Privacy policy

Summary

Item	Details
Controller	[PENDIENTE: legal name], Tax ID [PENDIENTE: NIF/CIF], with registered address at [PENDIENTE: full postal address].
Contact	[PENDIENTE: privacy contact email] · [PENDIENTE: phone, if applicable]
Data Protection Officer (DPO)	[PENDIENTE: DPO contact details] or, where none has been appointed, the statement: “No DPO has been appointed because none of the circumstances set out in Article 37 GDPR apply.”
Purposes	Creating and managing your account, providing the court-booking and competitions service, processing charges and refunds, sending you operational communications, handling your requests, keeping the platform secure and producing usage analytics.
Legal basis	Performance of the contract, compliance with legal obligations, your consent and legitimate interest, depending on the processing activity (see section 3).
Recipients	Providers acting as processors (infrastructure, payments, email, analytics) and the clubs where you book or compete. Match chat messages are seen by the other players in that match and by the organisers of that competition. Data is not disclosed to third parties for commercial purposes. Full detail in section 5.
International transfers	As a general rule, data is processed within the European Economic Area. If a provider processes data outside the EEA, an adequacy decision or the European Commission’s Standard Contractual Clauses apply. Detail in section 6.
Your rights	Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, as well as lodging a complaint with the Spanish Data Protection Agency. How to exercise them: section 7.
Further information	All detailed information is set out in the sections below. For details of the cookies and the storage used on your device, see the cookie policy.

Applicable legislation

This policy complies with the Spanish and European legislation in force on the protection of personal data and on information society services:

• Regulation (EU) 2016/679 (GDPR), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).

1. Data controller

The controller of your personal data is:

• Entity: [PENDIENTE: legal name or full name of the controller]
• Tax ID: [PENDIENTE: NIF/CIF]
• Address: [PENDIENTE: full postal address]
• Email: [PENDIENTE: privacy contact email]
• Phone: [PENDIENTE: phone, if applicable]
• Website: [PENDIENTE: domain]

Data Protection Officer: [PENDIENTE: DPO name and/or contact email]. Where no DPO is appointed: “No Data Protection Officer has been appointed because none of the circumstances set out in Article 37 GDPR apply.”

2. Personal data we process

We process the following categories of data, depending on how you use the platform:

• Identification and contact data: first name, surname, email address and, where applicable, phone number.
• Account and authentication data: credentials, user identifier, sign-in data from external providers (for example, Google) when you choose that option.
• Service activity data: bookings made, clubs and courts used, participation in competitions, teams and sign-ups, match history.
• Payment data: payments are processed through the [PENDIENTE: confirm — Stripe] payment gateway. Reservo does not store your full card number; it receives and keeps data such as the transaction identifier, amount, payment status and the last digits or brand of the card.
• Communications: match-chat messages, coordination proposals and any feedback or support messages you send us.
• Technical and device data: IP address, device identifier, browser and operating system type, access logs and the data required to send push notifications when you enable them.
• Usage and analytics data: pages and screens visited, product events (booking flows, sign-up steps, feature usage) and performance metrics.

[PENDIENTE: review and confirm that this list of categories accurately reflects the data the platform processes.]

No special categories of data (health, political opinions, religion, etc.) are requested or processed.

3. Purposes and legal bases for processing

Purpose	Legal basis (GDPR)
Create and manage your user account.	Performance of a contract (Art. 6(1)(b)).
Record the acceptance of legal documents (terms of use, club terms, data processing agreement) with the date, the specific version of the text and the IP address from which it was accepted.	Compliance with legal obligations (Art. 6(1)(c)), as evidence of the proactive accountability required by Arts. 5(2) and 7(1) GDPR: without this evidence, Reservo cannot prove which text you accepted or when.
Manage court bookings, sign-ups, teams and competitions.	Performance of a contract (Art. 6(1)(b)).
Process charges, deposits and refunds, and keep accounting records of transactions.	Performance of a contract (Art. 6(1)(b)) and compliance with accounting and tax obligations (Art. 6(1)(c)).
Send you operational communications (confirmations, match alerts, changes and push notifications) related to your activity.	Performance of a contract (Art. 6(1)(b)).
Provide the match chat and the coordination tools between players.	Performance of a contract (Art. 6(1)(b)).
Retain the content of match chat messages after their author closes their account, so that issues and complaints arising in the competition where they were written can still be resolved.	Legitimate interest in managing and overseeing the competition (Art. 6(1)(f)), as permitted by Art. 17(3) GDPR. Retention period detailed in section 4.
Allow the organisers of a competition to access the chats of the matches they organise, in order to coordinate the calendar, resolve issues between teams and handle players’ calls from within the chat (@admin).	Legitimate interest of the organisers in managing and overseeing their own competition (Art. 6(1)(f)). You may object on grounds relating to your particular situation, as set out in section 7.
Handle reports of illegal content, moderate content published by users, and apply and give reasons for the corresponding measures.	Compliance with legal obligations (Art. 6(1)(c)), in particular Articles 16 and 17 of Regulation (EU) 2022/2065, and legitimate interest in maintaining a safe environment (Art. 6(1)(f)).
Handle your support requests and the exercise of your rights.	Compliance with legal obligations (Art. 6(1)(c)) and legitimate interest in handling enquiries (Art. 6(1)(f)).
Site performance measurement with Cloudflare Web Analytics: aggregate metrics for each page load, with no cookies, no persistent identifiers and no tracking across visits or across sites. It involves the transient processing of your IP address in order to infer the country.	Legitimate interest in understanding and improving the performance of the service (Art. 6(1)(f)). You may object as set out in section 7.
Product analytics (PostHog) to understand how the application is used.	Consent, given in the cookie banner (Art. 6(1)(a)). Details in the cookie policy.
Send commercial communications or service news.	[PENDIENTE: confirm whether this processing takes place. If so: consent (Art. 6(1)(a)) or legitimate interest for existing customers (Art. 6(1)(f)), as applicable.]
Fraud prevention, platform security and safeguarding the integrity of the service.	Legitimate interest in protecting the service and its users (Art. 6(1)(f)).
Comply with legal obligations and respond to requests from competent authorities.	Compliance with legal obligations (Art. 6(1)(c)).

Where the legal basis is legitimate interest, the corresponding balancing test has been carried out and you may request information about it at the contact address indicated.

4. Retention periods

We keep your data for the following periods. Once they elapse, the data is deleted or irreversibly anonymised.

• Account and profile data: for as long as the account is active. When you close your account from within the application, your identifying and contact data (first name, surname, email address, phone number and picture) are anonymised immediately and irreversibly, and your sessions, login credentials, notifications, preferences and push notification subscriptions are deleted. The record of your past activity is not deleted: it is retained for the periods set out in the points below, showing “Cuenta eliminada” (“Deleted account”) instead of your name. Some accounting entries keep the name recorded at the time of the transaction, because commercial and tax law require the record to remain legible (Art. 17(3)(b) GDPR).

• Legal document acceptances: the record of which version you accepted and when is kept as evidence for as long as a relationship with your account exists; if you delete your account, your personal acceptance record is deleted, except for any acceptance you left as a club representative (for example, accepting the data processing agreement), which is retained without your name attached because it is evidence of the club’s consent, not your own. The retention period for the IP address associated with each acceptance is [PENDIENTE: to be defined], together with that of your session IP address and technical logs.

• Booking, sign-up and competition data: [PENDIENTE: specific period].

• Billing, payment and accounting records: [PENDIENTE: specific period, e.g. 6 years] in accordance with commercial law (Art. 30 of the Spanish Commercial Code) and tax law (General Tax Act).

• Match chat messages: retained with their full content for [PENDIENTE: specific period — retention will be bounded to the competition’s life cycle plus a defined period afterwards; the exact period is still to be set]. If you delete your account, your messages are not deleted or blanked: they remain readable and are shown as signed by “Cuenta eliminada” (“Deleted account”). The reason is that a match chat is the record the organisers need in order to resolve an issue in the competition — schedule changes, no-shows, complaints — and blanking it would leave decisions already taken without an explanation. The legal basis is legitimate interest (Art. 6(1)(f)), as permitted by Art. 17(3) GDPR.

  Bear this in mind when writing: the text of your messages outlives the deletion of your account. If you include your own personal data inside the message itself (a phone number, an address), it will be retained along with it.

• Reports of illegal content, removed content and moderation decisions: [PENDIENTE: specific period]. Kept in order to demonstrate that the report was handled diligently and for the defence of legal claims.

• Support and feedback communications: [PENDIENTE: specific period].

• Product analytics data (PostHog): [PENDIENTE: configured retention period].

• Site performance metrics (Cloudflare Web Analytics): [PENDIENTE: retention period configured by Cloudflare].

• Technical and access logs: [PENDIENTE: specific period, e.g. 12 months].

• Data processed on the basis of consent: until you withdraw your consent.

• Data retained to handle claims and to exercise or defend legal actions: for the applicable statutory limitation periods.

[PENDIENTE: review each period with legal advice before publishing.]

5. Recipients and processors

To provide the service we rely on providers that process data on Reservo’s behalf as processors, under a contract compliant with Article 28 GDPR:

• Infrastructure and database: [PENDIENTE: provider and entity — e.g. Neon] ([PENDIENTE: server location]).
• Hosting, content delivery network and security: Cloudflare, Inc. (United States). [PENDIENTE: confirm the contracting entity and the transfer safeguards; see section 6.]
• Site performance measurement: Cloudflare, Inc. (United States), which processes the technical data described in section 3 on behalf of Reservo. [PENDIENTE: confirm the contracting entity and the applicable processing agreement.]
• Payment gateway: [PENDIENTE: provider — e.g. Stripe]. It may act as a processor and, for certain purposes of its own (fraud prevention, regulatory compliance), as an independent controller under its own privacy policy.
• Transactional email: [PENDIENTE: provider — e.g. Resend].
• Product analytics: [PENDIENTE: provider — e.g. PostHog], with processing on servers within the European Union.
• Push notifications: [PENDIENTE: provider / service used].
• [PENDIENTE: any other processor — e.g. email, monitoring, support services.]

Other recipients:

• Other players in the match: the messages you write in a match chat are visible, together with your name, to the other players in that match.

• Padel clubs: when you book a court or sign up for a competition, the relevant club accesses the data needed to manage your booking or participation, acting as an independent controller in respect of that data.

• Competition organisers (competition administrators and managers of the linked club): they access the chats of the matches in the competitions they organise, including their content, in order to coordinate the calendar, resolve issues between teams and handle players’ calls from within the chat (@admin). Access is limited to the competitions they administer: it does not extend to chats in other competitions or other clubs.

  Bear this in mind when you write: the match chat is not a private conversation as regards the competition organisers.

• Whoever reports illegal content: receives the reasoned decision on their report, with no more personal data about the parties than is essential to understand it.

• Public authorities, courts and law enforcement bodies: where there is a legal obligation to disclose the data.

Data is not disclosed to third parties for commercial purposes, and personal data is not sold.

6. International data transfers

As a general rule, your data is processed within the European Economic Area (EEA).

Cloudflare, Inc. is established in the United States, so hosting, content delivery and site performance measurement involve an international transfer. [PENDIENTE: confirm which of the two safeguards below covers it — Cloudflare’s adherence to the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or the Standard Contractual Clauses incorporated into its processing agreement.]

[PENDIENTE: confirm whether any OTHER processor listed in section 5 processes data outside the EEA.] Where a provider carries out processing outside the EEA, the transfer is covered by one of the following safeguards under Chapter V GDPR:

• an adequacy decision by the European Commission regarding the destination country, or
• the Standard Contractual Clauses approved by the European Commission, supplemented by additional measures where necessary following a transfer impact assessment.

You may request a copy of the safeguards applied by writing to [PENDIENTE: contact email].

7. Your data protection rights

You may exercise the following rights, free of charge:

• Access: find out what data we process about you and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data (“right to be forgotten”) where it is no longer necessary or you withdraw your consent.
• Objection: object to processing based on legitimate interest on grounds relating to your particular situation.
• Restriction: request that processing be restricted in the cases provided for by law.
• Portability: receive the data you have provided to us in a structured, commonly used and machine-readable format, or request its transmission to another controller where technically feasible.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• Not be subject to automated individual decisions producing legal or similarly significant effects. [PENDIENTE: confirm. By default: Reservo does not make decisions based solely on automated processing that produce legal effects on the user or significantly affect them.]

From within the application: you can exercise the rights of access and portability and the right to erasure yourself, immediately and without waiting for a reply, under Profile → Danger zone. “Export my data” downloads a file with your data in a structured, machine-readable format; “Delete my account” carries out the account closure described in section 4, after confirmation. If you are a club owner or a platform administrator, closure cannot be automatic — it would leave the club or the platform without anyone responsible — and you must request it through the channel below.

How to exercise the rest: send a request to [PENDIENTE: email or postal address], stating the right you wish to exercise and providing enough information to verify your identity. We will respond within one month of receiving the request, extendable by a further two months where the request is particularly complex, in which case we will inform you of the extension.

Complaint to the supervisory authority: if you consider that the processing of your data does not comply with the applicable rules, or you are not satisfied with the response to your request, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

8. Minors

The service is not directed at children under 14 years of age. In accordance with Article 7 of the LOPDGDD, minors under 14 may only register and use the service with the consent of those holding parental authority or guardianship.

[PENDIENTE: confirm the minimum operational age the platform requires and how it is verified.]

If we become aware that an account has been created for a child under 14 without valid consent from their legal representatives, we will delete it. If you become aware of such a situation, please report it to [PENDIENTE: contact email].

9. Data security

We apply appropriate technical and organisational measures to protect your data against destruction, loss, alteration or unauthorised access, including encryption of communications in transit, role-based access control and minimisation of the data processed.

Chat messages are not end-to-end encrypted. They travel encrypted and are stored with access restricted to the parties listed in section 5 —the players in the match and the competition organisers— but they are not technically inaccessible to the controller: they may have to be consulted in order to handle a report of illegal content or a legal request. Bear this in mind and do not use the chat for information you would not want to be retained. [PENDIENTE: detail additional relevant measures — backups, pseudonymisation, access logging, etc.]

10. Links to third-party websites

The service may link to third-party websites or embed their components. In particular, the payment process is completed in a form provided by the payment gateway identified in section 5.

When you visit those sites or provide data to them, the processing is governed by their own privacy policies, over which Reservo has no control. We recommend reviewing them before providing any personal data.

[PENDIENTE: enumerar los servicios de terceros con los que el usuario interactúa directamente y enlazar a su política de privacidad.]

11. Changes to this policy

We may update this policy to reflect legal, technical or service changes. Each version is identified by a version number and a last-updated date, shown at the top of the document, and the version history is retained so we can demonstrate which text was in force at any given time.

Where changes are substantive, we will notify you [PENDIENTE: by email and/or an in-app notice] a reasonable time before they take effect.