Padelution – Privacy Policy
Controller: Padelution Oy · Business ID 3302427-9 · Friisinniityntie 5 A, 02240 Espoo, Finland · +358 40 766 1957 · info@padelution.com
This Privacy Policy explains how Padelution processes personal data, why, on what legal basis, who receives it, how long we keep it and what rights you have.
1. Who we are
1.1 Padelution Oy ("Padelution", "we", "us") is the controller for the processing described in this policy, except where section 3 says an organisation is responsible.
1.2 For anything about your personal data, including requests to use your rights, contact us at info@padelution.com or by post at the address above. We have not appointed a data protection officer.
2. What this policy covers
2.1 This policy covers padelution.com, the Padelution mobile apps and related services (the "Service"). It applies to everyone whose personal data we process through the Service:
players and other users with an account, and the guardians who manage linked accounts
people whose names and results an organiser enters without them having an account, and professional players in the public rankings we show
visitors who use the Service without signing in
people who use the Service for a club, federation or other organisation.
2.2 This policy doesn't cover the processing that organisations do for their own purposes (section 3.2), or websites run by others that we link to.
3. Who is responsible for what
3.1 Padelution is the controller for:
user accounts and public profiles
results, competition history, rankings and ratings
statistics, PLUS and AI recaps
messaging and support
payments for our own products, the payments we collect for organisations as their agent, and the related accounting, VAT and tax-reporting records
security, analytics and advertising.
3.2 Organisations are the controllers for the data in their own registers and tools in Padelution:
clubs, venues, federations and other organisers, such as their member, customer and participant records
staff notes
analytics about their customers
the surveys and messages they send
the contact details they receive once you accept a membership or confirm your participation.
We process that data on the organisation's behalf, as its processor. The organisation is responsible for telling you about its processing, and its own privacy notice applies. Contact the organisation about that data. If your request reaches us, we forward it.
3.3 Organisers who enter results are responsible for having the right to enter you in their competitions. We decide how results are shown and used in the Service.
3.4 Stripe, our payment provider, also processes payment data as a separate controller for its own legal obligations, such as fraud prevention and anti-money-laundering checks. Stripe's privacy policy applies to that processing.
4. The personal data we process
4.1 What we process depends on the features you use.
Account and profile: Name; e-mail address; phone number; date of birth; gender; nationality and country; home club; playing preferences, such as court side and hand; profile photo; language and region; privacy settings, such as "Show my age", statistics and messaging; password (stored hashed) and passkeys; links between linked accounts and their managers; licence system IDs and licence details, if linked; follows and saved searches.
Terms and consents: Which Terms version you accepted, when, and the IP address and browser used; your cookie choices.
Competition and match: Entries and participation; teams and pairs; partners and opponents; schedules; results, set and game scores; placings; rankings; ratings and rating history; OpenMix games and playgroups you are in; votes you give, such as level votes after OpenMix games and fan votes; your best mini-game scores and whether your name shows on their leaderboards.
Statistics: Statistics calculated from match data, such as win percentages, form, head-to-head records and comparisons; your AI recap if you have PLUS.
Purchases and payments: PLUS subscriptions; gift cards, including the recipient's name, e-mail address and the buyer's message; event, league and membership purchases; amounts, payment status, receipts, refunds, disputes and unpaid amounts; card details held by Stripe, of which we see only limited details, such as the card brand, last four digits, expiry date and country; VAT evidence, such as the country of your card and of your IP address.
Memberships and licences: Memberships and their validity; renewals; licence status, including licences synced from licence systems; certifications.
Messages: Message content and photos (we remove location and other metadata from photos); who is in each conversation; read status; when you were last active.
Support: Your support chat messages, the page you were on, browser details and any screenshots you attach.
Reports and moderation: Reports you make or that concern you, and our decisions, including bans.
Surveys: Your answers to surveys that organisations or we send you.
Location: Your saved location (a map point and its city), if you set one; your approximate location (country or city) based on your IP address.
Technical and security: IP address; device and browser details; sessions and sign-ins, including failed sign-in attempts and the e-mail address or phone number typed; security and error logs; cookie and device storage identifiers; Google Analytics data if you consent.
Organisation admins: Your name, contact details and role for an organisation's page; the actions you take in its admin, which we log; the organisation's billing details.
Sellers: For organisations and private persons who sell through the Service: legal name, address, business ID, contact details and sales through the Service, and the further details that tax reporting may require, such as a tax ID, a private seller's date of birth and bank account details.
4.2 Required details. To create an account, you must give the details the sign-up form marks as required, such as your name, e-mail address, phone number, date of birth and nationality. We need them to contact you, secure your account, apply the age rules and run competitions, so we can't create an account without them. Other details are optional.
4.3 We don't ask for health information or other sensitive personal data, and we ask organisations not to record it in Padelution.
5. Where the data comes from
We get personal data:
from you, when you create an account, use the Service, buy something or contact us
from organisers, when they add you to events, leagues, member registers or groups, import their member lists, or enter results
from other users, when they enter results of matches you played, add you to OpenMix games, send you messages, manage your linked account or buy you a gift
from the previous version of Padelution: if you had an account there, we moved your account, match history and ratings to the current Service on 27 October 2026, and recalculated the ratings
from licence systems, such as Suomisport, if you link your account there or your licence is synced to a club or federation that uses Padelution
from public rankings, such as the International Padel Federation's (FIP) world ranking of professional players, which we show
from Stripe, about the status of your payments
from location services, which give us the city for a saved map point and an approximate location for an IP address
automatically, from your use of the Service, through logs, cookies and similar technologies (section 12).
6. Why we process your data and on what legal basis
6.1 The legal bases come from Article 6(1) of the GDPR: contract (b), legal obligation (c), legitimate interests (f) and consent (a).
Creating and running your account, and providing the features you use, such as profiles, sign-ups, messaging, PLUS and linked accounts. Legal basis: Contract.
Creating an account for you when an organiser adds or imports you, until you accept the Terms or ask us to delete it. Legal basis: Legitimate interests: letting organisations run their activities with you in Padelution, and letting you take the account over.
Linking your account in a licence system and fetching your licences and date of birth from it. Legal basis: Contract, at your request.
Recording and publishing results, competition history and rankings, including for players without an account. Legal basis: Legitimate interests: documenting sporting results, keeping a reliable history for all players and competitions, and letting people follow the sport. Each result is also part of the other players' records, of the competition and, for official competitions, of the rankings that federations keep.
Calculating ratings, statistics, comparisons and predictions, and showing a limited set of other players' statistics to PLUS members. Legal basis: Legitimate interests: ours and other players' interest in sports analysis. For players aged 13–17, statistics and rating history are shown, and their records included in the match details PLUS members see, only after statistics are switched on, and we rely on that consent.
Writing an AI recap of a PLUS member's own season. Legal basis: Contract with the PLUS member. For the partners and opponents it mentions, legitimate interests: giving the PLUS member a summary of their own season.
Selling PLUS, gift cards and page plans, handling payments, refunds and disputes. Legal basis: Contract. For a gift's recipient, legitimate interests: delivering the gift the buyer sent.
Saving your card with Stripe when you pay while signed in. Legal basis: Contract, for subscriptions and renewing memberships. For faster checkout of later purchases, legitimate interests: making repeat purchases quicker. You can remove a saved card at any time.
Keeping accounting records and VAT evidence. Legal basis: Legal obligation.
Where the EU rules on tax reporting by digital platforms (DAC7) require it, reporting sellers that sell through the Service, such as clubs and private coaches, and their sales to the Finnish Tax Administration, which can pass the information to the tax authorities of other EU countries. Legal basis: Legal obligation.
Receiving payments on behalf of organisers. Legal basis: Contract, and the organiser's and our legitimate interest in a working payment service.
Giving an organiser your contact details after you accept a membership or confirm your participation. Legal basis: Contract: your membership or participation with the organiser.
Sending service messages, such as confirmations, receipts, reminders and message notifications. Legal basis: Contract. For people we contact without a contract with them, such as players an organiser adds or invites, legitimate interests: telling them about activities that concern them.
Answering support requests. Legal basis: Contract, and legitimate interests: helping anyone who contacts us, including people without an account.
Security, fraud prevention, handling reports and enforcing our Terms, including logs, rate limits and bans. Legal basis: Legitimate interests: protecting users and the Service. Legal obligation where the EU Digital Services Act applies.
Monitoring errors and performance. Legal basis: Legitimate interests: keeping the Service working.
Measuring use of the Service with Google Analytics. Legal basis: Consent.
Showing ads chosen by country. Legal basis: Legitimate interests: funding a largely free Service with ads that aren't profiled.
Location features, such as sorting by distance and finding nearby events. Legal basis: Legitimate interests: showing venues and events near you, based on the location you choose to save or share from your browser, or on the approximate location of your IP address.
Developing the Service and testing new features. Legal basis: Legitimate interests: improving features and fixing faults.
Translating news articles with AI. Legal basis: Legitimate interests: making news available in your language.
Publishing automatically written news, game leaderboards and awards from games and events. Legal basis: Legitimate interests: promoting the sport and its players' activity.
Showing public rankings of professional players. Legal basis: Legitimate interests: letting people follow the sport.
Internal notifications to our team about purchases, new pages and support requests. Legal basis: Legitimate interests: running our business.
Establishing, exercising or defending legal claims, and meeting requests from authorities. Legal basis: Legal obligation, and legitimate interests: protecting our and our users' legal rights.
6.2 Where we rely on legitimate interests, we have weighed them against your rights. You can object (section 19), and you can ask us for more information about how we weighed them.
6.3 You can withdraw consent at any time: for analytics in the cookie settings, and for a 13–17-year-old's statistics in the profile settings, or by e-mailing info@padelution.com. Withdrawing doesn't affect processing that took place before.
7. What is public
7.1 Visible to everyone, including people without an account:
your profile: name, photo, nationality, home club, rating (once it is no longer provisional), rankings, playing preferences such as court side and hand, and your age if "Show my age" is on ("Show my age" starts on for adults who sign up themselves, and off for players under 18 and for linked accounts; accounts that existed before we introduced these defaults keep their earlier setting)
your matches: your match results, with partners, opponents and scores
competition pages: events, leagues, draws, results, live scores and participant lists, which can show whether a participant has the membership or licence the event requires
news and boards: automatically written news articles that can name players and link to their profiles; game leaderboards with players' names, flags and profile links (on the mini-game leaderboards you can choose to hide your name); and share images with names and flags, which organisers can post elsewhere and of which we keep our copy only briefly (section 17).
7.2 Search engines. Player profiles, except those of players under 18, can be found through search engines, which can show the profile's name, photo, home club and nationality. Player profiles are not listed in our sitemap. You can ask us to keep your profile out of search engines.
7.3 Visible to PLUS members: player statistics (all of your own, and a limited set about others), match details such as head-to-head records (leaving out the records of players under 13 and players whose statistics are off), rating history (except for players under 13 and players aged 13–17 whose statistics are off), and the percentages for predictions and fan votes.
7.4 Visible in particular situations:
the creator of an OpenMix game and its confirmed players see each other's phone numbers
the people you chat with see when you were last active and whether you have read their messages
organisations see the data described in section 11.
8. Children and linked accounts
8.1 Under the Finnish Data Protection Act (section 5), a child aged 13 or over can give consent where we rely on consent. Only players aged 13 or over may have their own account. Younger players can use Padelution only through a linked account managed by a parent, guardian or another person authorised to act for them. If we find an account of a player under 13, we make it a linked account or close it. If the law where you live sets a higher age for giving consent online, a parent or guardian must switch statistics on for you.
8.2 Players under 13:
statistics and messaging are not available to them, and their records are left out of the match details PLUS members see
their rating history and rating changes are not shown
their profiles are kept out of search engines
their results, placings, rating, name, photo and other competition information appear like any player's, as part of the competition. Event pages and news articles that name them can be found through search engines.
8.3 Players aged 13–17:
statistics and messaging stay off until switched on in the settings, by the player or by the manager of their linked account, and both switch on when the player turns 18. While statistics are off, their rating history isn't shown, and their records are also left out of the match details PLUS members see, such as head-to-head records
their profiles are kept out of search engines
"Show my age" is off by default (accounts that existed before we introduced this default keep their earlier setting)
they can buy PLUS and gift cards, and a parent or guardian can ask us to refund such a purchase.
8.4 Linked accounts. The manager of a linked account confirms that they are the player's guardian or are otherwise authorised to act for them. The manager can use the account, read its messages, receive its e-mails and change its settings.
8.5 Age checks. Age-based rules use the date of birth you give, or the one from a licence system if you link your account there. If an account has no date of birth, for example because an organiser created it, messaging, statistics and buying PLUS or gift cards stay unavailable until one is added. We don't check the date of birth against identity documents, but we may ask for proof if we have reason to doubt it.
8.6 Ads are never targeted at anyone based on their age or profile (section 13).
9. Messaging
9.1 We store messages and photos so we can deliver them and show the conversation to its participants. Photos are kept in private storage and opened only through time-limited links.
9.2 Who can read messages. Padelution staff can't open your conversations through the Service. We access message content only when needed to investigate a report, keep the Service secure or comply with the law. The manager of a linked account can read that account's messages.
9.3 What others see. Anyone in a conversation with you sees when you were last active, when you are typing and whether you have read their messages.
9.4 Notifications. If you don't read a new message soon, we may e-mail you (or the manager of your linked account) a notification with the sender's name and the start of the message.
9.5 Keeping messages. Messages you send stay with the people you sent them to, also after you delete your account.
10. Ratings, AI and automated decisions
10.1 Ratings. We calculate ratings automatically, with an Elo-type method:
inputs: match results and scores, the players' previous ratings and experience, the type of match, and other match factors, such as which court side players prefer. Age, gender and nationality are not used
provisional: a new player's rating is provisional, and not shown publicly, until they have played a few rated matches
updates: ratings update as soon as a result is entered, and we recalculate them when needed, for example when results are corrected.
10.2 What ratings affect. Ratings are shown publicly, affect which games we suggest to you and how some playgroups are formed, and can stop you from joining an OpenMix game directly when its level is well above yours. You can then ask the game's creator to let you in.
We don't consider these to be decisions with legal or similarly significant effects under Article 22 of the GDPR. We explain them because they affect how you use the Service. If a result or rating is wrong, you can ask for it to be corrected or object to the processing (section 19).
10.3 AI recap. If you have PLUS, you can get an AI-written summary of your own season from time to time. An AI provider writes it from your statistics, which include the names of your partners and opponents, and the data can be transferred outside the EU (section 16). The recap is labelled as written by AI and isn't shown to other players.
10.4 News translation. We translate news articles with an AI provider. Articles can contain players' names.
10.5 Votes. We collect level votes after OpenMix games, but they don't affect ratings. If we start using them, we will update this policy first.
10.6 We make no other automated decisions about you.
11. What organisations see and do
11.1 Clubs, venues, federations and other organisations use Padelution for their registers and activities. For that data they are the controllers (section 3.2), and their own privacy notice applies.
11.2 What an organisation sees about you:
your name, when it adds you or you sign up to its activities; in its league player lists, also your age and gender, even if "Show my age" is off
your e-mail address and phone number, only after you accept its membership, confirm your participation, or sign up or buy from it yourself. If you were already its member in the previous version of Padelution, or your membership is synced from a licence system, it sees your contact details as part of that membership
your purchases from it, and in its analytics how much you have spent with it, your customer value and your customer group. Venues in the same chain can see this across the chain. Its analytics also group players by gender, age group and rating
notes its staff write about you
your survey answers. Answers are always linked to you; a survey marked anonymous only hides your name from the organisation in the results. The organisation can share survey results with other organisations or people.
If you have no home club yet, the first organisation that adds you to its member register becomes your home club on your profile. You can change or clear it in your profile settings.
11.3 Federations can:
see the members of clubs that have accepted the federation's link, with their names, memberships and validity
export lists of their licence holders, including licence IDs
send surveys to the participants of their rankings.
11.4 E-mails from organisers. Organisers can e-mail the participants of their events, leagues and certifications.
11.5 Offline tournament backups. For events that use offline backups, we keep a copy of the event's schedule and results, including participants' names, at an unlisted web address, so the event can go on if the Service is unavailable. The organiser also receives a PDF by e-mail, which can include participants' contact details.
12. Cookies and similar technologies
12.1 Cookies are small files your browser stores. Similar technologies include the browser's local storage. We use the ones listed below. Those marked "necessary" are needed for the Service you ask for, so they don't need your consent. Analytics cookies are used only if you consent.
Session cookie (padelution-session): Keeps you signed in during your visit and remembers what you are doing. How long: 2 hours of inactivity. Necessary.
XSRF-TOKEN: Protects forms against cross-site attacks. How long: same as the session. Necessary.
remember_web_…: Keeps you signed in if you choose to stay signed in. How long: until you sign out, at most about 400 days. Necessary.
padelution.cookie-consent (local storage): Remembers your cookie choices. How long: until you clear it. Necessary.
__stripe_mid, __stripe_sid (Stripe): Prevent payment fraud; Stripe loads on pages for signed-in users. How long: 1 year and 30 minutes. Necessary.
ad_popup_…: Stops the same pop-up ad from showing again. How long: 24 hours. Necessary.
Settings and game scores (local storage): Remember display settings and your scores in mini-games. How long: until you clear them. Necessary.
pusherTransportTLS (local storage): Remembers how to connect for live updates, such as live scores and messages. How long: 30 minutes. Necessary.
mapbox.eventData… (local storage, Mapbox): Lets Mapbox count map loads on pages with a map. How long: until you clear it. Necessary.
_ga, _ga_… (Google Analytics): Measure how the Service is used, including completed purchases. How long: up to 2 years. Only with your consent.
12.2 Google Analytics loads only after you accept analytics cookies. It tells us which pages are used and when a checkout starts or a purchase is completed, including the amount. Google processes this data on our behalf, and it can be transferred to the United States (section 16). It is kept for at most 14 months.
12.3 Content from other services:
maps come from Mapbox, which receives your IP address and counts map loads with an identifier it keeps in your browser's local storage; we have switched off its performance tracking
fonts come from Bunny Fonts in the EU, which receives your IP address
YouTube videos load only when you click play. YouTube (Google) then receives your IP address and device details and may store data on your device for its own purposes, such as remembering player settings and measuring views. Google decides on that processing as a separate controller under its own privacy policy, and can process the data in the United States.
12.4 Changing your choice. You can change or withdraw your consent at any time with the "Cookie settings" link in the footer or in your account menu. You can also delete cookies in your browser.
13. Advertising
13.1 We show our own ads in the Service, labelled as sponsored. We don't use outside ad networks.
13.2 We choose ads only by country: the country you have saved, or the country of your IP address. We don't use your profile, age or behaviour to target ads.
13.3 We count how many times each ad is shown and clicked, without recording who saw or clicked it. PLUS members see fewer ads.
14. Location
14.1 Saved location. You can save a location by moving the map pin or allowing your browser to share your location. We store the exact point and use a map service to look up its city. We use it to sort venues and events by distance and to show events near you. It isn't shown to other users, and you can remove it at any time in your settings.
14.2 Without an account. If you choose a location, we send the point to a map service to find the place name, and keep a rounded location, to about 1 km, for your visit.
14.3 Approximate location from your IP address. We use an IP location service to find the country or city of your IP address, for example when you first visit or sign up, to show events near you, to choose ads by country and to determine VAT at checkout.
15. Who receives your data
15.1 Other users and the public see what is described in section 7. Organisations see what is described in section 11. Managers of linked accounts see the account they manage.
15.2 Service providers process data on our behalf, under contracts that oblige them to protect it and to use it only as we instruct:
Hosting and infrastructure: All data in the Service.
File storage and image processing: Profile and other photos, message photos, attachments, share images and offline tournament backups.
Document and image rendering: Receipts, invoices and tournament PDFs, with names and contact details, and share images.
E-mail delivery: Name, e-mail address and the content of the e-mails we send.
Search: Names and home clubs, for search in the Service.
Error and performance monitoring: User ID, name, e-mail address, IP address and the addresses of pages visited.
Payments (Stripe): Name, e-mail, phone, payment details and purchase information.
Maps, place names and IP location: IP address, map points and city.
Fonts: IP address.
AI providers, for AI recaps and news translation: Player statistics and the names they contain; news texts.
Analytics (Google Analytics, only with consent): Usage and purchase events, and cookie identifiers.
Internal team communication: Name and e-mail address with the start of a support message; name and country when someone buys PLUS, a gift or a page plan, or creates a page.
Default profile pictures: Name, to draw initials.
We give the names of all our service providers on request.
15.3 Separate controllers. Stripe also processes payment data as a separate controller, as described in section 3.4. If you link your account in a licence system, such as Suomisport, that system, as a separate controller, receives your licence ID and returns your licence details and date of birth. When you play a YouTube video, Google receives your IP address and device details as a separate controller (section 12.3).
15.4 Authorities. We disclose data to authorities, such as the police or tax authorities, when the law requires it, including the reporting about sellers described in section 6.1. If we learn of a crime that threatens someone's life or safety, we inform the police.
15.5 Change of ownership. If our business is sold or reorganised, the data can transfer to the new owner, who must follow this policy.
15.6 We don't sell personal data to other companies. PLUS gives members access to statistics about other identifiable players, as described in section 7.3.
16. Transfers outside the EU/EEA
16.1 We store the Service's main database and files in the EU. Some of our service providers are located in, or can access data from, countries outside the EU/EEA, mainly the United States. This applies, for example, to AI, analytics, payment, maps, monitoring and communication services.
16.2 We transfer data only:
to countries the European Commission has found to protect personal data adequately, including transfers to US companies certified under the EU–US Data Privacy Framework, or
under the European Commission's standard contractual clauses, with additional safeguards where needed.
16.3 You can ask us for information about the safeguards and for a copy of them.
17. How long we keep data
17.1 We keep personal data only as long as we need it for the purposes in section 6, or as long as the law requires:
Account and profile details: While your account exists. What happens on deletion is set out in section 18.
Results, placings, rankings and ratings: Permanently, as part of the competition history.
Accounting records, including receipts and payment records: 6 years from the end of the financial year (vouchers) and 10 years (ledgers and financial statements), as the Finnish Accounting Act requires.
VAT evidence for PLUS and gift purchases: As long as VAT law requires, at most 10 years.
Seller information for tax reporting: As long as tax law requires, at most 10 years.
Payment provider event records (buyer's e-mail address, address, card brand and last four digits): 90 days.
Security log, including sign-ins, staff access and exports: 12 months.
Sessions and sign-in links: Until they expire or you sign out; at most about 400 days if you choose to stay signed in.
Share images: About a week.
Google Analytics data: At most 14 months.
Records of the Terms you accepted: While your account exists and, after that, until claims under those Terms are time-barred.
Organisations' register data, including answers to their surveys: As the organisation decides, and deleted after it stops using Padelution (we process it on its behalf).
Saved location, AI recaps, follows and mini-game scores: Until you delete your account, or remove them sooner where the Service lets you.
Messages and message photos, support chats and screenshots, answers to our own surveys, offline tournament backups, votes and reports: See section 17.2.
17.2 For the data in the last item of the list above, we don't use fixed periods. We keep it only as long as its purpose requires, review it regularly and delete what is no longer needed:
messages and message photos: while someone in the conversation can still see them
support chats and screenshots, and reports and our decisions on them: while we may need them to handle the matter, prevent repeated misuse or deal with a related claim
offline tournament backups: until the event they back up is over
answers to our own surveys, fan votes and OpenMix votes: as long as the survey, match or OpenMix results they are part of are kept, also after the account is deleted.
You can ask us to delete them sooner (section 19).
18. Deleting your account
18.1 How. You can delete your account in your account settings. If something prevents it, such as an active subscription, unpaid payments or accounts you manage, e-mail info@padelution.com and we will help, for example by cancelling your PLUS and deleting the account for you.
18.2 What we delete:
your e-mail address and phone number
your profile photo
saved cards and passkeys
your date of birth, gender, home club, playing preferences and licence system ID
your saved location and AI recaps, your follows and favourites, and your mini-game scores.
Signing in stops working on all devices, and nobody can send you new messages. Your statistics are no longer shown, and your records are left out of the match details PLUS members see. Your profile is hidden from search in the Service and from search engines, but stays reachable by its direct link (section 18.3).
18.3 What we keep, and why:
Your name and nationality in results, rankings and the competition history, and your profile page with your name, nationality, rating, rankings and results: Results also belong to the other players and to the competition (section 6). The profile page keeps the player's results, rankings and ratings together in the competition history, so it stays reachable by its direct link, but not through search.
Messages you sent: They stay with the people you sent them to.
Support chats, answers to our own surveys, and the fan and OpenMix votes you gave: Under section 17.2.
Payment and accounting records, and your customer record with Stripe: Needed for accounting, refunds and disputes.
Security log entries: For 12 months.
18.4 If you want us to delete any of the kept data, contact us. We will assess your request under the law. Your results, and your name in them, stay as part of the competition history unless the law requires otherwise, because they are also part of the other players' records, of the competition and, for official competitions, of the rankings that federations keep.
18.5 Closing your account and asking for your data to be erased are separate things. You can always make an erasure request under section 19, and we will assess it individually.
19. Your rights
19.1 Under data protection law, you have the right to:
access your data and get a copy of it
correct inaccurate data. You can edit most details in your settings. For your date of birth, contact us. For results, contact the organiser or us
have your data erased, when there is no longer a reason to keep it
restrict the processing, for example while we check a correction
object to processing based on legitimate interests, including the publication of your results and statistics, on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims
receive the data you gave us in a machine-readable format, where we process it under a contract or your consent
withdraw your consent at any time (section 6.3)
complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en), or to the data protection authority where you live or work.
19.2 How to use your rights. E-mail info@padelution.com. We may ask you to confirm your identity.
We answer within one month. If a request is complex, or there are many, we can extend this by two months, and we tell you within the first month if we do.
Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it.
19.3 A guardian can use these rights for a child whose linked account they manage. For data that an organisation controls (section 3.2), contact the organisation; we forward requests that reach us.
19.4 This policy applies wherever you live. If you live outside the EU, your local data protection law may give you further rights, and we respect them.
20. Security
20.1 We protect personal data with technical and organisational measures, such as:
encrypted connections
role-based access rights
securely hashed passwords and support for passkeys
private file storage served through time-limited links
rate limits and protection against card fraud
security logging.
20.2 Staff access. Our staff can view accounts and, to help with support, sign in as a user. This is logged, and staff can't open messages while doing it. Staff exports of user data are logged too.
20.3 No system is completely secure. If a personal data breach happens, we notify the Data Protection Ombudsman and, where the law requires, the people affected.
21. Changes to this policy
21.1 We update this policy when the Service or the law changes. The version and the date it took effect are shown with the policy.
21.2 If we start using your data for a new purpose, or make another significant change, we tell you in the Service before it takes effect.
21.3 We keep earlier versions and send them on request.
22. Contact
Padelution Oy, Friisinniityntie 5 A, 02240 Espoo, Finland. E-mail: info@padelution.com. Phone: +358 40 766 1957.
The supervisory authority is the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en).