Privacy Policy

The controller responsible for data processing on this website is:

2.1 When visiting the website

When you access our website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a so-called log file.

The following information is recorded automatically:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Website from which access was made (referrer URL)
• Browser used and, if applicable, the operating system

2.2 During registration

When registering for padelturn, the following data is collected:

• Email address
• Optional: display name and profile information (e.g. skill level, club, avatar)
• For password login: password (stored as a bcrypt hash, never in plain text)
• For magic-link login: a one-time token sent by email and invalidated after use

2.3 During tournament creation and participation

When you create or participate in a tournament, additional tournament-related data is stored: tournament name and description, match results, pairings, brackets, schedules, live scores and confirmation/rejection events of match results. Public spectator views of tournaments are accessible under individual slugs — player names and results are visible there.

2.4 When using the in-app chat

Within a tournament, participants and the organiser may communicate via a tournament-internal chat. Chat messages are stored in our database and are visible to all participants and the organiser of the respective tournament. Transmission occurs in real time via WebSocket (Socket.io) on our own servers.

2.5 During CSV bulk import of participants

Tournament organisers can upload participant lists via CSV file. The uploading organiser is responsible for the lawfulness of collecting and transmitting this data to padelturn (in particular for any consents required from the affected players). padelturn processes the data exclusively for the purpose of running the respective tournament.

We use your data for the following purposes:

• Provision and operation of the padelturn platform
• Management of your user account
• Organisation and execution of padel tournaments and leagues
• Communication related to tournaments (sending confirmations, reminders and match updates by email)
• Provision of the public spectator views for viewers
• Technical administration and security of the website
• Improvement of our services

The processing of your personal data is based on the following legal grounds pursuant to Art. 6 (1) GDPR:

• Performance of contract (Art. 6 (1) (b) GDPR): Processing is required to perform the user agreement.
• Legitimate interests (Art. 6 (1) (f) GDPR): To safeguard our legitimate interests in the functionality and security of our website.
• Consent (Art. 6 (1) (a) GDPR): Where you have given us consent for processing.

Our website uses only strictly necessary and functional cookies as well as client-side storage. No tracking or marketing cookies are set.

• Session cookie (necessary): Maintains your login through the NextAuth session. Removed on sign-out.
• CSRF token (necessary): Protects against cross-site request forgery attacks.
• Language cookie (functional): Stores your selected language (de/en/es).
• Theme preference (local, not a cookie): Light/dark mode is stored exclusively in your browser's LocalStorage and is not transmitted to our servers.

Your personal data will only be disclosed to third parties in the following cases:

• You have given your express consent
• Disclosure is required for the performance of the contract
• There is a legal obligation to disclose
• Service providers necessary for operating the website (e.g. hosting providers) who are contractually bound to comply with data protection regulations
• Within publicly accessible tournament spectator views: player names, match results and tournament data are publicly visible via the respective tournament slug (consent to this is given by creating or joining a tournament)

7.1 Hosting, database and email delivery (Strato AG)

Our website, the database (PostgreSQL) and email delivery are operated on servers of Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Transactional emails (e.g. magic-link logins, registration confirmations, match notifications) are sent via Strato AG's SMTP relay. The servers are located in Germany.

Legal basis: Performance of contract (Art. 6 (1) (b) GDPR) and legitimate interests (Art. 6 (1) (f) GDPR).

7.2 No external trackers or analytics

padelturn does not use any third-party trackers, analytics tools (such as Google Analytics, Matomo, Plausible), advertising cookies, social media plugins, or map and font services with external data transmission. The entire data flow remains between your browser and our servers in Germany.

We store your personal data only as long as necessary to fulfil the purposes for which it was collected, or as required by statutory retention obligations. After these periods expire, the data is deleted or anonymised.

• Account data: until your account is deleted
• Tournament and match data: 2 years after tournament completion
• Chat messages: deleted together with the associated tournament
• Server log files: maximum 30 days
• Cookie data: between session end and 1 year, depending on cookie type

You have the following rights with regard to your personal data:

• Right of access: you may request information about your stored data
• Right to rectification: you may request correction of inaccurate data
• Right to erasure: you may request deletion of your data
• Right to restriction: you may request restriction of processing
• Right to object: you may object to processing
• Right to data portability: you may request the transfer of your data
• Right to withdraw consent: you may withdraw given consent at any time

To exercise these rights, please contact: support@padelturn.com

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us. The supervisory authority responsible for us is:

https://www.ldi.nrw.de

During your visit to the website we use the widely used TLS (Transport Layer Security) protocol in conjunction with the highest encryption level supported by your browser. Passwords are stored exclusively as a bcrypt hash. We additionally implement technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties.

We reserve the right to occasionally adjust this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The new privacy policy will then apply to your next visit.

For questions regarding the collection, processing or use of your personal data, or for requests for information, correction, blocking or deletion of data, please contact: