Privacy policy

1. Who processes your data

The club you play at is responsible for the data of your sign-ups.

Touchless Applications, S.L. (tax number B02834083, Calle Pomar 4, Nave 2, 07010 Palma de Mallorca, Spain) runs the app and processes that data on the club's behalf, only to provide the service. It is also responsible for your account (name, email, mobile and password), which works at any club that uses the app.

Data protection contact: bvidal@borbalan.com.

2. What data we process and why

Your account: name, email, mobile, password (stored encrypted) and language. Used to create and protect your account and to notify you. Legal basis: the contract you accept when you join.

Your club level and, if you give it, your Playtomic level, and whether you are a member. Used to apply the right price and to make balanced courts. Legal basis: the contract.

Your sign-ups, with the exact time, the waitlist and the courts. Used to give spots in order of arrival and to organise the session. Legal basis: the contract.

Your payments, credit and refunds. We never see your card details. Used to charge, keep your credit and the club's accounts. Legal basis: the contract and the club's legal obligations.

The details of the partner you sign up with (name, mobile and level), so you can play together. Legal basis: the legitimate interest of the club and yours.

A log of actions and sign-ins, for security and to settle questions about a spot. Legal basis: legitimate interest.

The notices we send you (by email and, later, by WhatsApp), to check they went out. Legal basis: the contract.

Club news and offers, only if you agree to them separately. You can withdraw that permission at any time.

We do not process health data or other specially protected data. Confirming you are fit to play does not mean giving us medical data.

3. Automated decisions

Spots are assigned automatically in order of arrival, and the app may suggest courts by level. The club reviews and publishes the final courts. No decision with legal effects on you is made solely automatically. If you disagree with your spot or your level, you can ask a person at the club to review it.

4. Who sees your data

The club sees all the data above. Only the club sees your phone number and email.

Players of the club see your name in the lists of who is in and who is waiting for the turns you sign up to, and your court mates see it on the courts.

We never sell your data or share it for third-party advertising.

5. Providers

To run the service we use these providers, who process data on our instructions:

Supabase: database and accounts, in Frankfurt (European Union).

Vercel: app server, in Frankfurt (European Union). It is a US company.

Mailgun (Sinch): sending emails. It is a US company.

Stripe: card and Bizum payments, once the club switches them on. Stripe also processes payment data as a controller in its own right, for its anti-fraud and anti-money-laundering obligations.

Meta (WhatsApp): WhatsApp notices, once they are switched on. It is a US company.

Where a provider is based in the US or can access data from there, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

6. If someone else signs you up

If another player signs you up as their partner, we receive your name, mobile and level from them. We tell you in the first message, and you can object and ask us to delete your data.

7. Minors

You must be 18 or over to create an account. If we find an account belonging to a minor, we will delete it.

8. How long we keep your data

Your account and profile, until you delete your account.

Your record at a club where you no longer sign up: 24 months without activity, with notice before it is deleted.

Sign-ups and payments: 6 years, as Spanish commercial law requires, locked and not used for anything else.

Security log and notices sent: 12 months.

When you leave, what the law requires us to keep stays locked: it would only be used for a claim or an inspection.

9. Your rights

You can ask to access, correct, delete, object to, restrict and port your data, and withdraw your permission for advertising, by writing to bvidal@borbalan.com. We reply within one month.

You can delete your account yourself from "My account".

If you disagree with our reply, you can complain to the Spanish Data Protection Agency (www.aepd.es).

10. Security

Your password is stored encrypted and passwords known from data leaks are rejected. The connection is encrypted, each club can only see its own data and club staff sign in with two-step verification. If there were a security problem affecting you, we would let you know.

11. Changes

If this policy changes in an important way, we will tell you in the app or by email.