Privacy policy

01Who we are

Courts Padel^® operates padel tennis courts at The Retreat Elcot Park, Elcot, Newbury, Berkshire, United Kingdom. For the purposes of UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018), we are the data controller for the personal data collected through this website (courtspadel.co.uk).

02What data we collect

We collect different types of data depending on how you interact with our website:

a) Information you provide directly

• Contact form: Name, email address, phone number (optional), subject, and message content.
• Tournament entries: Player names, email addresses, phone numbers, division preference, and partner status.

b) Information collected automatically

When you visit our website, we automatically collect certain technical data to understand how our site is used and to improve your experience:

• Device information: Device type (desktop, mobile, tablet), browser name and version, operating system.
• Screen data: Screen resolution, viewport size, pixel density.
• Network: Connection type (e.g. 4G, WiFi) where available.
• Location indicators: Language preference, timezone (e.g. "Europe/London"). The website does not collect precise GPS location. For what the iPhone app does with location, see section 07.
• Browsing data: Pages visited, entry page, referring website or domain, page load times.
• Engagement data: How long you actively spend on each page and each section of it, how far down the page you scroll, and which links and buttons you click (the link text and where it goes). We never record anything you type into a form.
• IP address: We do not store your raw IP address. Instead, we store a one-way cryptographic hash (SHA-256) that rotates daily. This allows us to count unique visitors without being able to identify you.
• UTM campaign parameters: If you arrived via a marketing link, we record the UTM source, medium, and campaign.

c) What we do NOT collect

• We do not collect names, email addresses, or any personally identifiable information through our analytics.
• We do not use fingerprinting to track you across websites.
• We do not sell, rent, or trade any personal data.
• We do not use third-party advertising trackers.

03Why we collect it (lawful basis)

Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Our legitimate interest in website analytics has been balanced against your privacy rights. We mitigate the impact by: hashing IP addresses daily so they cannot be reversed, not collecting personally identifiable information, not sharing analytics data with third parties, and retaining data only as long as necessary.

04Website analytics & cookies

Our own analytics

We operate a first-party, self-hosted analytics system on our own server, hosted by AWS in the United States. This system:

• Does not set any cookies
• Does not use fingerprinting
• Stores only hashed IP addresses (rotated daily)
• Cannot track you across other websites
• Does not collect personally identifiable information

This data helps us understand which pages are popular, which parts of a page people read, what devices our visitors use, and how visitors find our site.

If you choose Reject in our cookie banner, our own analytics is switched off for your browser as well.

Google Analytics

We also use Google Analytics 4 (property: G-HG3KB8Z5NP) which is a third-party service provided by Google LLC. Google Analytics uses cookies to collect aggregate data about website traffic. It is only loaded if you click Accept in our cookie banner; until then no Google Analytics cookies are set. Google's processing of this data is governed by Google's Privacy Policy.

You can change your choice at any time using the Cookie settings link at the bottom of every page. If you withdraw consent, we stop Google Analytics and remove its cookies. You can also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser's cookie settings.

05Contact form data

When you submit the contact form on our website, we collect your name, email address, phone number (if provided), subject, and message. This data is:

• Stored securely in our database
• Used solely to respond to your enquiry
• Accessible only to authorised Courts Padel staff
• Not shared with any third parties
• Retained for as long as necessary

Replies to your message are sent via email using encrypted SMTP. A hash of your IP address is stored with your submission for anti-spam purposes only.

06Tournament entries

When you register for a Courts Cup tournament, we collect player names, email addresses, phone numbers, division, and partner preferences. This data is:

• Used to manage your tournament entry, arrange pairings, and communicate event logistics
• Stored securely in our database
• Accessible only to authorised Courts Padel staff and tournament organisers
• Retained for as long as necessary

Confirmation emails are sent to the address you provide at the time of registration.

07Player accounts

Player accounts live at app.courtspadel.co.uk, the Courts Padel player app. You can use it in a web browser or through the Courts Padel iPhone app, which uses the same account and the same server. We run it ourselves, stored on our server hosted by Amazon Web Services (AWS) in the United States. It keeps its own database and only exchanges the information described here with this website, over a secure, signed connection. Court bookings stay with Playtomic: Book a court in the app opens the Playtomic app or website, where Playtomic's privacy policy applies (see section 08). Payments in the app, for the club shop, racket hire and event fees, are taken on Stripe's own payment page; we never see your card number.

Profiles made from Courts Cup entries

When you enter a Courts Cup, we create a player profile from your entry: your name, email address, phone number, and the competition and division you entered. If a friend entered you as their partner, we create it from the details they gave us. Until you claim it, your profile is marked unclaimed. In this first release, only you and Courts Padel staff can see a profile.

Our lawful basis for these profiles is legitimate interest (Art. 6(1)(f)): you registered to take part in our competition, and a profile lets you follow it. We hold only what the entry contained and you can have it removed at any time.

If a friend entered you

If someone else entered you as their partner, we email you to say so. The email has a one-click Not me / remove me link, and you can remove yourself at any time before you claim the profile. The email that invites you to claim it is a service message about your entry, not marketing. An invite is valid for 14 days.

What your account holds

• Your profile: name, email, phone, photo (if you add one), playing level, home club and membership status. We remove location and other hidden metadata from photos when you upload them.
• Your choices: Show my profile to members of my club is off unless you turn it on (it takes effect once club pages for members are available), and marketing emails are off unless you opt in.
• Sign-in records: single-use sign-in links (valid for 15 minutes) and, if you set a PIN, the devices you trust. We store only hashed (scrambled) versions of links, device tokens and PINs.
• Notification subscriptions, only if you allow notifications in your browser. We store them to deliver notifications, and remove them when you turn notifications off or delete your account.
• A log of changes to your account and who made them (you, our staff or the system), so we can put mistakes right

Cookies in the app

The app uses only the cookies it needs to work, and no analytics:

• cp_app_sid: keeps you signed in during a visit. It ends when you close your browser, or after 12 hours without use.
• cp_device: set only if you choose a PIN, so this device can sign in with it. It lasts 180 days, and you can remove trusted devices from your profile at any time.

The iPhone app

The Courts Padel app for iPhone uses the same account and the same server as app.courtspadel.co.uk, so everything above applies to it too. It contains no third-party analytics or advertising software, and it does not track you across other apps or websites. In addition:

• Signing in: you sign in with a code we email you. Your profile is as above: name, email, phone, an optional photo, playing level and home club.
• Location: used only for optional automatic check-in when you arrive at the club for a game you have joined. It is off unless you turn it on. The app first asks to use your location while you are using it, and asks to use it in the background only if you turn automatic check-in on. Your position stays on your phone: our server receives only the check-in itself, the same as if you had tapped Check in yourself. You can turn it off at any time in the app or in your iPhone's Settings.
• Notifications: if you allow them, they are delivered through Apple's push notification service. We store the device token Apple gives us so we can send them, and remove it when you sign out or turn notifications off. You choose which notifications you get in the app.
• Camera: used only to scan a connect code when you add a player and, for club staff, member cards and collection codes. Nothing the camera sees is kept or sent to us.
• Photos: you can add a profile photo and share photos ("moments") from events. As above, we remove location and other hidden metadata when you upload them.
• Error reports: if a screen cannot load or the app freezes, it sends us a report so we can fix it: the screen you were on, the request that failed, the error message, the app version, the iOS version and your iPhone model. Reports never include your sign-in tokens, the contents of what you sent, or other members' names. We keep them for 90 days.
• Prompts: the app tells us which wording of a prompt you saw and whether you tapped it or dismissed it, so we can write clearer prompts. This is counted per member and never shared.
• Apple Wallet and Lock Screen: you can add your member card to Apple Wallet. It is made from your own record (name, member number and QR code) and adding it sends us nothing new. During an event the app can show a Live Activity on your Lock Screen; this runs on your phone.
• Shop and bookings: payments for the shop, racket hire and event fees are taken on Stripe's own payment page and orders are collected at the club; we never see your card number. Court bookings stay with Playtomic: Book a court opens the Playtomic app or website, where Playtomic's privacy policy applies.
• Deleting your account: you can delete your account in the app (Me → Settings → Delete my account). It removes your data as described below.

Who else is involved

App data is stored on our server hosted by Amazon Web Services (AWS) in the United States. Emails from the app, such as sign-in links and invitations, are sent through Amazon Simple Email Service (SES) in the EU (Frankfurt). If you allow notifications, they travel through your browser's push service or, on iPhone, Apple's push notification service. Payments are taken by Stripe on its own payment page, and Stripe's privacy policy applies to the card details you enter there. We don't sell your data.

How long we keep it, and your choices

We keep your account until you delete it. From your profile you can Download my data (a JSON file of what we hold about you) and Delete my account.

A profile you never claim is deleted automatically 12 months after your last competition entry. When a profile is removed or deleted, we keep only a one-way hash of the email address, so later imports don't recreate it. We recreate it only if you sign up again yourself. Competition entries themselves are covered by section 06.

08Booking redirects

When you click a "Book a Court" button, you are redirected to Playtomic (playtomic.com), a third-party booking platform. We record which button was clicked (e.g. "hero section", "pricing card") to understand which parts of our website drive bookings. We do not collect any personal data during this process.

Your use of Playtomic is governed by Playtomic's Privacy Policy.

09Who we share data with

We do not sell, rent, or trade your personal data. Data may be processed by the following categories of service provider, all under appropriate data processing agreements:

• Email delivery: Amazon Simple Email Service (SES), EU (Frankfurt). It sends contact form replies, Courts Cup emails, and player sign-in links and invitations.
• Hosting: Amazon Web Services (AWS), United States. It holds the website's and the player app's databases.
• Payments: Stripe, which takes shop, racket hire and event payments on its own payment page. We never see your card number.
• Apple: Apple's push notification service delivers the iPhone app's notifications. Your Wallet member card is held on your phone.
• Google: Google Analytics for aggregate website statistics

Because our hosting is in the United States, your data is stored there. It is protected by the safeguards in AWS's data processing terms.

We will also disclose data if required to do so by law, regulation, or court order.

10How long we keep data

11How we protect your data

We take appropriate technical and organisational measures to protect your personal data, including:

• All data transmitted between your browser and our server is encrypted using HTTPS/TLS
• IP addresses are one-way hashed using SHA-256 before storage
• Database access is restricted to authorised personnel
• Email communications use encrypted SMTP (TLS/SSL)

12Your rights under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at hello@courtspadel.co.uk. We will respond within one month as required by law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

13Cookie policy

Our website uses a minimal number of cookies and similar technologies:

Our own first-party analytics system does not set any cookies. You can change your choice at any time: Cookie settings. You can also control cookies through your browser settings. Disabling cookies will not affect the public-facing website experience.

14Children's privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@courtspadel.co.uk and we will promptly delete it.

15Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Material changes that affect how we process your data will be communicated via our website.

16How to contact us

If you have any questions about this privacy policy, your personal data, or wish to exercise your rights, please contact us: