Legal Center

Who is responsible for your data

Padel Plus, based in Amman, Jordan, operates the Padel+ service described in this policy and is the data controller for the personal data it holds about club staff and about the players a club records.

Padel+ is a business-to-business product: clubs subscribe to it to run their own venues, and each club stays responsible for the player data it chooses to enter. Where a club records a player, Padel Plus processes that data on the club’s behalf.

For any data-protection question - access, correction, deletion, or anything else in the "Your rights" section below - email privacy@padelplus.net. That address reaches the people who can act on it, and we answer every request we receive there.

What we collect

We collect the information you give us when you create an account and run your club - names, contact details, bookings, and the desk records your club keeps in Padel+: who has paid for what, packages, vouchers and player credit. Padel+ records those entries; it never processes or holds player money and never collects card details from players. Your subscription is billed by Paddle, our merchant of record, which collects and holds the card you subscribe with - it never reaches Padel+. We also collect basic usage data to keep the service reliable.

How we use it

Your data is used to operate Padel+: to take bookings, keep your club’s records, send confirmations, and provide support. We never sell your data, and we only share it with the subprocessors needed to run the service.

Player data

As a club, you control your players' data. Padel+ processes it on your behalf, and any player can ask their club or email privacy@padelplus.net to get a copy of their information or have it deleted within 30 days.

Your rights

You can ask us to access, correct, or delete your account data at any time. Email privacy@padelplus.net and we'll respond within 30 days.

The laws that apply

Padel Plus is operated from Jordan and follows Jordan's Personal Data Protection Law No. 24 of 2023. Where you or your club are in the European Union or the United Kingdom, the GDPR applies as well. Where your local law gives you stronger rights than this policy describes, that law wins.

Cookies & analytics

Padel+ does not use advertising or cross-site tracking cookies. We set only the strictly-necessary cookies needed to keep you signed in and to protect your session.

We measure product usage with PostHog, hosted in the European Union. PostHog sets a cookie that lets us recognise a returning visitor across padelplus.net and the club dashboard, so it only runs after you accept it. Decline and no analytics cookie is set, no analytics code is loaded, and nothing about your visit is sent anywhere.

You can change your mind at any time with the "Cookie settings" link in the footer, or by clearing the "pp_analytics_consent" cookie in your browser; either way the choice is asked again on your next visit. We also record errors through Sentry to keep the service working; error reports carry no analytics cookie and we strip identifying details out of them before they are sent.

On a club's Padel+ booking site we set two cookies when a player signs in with an emailed code: "pp_player", which carries the sign-in token and cannot be read by page scripts, and "pp_player_id", which holds the player's name and email so the page can show who is signed in. Both are strictly necessary, expire when the session does, and carry no analytics. The club is the controller of its players' records; Padel Plus processes them on the club's instructions.

Lawful bases for processing

Under the laws that apply to us - including Jordan's PDPL and the GDPR - we rely on the following lawful bases:

• Contract - to provide the Padel+ service you or your club sign up for.
• Legitimate interests - to keep the service secure, reliable, and improving, balanced against your rights.
• Legal obligation - to meet accounting, tax, and other statutory duties.
• Consent - where required, for any optional communications you opt into (withdrawable at any time).

Your data-protection rights

Subject to applicable law, you can exercise the following rights over your personal data:

• Access - get a copy of the personal data we hold about you.
• Rectification - correct data that is inaccurate or incomplete.
• Erasure - delete your account data (the “right to be forgotten”).
• Portability - export your data in a portable, machine-readable format.
• Restriction & objection - limit or object to certain processing.

To get a copy of your data or have it deleted, email privacy@padelplus.net and we will respond within 30 days; for a complex request we may ask you to confirm your identity, and we tell you if we need longer. Players can make the same request to us or to the club they play at.

If you think we have handled your data wrongly, tell us first and we will try to put it right. You can also complain to a regulator: in Jordan, the Personal Data Protection Council at the Ministry of Digital Economy and Entrepreneurship; in the EU or UK, the data protection authority where you live or work.

Subprocessors

We share data only with the processors needed to run the service. We never sell your data. Current subprocessors are:

• Cloudflare Turnstile - bot protection on our forms.
• PostHog (EU-hosted) - product usage analytics, loaded only with your consent.
• Sentry - error and performance monitoring, so we can find and fix faults.
• Resend - transactional and notification email delivery.
• Paddle - subscription billing for Padel+ plans, as merchant of record.

Paddle, as merchant of record, collects and holds the card used for your subscription; Padel+ never collects or stores card details, and player money never passes through Padel+ - your club collects at its own desk and Padel+ keeps the record.

We tell account holders before we add or replace a subprocessor, and the full current list - including our infrastructure host - is available anytime from privacy@padelplus.net.

Data retention

We keep account and club data for as long as your account is active, and delete or anonymise it on request or within a reasonable period after your account closes.

When a subscription ends, your organisation goes read-only and we keep everything in it - clubs, courts, players, bookings and history - for 30 days. Start a plan again inside that window and it all comes back exactly as you left it. After 30 days we remove the organisation from the running service; it is recoverable for a limited period if you contact support, after which it is deleted or anonymised as described above.

• Security and audit logs, including the IP address recorded with each action, are kept for as long as your account exists and are removed with the rest of your organisation when it is deleted.
• Messages sent through our contact form are kept only while we are handling the enquiry, and in any case no longer than 12 months.

Children's data

Clubs run junior sessions and academies, so player records can belong to minors. Your club is responsible for collecting those records with the consent the law requires from a parent or guardian; Padel Plus processes them only on the club’s instructions, and parents and guardians can exercise every right in this policy on a child’s behalf.

International transfers & DPA

Some of our subprocessors run infrastructure outside the country where your data was collected. Before data crosses a border we check that the provider receiving it protects it at least as well as the law protecting it at home, and we sign standard contractual clauses with that provider.

For data covered by Jordan's Personal Data Protection Law, we transfer it abroad only on the grounds that law allows - including where the transfer is needed to run the service your club asked us for - and we obtain any approval the Personal Data Protection Council requires.

A Data Processing Agreement (DPA) is available on request - email privacy@padelplus.net.