Privacy Policy

Key information at a glance

SmashPlay is a platform that allows parents and legal guardians who are of legal age to organise the padel activities of the minors in their care, and allows clubs and organisers to manage their academies, events and bookings. In this Policy you will find:

• Who processes your data (SmashPlay, S.L.).
• What data we process about you and about the minors you register.
• What we use it for and on what legal basis.
• How long we keep it and what happens when you delete your account.
• Who can see the minors' data and what you decide.
• Who we share it with (clubs, organisers, providers).
• How to exercise your rights.

1. Data controller

The controller of the personal data collected through the website smashplay.app and the application app.smashplay.app is:

• Company name: SmashPlay, S.L. (hereinafter, "SmashPlay")
• Tax ID (NIF): [TAX ID PENDING]
• Registered office: Calle Pau Claris, 44, local · Barcelona · Spain
• Data protection email: legal@smashplay.app
• General contact: info@smashplay.app

1.1 Data Protection Officer (DPO)

The formal appointment of SmashPlay's Data Protection Officer is pending. Until then, any enquiry or request to exercise your rights may be sent to legal@smashplay.app. Once the Data Protection Officer has been appointed, we will update this Policy with their details and notify the Spanish Data Protection Agency (AEPD) (Article 34.4 LOPDGDD).

2. Personal data we process

2.1 Data of the adult (parent or legal guardian)

Only people over 18 years of age may create a family account. We process the following data about you:

• Identification and access: first name and surnames, email address and password (the password is stored in encrypted form by our authentication provider; SmashPlay does not know it).
• Contact: mobile phone number (optional) and province and municipality (to find partners, opponents, courts and events nearby).
• Preferences and permissions: the app language and the permissions you switch on or off (section 6).
• Activity in the app: matches, registrations, bookings, messages in the chat between families and payments made.
• Record of acceptances: which document you accepted, its “Last updated” date, the language, and the date and time at which you accepted it.
• Technical data: IP address and device data (operating system, browser, language) and, if you turn on notifications on your phone, that device's code used to send them to you (push token).
• Payment data: payments are made on Stripe's page. SmashPlay does not see or store your card details; it only stores the amount, the date, the description and the Stripe payment reference.
• Invitations from a club: if a club invites you to a booking made at its front desk by entering your email, we only use it to find your account and send you the invitation in the app. We do not store it or tell the club whether you have a SmashPlay account.

2.2 Data of the minor you register

As the parent or legal guardian, you are the person who provides this data about the minor and who makes decisions about it:

• Identification: first name and, optionally, first surname; date of birth (for their sporting category) and sex (competition categories are organised by age and sex).
• Sporting data: playing level (declared by you or verified by a club, section 6.7), preferred position, playing style (optional), the club where they train (optional), history of matches, tournaments and americanas, results, ranking points and badges.
• Assessments and reports: the assessments and reports that the club where the minor trains writes about them, if that club uses these features.
• Photo (optional): only if you decide to upload one. You choose where it is shown (section 6.4).

2.3 Data of clubs and organisers

For club and organiser accounts, we process the data of the contact person (name, email, phone number), the data of the club or organiser shown on its listing and the data necessary for its plan and invoicing. The data of its payout account (identity, tax details and bank account) are collected and managed by Stripe.

2.4 Location

When you search for courts nearby, the app asks for your permission to use your approximate location. It is used only at that moment to calculate distances and is not stored.

3. Purposes of processing

3.1 To provide the service

1. To create and manage your account and the sporting profiles of the minors in your care.
2. To find compatible partners and opponents (by level, age, category, position and area) and to organise matches.
3. To manage registrations for tournaments, americanas and Assessment Days, their draws, results and waiting lists.
4. To manage court bookings and payments, including refunds.
5. To enable the chat between adults (families, clubs and organisers). Minors do not have access to the chat.
6. To send you notifications about your activity (registrations, matches, results, refunds) and, if you switch them on, last-minute alerts about events in your province and alerts about last-minute available courts and free places in matches in your province.
7. To allow the club where the minor trains to verify their level and, if it uses these features, to assess them and share reports with you.
8. To show the ranking to families, only for players whose family has switched it on.
9. To allow verified clubs and organisers to find the minor and contact you, only if you have switched this on.
10. To keep a record of what you have accepted, so that we can demonstrate it.

3.2 Other purposes

1. Internal statistics: aggregated and anonymous figures based on platform data, to improve the service. The app does not use analytics or tracking tools.
2. Marketing communications from SmashPlay, only if you give your express consent.
3. User support: enquiries, incidents and complaints.
4. Legal obligations: accounting, tax and requests from the authorities.

4. Legal basis for processing

4.1 Consent regarding minors' data

Under Article 7 of the LOPDGDD, the processing of the data of minors under fourteen years of age requires the consent of the holder of parental authority or guardianship. SmashPlay goes further: only people over 18 years of age may create an account and minors do not have their own account. Their data is provided, managed and may be deleted exclusively by their parent or legal guardian from their account.

By registering a minor, you declare under your own responsibility:

a) That you are their parent or legal guardian, with parental authority or guardianship.

b) That you are able to authorise the processing of their data under the terms of this Policy.

c) That you have informed them, to the extent that their age and maturity allow, of their registration and of what the platform does.

d) That you will keep their data up to date and will delete it when appropriate.

This declaration is stored in the record of acceptances, one for each minor. SmashPlay may ask for proof of parental authority or guardianship if there is reasonable doubt.

5. How long we keep data and what happens when an account is deleted

5.1 Deleting your account or a player

You can delete your account, or just one of the minors in your care, from “Legal and privacy” in the app. Before you confirm, we show you what will be deleted and what will be cancelled.

• Everything is deleted immediately and cannot be recovered: your profile, the minors, their photos, levels, assessments, ranking, badges, partners and your chats. There is no cooling-off period.
• Future registrations and bookings: they are cancelled and the place becomes available. Any refund follows SmashPlay's cancellation rules. If an event is already in progress, the player can be deleted, but there is no refund.
• What other families see: in the draws, standings and histories of other players, the deleted minor appears as “Withdrawn player”, without a name. In chats, the other family sees “This conversation is no longer available” and the conversation is deleted.
• If the minor was playing as part of a pair: their partner remains registered and we notify their family.

5.2 Closure of a club or organiser account

The account is deactivated when closure is requested and is permanently deleted after 7 days, unless the closure is cancelled beforehand. While it is deactivated, it does not appear in the directory or in searches. If it was a club with a listing in the directory, the public listing returns to the directory without an owner. The reports and assessments that families could already see remain on the minor's profile with the club's name, and the level the club verified is kept with its name; the club's internal notes are deleted. Its payout account is deactivated immediately and closed 120 days after the last payment received.

5.3 Retention periods

Stripe independently retains the records of the payments it processes, including the email address you paid with, in accordance with its own legal obligations and its privacy policy. That email address also appears in the club's record of payments in Stripe.

6. Enhanced protection of minors

6.1 You decide: everything switched off by default

The permissions over the minors' data are in “Legal and privacy” → “Privacy and permissions” and also where they are used (your profile and each player's profile). Changing a permission in one place changes it in the other. In a new account, they are all switched off. You can change them whenever you wish and the change takes effect immediately.

6.2 Who sees the minor's name

• Your family: their full name.
• Other families: only the first name and the initial of the first surname (for example, "Sergio S.").
• The verified club where the minor trains: their full name, to manage its academy.
• The club or organiser of an event for which you register the minor: their full name, because in order to organise the event it needs to distinguish between minors with the same first name and initial.

6.3 Event draws and standings

The draws and standings of americanas and tournaments can only be seen by the club or organiser of the event, its helpers for the duration of the event and families with a player registered for that event. This way, nobody else can find out where and at what time a minor will be playing.

6.4 Photo of the minor

Uploading a photo is optional. Your family can always see it. For other families, you choose place by place where it is shown: “In partner and opponent searches” and “In the ranking”. Both options are switched off by default; wherever you do not switch them on, the minor's initials are shown. When you switch an option off, the photo stops being shown in that place immediately. The photo can only be opened by the minor's family and by the people to whom you show it in the app. “The photo never leaves the app” and SmashPlay will never use it for commercial or promotional purposes.

6.5 Ranking

The overall ranking is optional and is switched on player by player (“Show [name] in the ranking”). It is switched off by default. If you switch it on, logged-in families see the player's first name, the initial of their surname, their club, their category, their province and their points, and their photo only if you have chosen this in their profile. Clubs, organisers and people who are not logged in cannot see the ranking. If you switch it off, the player leaves the ranking immediately and their points continue to be stored only for your family.

6.6 Search by clubs and organisers, and contact with you

• “Allow search by clubs” (for each player): clubs and organisers verified by SmashPlay can find the player's profile when searching for players. A club or organiser that has not been verified cannot search for minors.
• “Contact about proposals” (for your family): allows a verified club or organiser to write to you with sporting proposals for your players (for example, inviting a player to an event) from that search tool. Both permissions are required for them to write to you or to invite the player. If only the first one is switched on, they can see the profile but cannot contact you.
• The club where the minor trains and the club or organiser of an event for which the minor is already registered can write to you without these permissions, because you already have a relationship with them.

6.7 Who can verify the minor's level

A minor's level can only be verified by a verified club: the club where they train or the club that assesses them at a SmashPlay Assessment Day for which they are registered (from the day of the Assessment Day until 7 days afterwards). Tournaments, americanas and training camps do not grant that permission. The minor's profile shows which club validated their level.

6.8 The minor does not take part in communications

Chats are only between adults (families, clubs and organisers). The minor does not have access to the chat, does not send or receive messages and does not share contact details.

6.9 No advertising aimed at minors

SmashPlay does not show advertising aimed at minors and does not use their data to target advertising. Any marketing communication is addressed only to the adult, and only if they have given their consent.

6.10 No automated profiling

SmashPlay does not make automated decisions with legal or similarly significant effects on the minor. The matchmaking only suggests partners and opponents using sporting criteria (level, age, category, position and area).

6.11 Rights of the minor

Although the rights are exercised by their parent or legal guardian, the minor may ask them to exercise those rights on their behalf. From the age of 14, in accordance with Article 7 LOPDGDD, the minor may exercise certain rights on their own; please consult us about each case at legal@smashplay.app.

6.12 Separation of data

The minor's data is stored separately from the adult's data, with its own identifiers. The minor's photo, points, badges and history can only be read by their family; the public standings use an identifier that is different from the minor's own.

6.13 The public website does not show minors' data

The website smashplay.app does not show any data or any photo of the registered minors.

7. Who we share data with

SmashPlay only discloses personal data when this is necessary to provide the service or when required by law.

7.1 Club where the minor trains

If you indicate the club where the minor trains and that club is verified, its administrators see the minor's full name and level in order to manage its academy, verify the minor's level and, if they use these features, assess the minor and send you reports. They also see your full name, as the adult who registered the minor. A club that has not been verified does not see the players in its academy. The club is contractually bound to SmashPlay to use this data only for these purposes.

7.2 Clubs and organisers of events and bookings

When you register a minor for an event or book a court, the club or organiser sees the data necessary to manage it: the minor's full name, category and level, and your full name as the adult who registers or pays. It only sees your contact details if you have switched on “Contact about events”, and only those you choose in “What I share”.

7.3 Your contact details: “Contact about events”, “Contact about proposals” and “What I share”

Voluntarily and with your consent, you can share your contact details as an adult (email, phone number or both: you choose in “What I share”). The minor's contact details are never shared. There are two independent permissions; switching one on does not switch the other on:

• Contact about events. The club or organiser of an event for which you have registered a minor in your care can contact you to resolve incidents or organisational matters relating to that event, including if you are on its waiting list. Your details stop being shown when the event ends.
• Contact about proposals. A verified club or organiser can contact you with sporting proposals for the minors in your care from the player search tool (section 6.6). This remains in place for as long as you keep the permission switched on.

There is no list or directory of families. Clubs and organisers are contractually bound to use this data only for the purpose you have allowed, and are prohibited from using it for advertising or marketing communications, from passing it on to third parties and from adding it to marketing databases. If they breach these obligations, they may be suspended or expelled from the platform. These obligations are set out in the Terms for clubs and organisers.

You can withdraw each permission at any time from the app, without this affecting anything done beforehand.

7.4 Other families

To find partners and opponents, other families see the minor's first name and initial, their sporting data and their area, and their photo only if you have chosen this. Chat takes place between the adults. Of you, they see your first name and the initial of your surname. In open matches, signed-in families can see the first name, initial, level and team of the players already signed up, together with the club, day and time of the match, so they can decide whether to join.

7.5 Refunds that cannot be made to the card

If a refund to your card fails (for example, because the card has expired or been cancelled), we will notify you. If you have already deleted your account, we use the email address on the payment receipt held by Stripe solely to notify you. The club must refund the money to you by Bizum or bank transfer: for this purpose, we will ask you for the number or the account solely for that refund, or we will give you the club's contact details. We never give the club your email address or phone number without your permission.

7.6 Providers (data processors)

These providers supply technical services to SmashPlay and act as data processors (Article 28 GDPR), under contracts that require them to comply with the applicable legislation:

Phone notifications are delivered through the notification service of your phone or browser (Google, Apple, Mozilla or Microsoft, depending on the device you use). Their content is encrypted. You can turn off notifications, or each type of notification, at any time from your profile.

7.7 International transfers

If any processing involves sending data outside the European Economic Area (for example, to the US), this is done on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework), standard contractual clauses or other equivalent safeguards. You can request a copy of the safeguards at legal@smashplay.app.

7.8 Legal obligations

SmashPlay may disclose data to law enforcement agencies, to judges and courts or to public authorities (the Spanish Tax Agency, the AEPD) when required by law.

7.9 SmashPlay does not sell data

SmashPlay does not sell, rent or transfer personal data for commercial purposes, nor does it cross-reference it with other databases for marketing purposes.

8. Your rights

You can exercise these rights over your own data and, as the parent or legal guardian, over the minor's data:

8.1 How to exercise them

• From the app: in “Legal and privacy” you can see what you have accepted and when, change your permissions and delete your account or a player.
• By email: write to legal@smashplay.app with the subject line “GDPR rights request”, stating which right you wish to exercise and over which data. If you write from your account's email address, you do not need to send any document; we will only ask you to prove your identity, or your parental authority or guardianship, if there is reasonable doubt.

We will reply within a maximum of one month, which may be extended by a further two months in particularly complex cases (Art. 12.3 GDPR).

8.2 Complaint to the supervisory authority

If you believe that we are not processing your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es · electronic office: https://sedeagpd.gob.es. We recommend that you write to us first to try to resolve the matter.

9. Security measures

SmashPlay applies technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• Encrypted communications (TLS 1.2 or higher).
• Encrypted passwords, managed by the login provider.
• Access by account type: the database rules separate what each family, club or organiser can see, and they are checked with automated tests before every change.
• Server-side checks of sensitive operations (contacts, invitations, payments and deletions).
• Protected photos of minors: only the minor's family can upload, change or delete them.
• Data processing agreements with providers.
• Notification of personal data breaches to the AEPD within a maximum of 72 hours (Art. 33 GDPR) and, where appropriate, to the people affected (Art. 34 GDPR).

No system is completely invulnerable, but we review these measures every time the platform changes.

10. Cookies and browser storage

• Website smashplay.app: the use of cookies is governed by the Cookie Policy.
• App app.smashplay.app: the app does not install its own or third-party cookies and does not use analytics, advertising or tracking. It stores only four technical or preference items in your browser: the logged-in session (Firebase, until you log out), the chosen language and two flags that last until you close the tab (one so that the prompt to install the app is not repeated and another so that the app is updated only once). Payments are made on Stripe's page, which uses its own cookies in accordance with its policy. If you turn on phone notifications, your browser also stores the subscription to those notifications, which is needed to receive them, until you turn them off.

If in the future we add anything that changes this (for example, an anti-fraud tool), we will update this section before activating it.

11. Changes to this Policy

SmashPlay may amend this Policy to adapt it to legal, technical or service changes. If a change is significant, we will inform registered users at least 30 days in advance, by means of a notice in the app or by email.

The current version is always available at https://smashplay.app/privacidad, together with its last updated date.

This Policy is published in Spanish, French, English, Italian and Portuguese. In the event of any discrepancy between versions, the Spanish version prevails.

12. This Policy and your acceptance

This Policy informs you of how we process data. By registering, you confirm that you have read it, and in “Legal and privacy” you can see at any time which documents you accepted and when. The consents in section 6 are requested separately in the app and you can withdraw them whenever you wish.

If you have any questions, please write to us at legal@smashplay.app.