Privacy policy

This page says what PadelFirst stores about you, why, and how to get rid of it.

Who is responsible

PadelFirst. Email: info@padelfirst.one.

What is stored, and why

Your account
Email address, a hash of your password (never the password itself), when you registered, when you accepted the terms, and when you last logged in. Needed to run your account (Art. 6(1)(b) GDPR).
Your Playtomic connection
Your Playtomic user id and login email, an access token and a refresh token issued by Playtomic, both encrypted at rest, and whether a payment method exists in your Playtomic account (yes or no). Your Playtomic password is sent to Playtomic once to obtain the tokens and is not stored or logged. Card numbers never reach PadelFirst. Needed to book on your behalf (Art. 6(1)(b) GDPR).
Your requests and what happened to them
Club, date, time, duration, number of players, an optional hint which saved payment method to use (last four digits or Playtomic's id), the status of the request, and for every booking attempt the court, Playtomic's booking and payment ids and any error message. Needed to make and explain the booking (Art. 6(1)(b) GDPR). Also your answers on watching for cancellations and on booking without free cancellation, the club's free-cancellation period, and for a recurring request its interval and last date.
Emails we sent you
Subject and text of activation, password-reset and result emails, with the time they were sent, so a failed delivery can be retried and you can see what was sent (Art. 6(1)(b) GDPR).
Server logs
IP address, requested page, time, browser type, and your user id if you are logged in. Used to keep the service running and secure, to debug, and to count visits. Logs are kept for at most 30 days.
The waitlist
If you joined the waitlist before launch: your email address and when you joined. Used for one email telling you that PadelFirst has opened, with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to info@padelfirst.one. Joining the waitlist does not create an account.
Invitations to the beta
If you were invited to the closed beta: the invitation code, the address it was sent to, and when it was used. Used to keep the beta to the people invited to it, on the basis of our legitimate interest in running a limited test (Art. 6(1)(f) GDPR). An invitation is deleted once the beta ends, or earlier on request; if you then delete your account, the record that the invitation was used stays, with no link to you, so that the code cannot be used again.

Who else sees your data

Nobody else. Your data is not sold, shared for advertising, or used to train anything.

Cookies

Two cookies, both strictly necessary: one keeps you logged in, one protects forms against cross-site requests. There are no tracking or advertising cookies, so there is no consent banner.

How long

Finished requests (booked, failed or cancelled), the record of what was done for them and the emails sent about them are deleted 90 days after they finish. Your account, the Playtomic tokens and any request that has not run yet are kept until you delete your account, which you can do yourself on the account page after logging in. Deletion removes all of it from the database immediately. Server logs are deleted after at most 30 days. Disconnecting Playtomic without deleting the account removes the tokens right away. Waitlist addresses are deleted once the launch email has been sent, or earlier on request. A recurring request is kept until you stop it or its last date has passed, and deleted 90 days after that.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format (Art. 15–21 GDPR). Email info@padelfirst.one from the address of your account. You can also complain to a data protection supervisory authority.

Changes

If what is stored changes, this page changes with it and the date below is updated. Substantial changes are announced by email.

Last updated: September 2026.