right);
• Profile photo (optional);
• Custom username (optional);
• Description / bio (optional);
• Messages posted in the platform’s chats.

2.2. Data collected automatically during use:

• IP address – needed for authentication and account security to work;
• Estimated geographical location – the city and country derived from the IP address, stored for statistics on the use of the platform;
• Date and time of last activity (last_seen_at) – used to display presence status (online / idle / offline) to other logged-in users;
• Technical session data – browser type, operating system, screen resolution, pages visited – exclusively for statistical and diagnostic purposes;
• Cookies – described in detail in the Cookie Policy.

2.3. Data generated by your activity on the platform:

• History of tournament participation and registrations;
• Points accumulated and ranking positions;
• Match results recorded by the tournament organisers.

3. Purposes of processing and legal basis (Article 6 GDPR)

4. Location estimated from the IP address – full transparency

4.1. The platform records the IP addresses of logged-in users as part of the normal operation of the authentication service provided by Supabase.

4.2. Using a geolocation service, the IP address is converted into an estimated geographical location (city, country). This estimate has an accuracy of approximately 50–200 km and does not reflect the user’s exact address.

4.3. The estimated location may be shown to other logged-in users in the “Active users” panel, alongside the presence status. It serves as an indication of the region from which the user is playing at that moment.

4.4. Right to opt out: Each user may turn off the display of their location at any time by going to Profile → Personal data → edit → “Show my real-time location to other users”. The setting takes effect immediately and retroactively for future sessions.

4.5. Full IP addresses are never shown to other users. The stored location is exclusively at city level, without street or GPS coordinates.

4.bis Analytics, event log and consent (v1.1)

4.bis.1. To improve the platform, we record in an internal table (user_events) the significant actions of logged-in users: registering for a tournament, uploading a photo, posting a comment, liking, following a profile and unfollowing it, sending a message, opening the “My matches” list, adding a player to or removing a player from the followed list. Each row contains the user_id, the type of action, a timestamp, the type of device (phone / desktop / tablet) and, optionally, the ID of the resource concerned (tournament, photo, comment, followed player).

4.bis.1.bis. The list of followed players (“my crew”, used so that you see in the schedule only the matches that interest you) is saved in your account (player_follows), so that you can find it from any device. The list is visible to you and to the platform administrator; the followed player cannot see who follows them. You can clear it at any time from the follow bar on the tournament page, and it is deleted automatically when the account is deleted. If you are not logged in, the list remains exclusively in your browser.

4.bis.2. This data is used exclusively for internal aggregation – DAU/MAU, retention cohorts, engagement score, conversion funnel – and for reporting in the event of a possible transaction (due diligence). It is not shared with third parties for advertising or behavioural profiling outside the platform.

4.bis.3. Legal basis: Article 6(1)(b) GDPR (performance of a contract) for events directly linked to the use of the service (tournament registration, etc.) and Article 6(1)(f) (legitimate interest) for anonymous statistical aggregation.

4.bis.4. Page and session tracking (DAU/MAU, retention) is conditional on your explicit consent, given through the “Cookie preferences” banner on your first visit. You can change your consent at any time by going to Profile → Cookie & GDPR preferences.

4.bis.5. All consents are recorded in an audit table (user_consents) with a timestamp, the IP and the policy version, in accordance with Article 7(1) GDPR (proof of consent). You may request a copy at any time.

4.bis.6. Retention: the event log is kept for as long as the account exists. When the account is deleted, the events are deleted automatically (ON DELETE CASCADE). Consent records are kept for 6 years after the last change, as proof of compliance with GDPR obligations.

4.bis.7. The visitor counter – we show how many people are on the site right now and how many have visited in the last 24 hours. To do this we do not store the IP address and we do not write anything to your browser (no cookie, no identifier): the server calculates an irreversible cryptographic fingerprint (HMAC-SHA256) from the IP address and the user agent, with a key that changes every day, used exclusively so that we do not count the same person twice. The fingerprints are deleted automatically after 24 hours and cannot be linked from one day to the next or to your account. Only aggregate figures are displayed – never who exactly visited. The same fingerprint also counts visits to player profiles: each profile shows only the total number of visits (a person is counted once a day), not who made them. Legal basis: Article 6(1)(f) GDPR (legitimate interest – audience measurement). Because nothing is stored on the device, this count is not subject to the cookie consent requirement and works regardless of the option chosen in the banner.

4.bis.8. The badge photo – at tournaments that print player badges (plastic accreditation passes), you can take a photo of yourself from the chest up. The camera guidance (framing, lighting, angle) runs on your phone; face detection is used only for framing – we do not perform facial recognition and we do not compare the photo with other photos. We do not record video: only the photo you confirm is uploaded, together with at most 4 frames taken while the photo was being taken (the sharpest ones), so that the organiser can choose a better one if the photo is blurred; the frames are deleted when you take a new photo or delete your account. For the uploaded photo, we remove the background on our servers, and its suitability for an ID-style pass is checked automatically by an artificial intelligence model (Anthropic Claude); uncertain cases are reviewed by a person from the organiser’s team. The approved photo is public: it appears on your public profile, in the official Padel Tour badge, and on the badges of the tournaments you are registered for. You can hide it from your profile at any time in Profile → “Show the badge on my public profile”, you can replace it at any time from your Profile, and it is deleted when the account is deleted. Photos that have not been approved and the frames can be seen only by you, the administrators of the badge tournaments you are registered for and the platform administrator. Legal basis: Article 6(1)(b) GDPR – participation in the tournament, for the tournament badges; Article 6(1)(f) GDPR (legitimate interest) for display on the public profile, with the right to object at any time using the same checkbox.

5. Recipients of the data – who else has access

5.1. Supabase Inc. (USA) – provider of databases, authentication and file storage. The data is protected by standard contractual clauses (Standard Contractual Clauses – SCCs) approved by the European Commission, which ensure a level of protection equivalent to that in the EU.

5.2. Vercel Inc. (USA) – hosting provider for the web application. The same SCC safeguards apply.

5.2.bis. Anthropic PBC (USA) – automatic checking of badge photos and of Marketplace listings. It receives only the image (and, for listings, the text) to be checked, as a processor, with the same SCC safeguards.

5.3. Platform administrators – have access to data to the extent necessary to manage the platform, resolve disputes and moderate content. This includes private messages, which platform administrators may access for user safety, moderation (for example following a report) and legal requests, and for no other purpose.

5.4. Tournament organisers (sports clubs) – have limited access to the data of players registered for the tournaments they organise (name, category, registration status), exclusively for the purpose of organising the competition.

5.5. We never sell your data. We do not transfer personal data to third parties for commercial purposes and we do not use data for behavioural advertising or automated profiling within the meaning of the GDPR.

5.6. Data may be disclosed to the competent authorities (ANSPDCP, courts, police) only where required by law or where necessary to protect the rights of the Controller or of other users.

6. International data transfers

Your data is stored on servers managed by Supabase and Vercel, which may be located in the United States of America or in other third countries. These transfers are carried out with the safeguards provided for in Article 46 GDPR, by means of the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914/EU). A copy of these clauses may be requested at the contact email address.

7. Data retention period

Updated in v1.1 – policies applied automatically by a nightly job (Postgres cron). Verifiable on audit.

• Account and profile data: for as long as the Account exists. When the account is deleted (self-service from the Profile or on request), the data is deleted immediately and permanently from all related tables (CASCADE).
• Competition history (participation, points, results): for 5 years from the last participation, for reasons of legitimate sporting interest and competitive transparency. Attributed anonymously (“Deleted player”) after the account is deleted.
• Chat messages (group chats and private conversations): for as long as the Account exists. When the account is deleted, the messages you sent and the private conversations you took part in are deleted.
• IP addresses: deleted (NULL) after 90 days in all tracking tables (site_sessions, user_events, user_consents). The rest of the session data (paths, timestamps) is kept without an IP identifier for aggregated internal analytics.
• Browser user agent: deleted after 180 days.
• Referrer (URL of origin): deleted after 365 days.
• Raw pageview and session rows: deleted after 2 years; only the monthly aggregates (DAU/MAU, retention) are kept.
• Per-user event log (user_events): kept for as long as the Account exists. Deleted automatically when the account is deleted.
• Consent records (user_consents): 6 years from the last change, as proof of compliance with Article 7(1) GDPR.
• Location data estimated from the IP: max 90 days for the raw field; the derived city is kept on the profile for as long as the “Show location” setting is on.
• Audit and security logs: max 12 months.

8. Your rights under the GDPR

As a data subject, you have the following rights, which you can exercise free of charge by email to claudiutigaroi@gmail.com, stating in the subject line the right you are invoking:

• Right of access (Article 15 GDPR): Self-service – download a complete copy of your data in JSON format from Profile → “Download my data”. It includes all the tables that relate to you: profile, registrations, photos, comments, likes, messages, events, consents.
• Right to rectification (Article 16 GDPR): You have the right to request the correction of inaccurate data or the completion of incomplete data. You can do this directly from the profile section.
• Right to erasure / “right to be forgotten” (Article 17 GDPR): Self-service – delete your account permanently from Profile → “Delete account” (confirmed by typing your email). All related data is deleted immediately, except for the anonymised competition history, which is kept for 5 years.
• Right to restriction of processing (Article 18 GDPR): You have the right to request that the processing of your data be restricted in certain circumstances (e.g. if you contest the accuracy of the data).
• Right to data portability (Article 20 GDPR): You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format (JSON/CSV).
• Right to object (Article 21 GDPR): You have the right to object to the processing of your data based on the Controller’s legitimate interest.
• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent (e.g. displaying the location derived from the IP), you can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw it from your profile settings or by a request to the email address.
• Right not to be subject to automated decision-making (Article 22 GDPR): We do not use fully automated decision-making processes or profiling that produce legal effects concerning you.

We will respond to requests within a maximum of 30 calendar days of receipt. If the request is complex, this period may be extended by a further 60 days, after notifying you in advance.

9. Supervisory authority

If you consider that your rights have not been respected, you have the right to lodge a complaint with the national supervisory authority:

10. Data security

10.1. The Controller has implemented appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or accidental destruction, including:

• Encryption of passwords using the bcrypt algorithm;
• Data transmission exclusively over HTTPS/TLS connections;
• Role-based access control policies (RLS – Row Level Security in the database);
• Two-factor authentication available through third-party providers (Google OAuth);
• Periodic auditing of access policies.

10.2. In the event of a security incident affecting your data, we will notify you in accordance with Article 34 GDPR, without undue delay.

11. Minors

The platform is not intended for persons under the age of 16. We do not knowingly collect data from minors under this age. If we learn that we have collected data from a minor under 16 without the consent of their parent or legal guardian, we will delete this data immediately. Persons aged between 16 and 18 may use the platform with the consent of their parent or guardian, who gave their agreement at sign-up.

12. Cookies

The use of cookies is described in detail in the Cookie Policy. By continuing to use the Platform after viewing the cookie banner, you agree to the use of the cookies described there.

13. Changes to the policy

The Controller may periodically update this Privacy Policy. Significant changes will be communicated by email or by displaying a notice on the Platform at least 30 days before they take effect. We recommend that you check this page periodically. Continued use of the Platform after the effective date constitutes acceptance of the changes.