Privacy Policy
Last updated: 14-11-2026
This is a translation for convenience. If there is any difference, the Portuguese version prevails.
This policy explains what personal data we process, why, on what legal basis, for how long, and what your rights are. It applies to the padelovers.pt website, the student portal, our communications and the services provided at the PadeLovers Matosinhos club. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Portuguese Law no. 58/2019 and Law no. 41/2004.
1. Who is the controller
Associação Raquetes para Todos (ARPT), the association that runs the PadeLovers Matosinhos club.
- Tax number (NIPC): 517824779
- Address: Rua Gonçalves Zarco, 1706, 4450-685 Matosinhos, Portugal
- Email for privacy matters: geral@arpt.pt
- Phone: +351 220 980 938 (call to a Portuguese landline)
We have not appointed a data protection officer, as we are not required to. Any question can be sent to the email above.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Identification and contact | Name, email, phone, date of birth | The data subject or their legal representative |
| Invoicing and payments | Tax number (NIF), billing address, amounts paid, payment method | The data subject |
| Club activity | Playing level, groups, attendance, pack hours, contracts, pauses, bookings | Club and coach records |
| Trial lesson | Name, age, email, mobile and the answers to the level questionnaire | The data subject, through the website form |
| Communications | Messages exchanged by email, phone or WhatsApp; email preferences | The data subject |
| Image | Photos and videos of events, tournaments and lessons | Taken by the club, with consent |
| Browsing | IP address, device and browser type, pages visited, cookies | Collected automatically on the website |
| CCTV | Camera images in the signposted areas | CCTV system |
We do not store card details: card payments are processed directly by the payment service provider. We do not buy data from third parties and we do not take solely automated decisions with legal effects on you.
3. Why we use the data, on what basis and for how long
| Purpose | Legal basis (art. 6 GDPR) | Retention period |
|---|---|---|
| Managing enrolments, lesson contracts, packs, groups and attendance | Performance of a contract | Length of the contract and then 5 years to defend legal claims |
| Managing court hire and events | Performance of a contract | As above |
| Booking the trial lesson | Steps taken at the data subject’s request before a contract | 12 months if there is no enrolment |
| Invoicing and meeting tax and accounting obligations | Legal obligation | 10 years |
| Service messages (fee reminders, end of commitment period, timetable changes) | Performance of a contract | Length of the contract |
| News, tournaments and promotions | Consent; for customers, legitimate interest regarding similar services, with an opt-out in every message | Until consent is withdrawn or you object |
| Answering requests for information and complaints | Legitimate interest; legal obligation (Complaints Book) | As long as needed to reply; Complaints Book: 3 years |
| Publishing photos and videos on the website and social media | Consent | Until consent is withdrawn |
| Measuring website audiences (Google Analytics) and online ad campaigns (Google Ads) | Consent | See section 6 |
| Keeping the website secure and preventing abuse and spam (including the anti-spam check on forms) | Legitimate interest | Up to 12 months |
| CCTV | Legitimate interest (safety of people and property) | 30 days |
Where the basis is a contract or a legal obligation, we cannot provide the service without the data. When the period ends, the data is deleted or anonymised.
4. Who we share data with
We do not sell personal data. We only share it with those who help us provide our services (processors, bound by contract and confidentiality) or when the law requires it.
| Entity | Purpose |
|---|---|
| Google (Workspace, Analytics, Ads, Maps) | Email, storage of documents and contracts, statistics and online advertising (these two only with consent); the club map, only if the visitor opens it |
| Cloudflare | Website hosting and anti-spam check on forms (Turnstile) |
| SendPulse | Sending emails |
| Supabase and Netlify | Hosting the database (servers in the EU), trial lesson requests and the apps (student portal, tournaments) |
| Vendus | Invoicing software |
| Teya | Card payments |
| Certified accountant | Accounting and tax obligations |
| Tax Authority and other authorities | When required by law |
| Insurer (Tranquilidade) and Portuguese Padel Federation (FPP) | Sports insurance for all users; the club’s FPP membership (no. 49) and entries in federation events |
Court bookings are made on Playtomic and social tournaments on PadelTeams. In those cases each platform processes the data as an independent controller, under its own privacy policy, and shares with us the data needed for the booking or entry. The same applies to WhatsApp, Instagram, Facebook and YouTube when you contact or interact with us there. YouTube videos on the website only load when you press play.
5. Transfers outside the European Union
Some providers (for example Google, Cloudflare, SendPulse and Netlify) may process data outside the European Economic Area, mainly in the USA. The student portal database (Supabase) is hosted in the European Union. These transfers only take place with appropriate safeguards: a European Commission adequacy decision (including the EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses approved by the Commission. You can ask us for a copy of these safeguards.
6. Cookies
The website uses cookies and similar technologies.
- Necessary: needed for the website to work and to remember your cookie choices. They do not need consent.
- Statistics (Google Analytics): measure visits and use of the website, in aggregate.
- Advertising (Google Ads): measure the results of our campaigns and allow more relevant ads.
Statistics and advertising cookies are only set if you accept them in the cookie notice. You can change your choice at any time with the cookie icon in the bottom-left corner, the “Cookie settings” link in the footer, or your browser settings.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| stcm… (local storage) | PadeLovers (Silktide Consent Manager) | Remember your cookie choices | Necessary | Until you clear them in your browser |
| Cloudflare Turnstile | Cloudflare | Check that whoever sends the form is not a bot (trial lesson page only) | Necessary | Session |
| _ga, ga* | Google Analytics | Tell visitors and sessions apart for statistics | Statistics | Up to 2 years |
| _gcl_au | Google Ads | Measure campaign conversions | Advertising | 3 months |
The Google Maps map and YouTube videos only load if you press the relevant button; at that point Google may set its own cookies.
7. Your rights
Under articles 15 to 22 of the GDPR, you may at any time:
- access your data and get a copy;
- ask for inaccurate or incomplete data to be corrected;
- ask for your data to be erased, when it is no longer needed or there is no basis to keep it;
- ask for processing to be restricted;
- receive the data you gave us in a structured format (portability);
- object to processing based on legitimate interest and, without giving reasons, to marketing;
- withdraw consent, without affecting the lawfulness of processing already carried out.
To exercise a right, write to geral@arpt.pt or to the address in section 1. It is free of charge and we reply within one month, extendable by two further months in complex cases (we will tell you if so). We may ask for information to confirm your identity. To stop receiving emails, use the link at the end of each message or ask at reception.
8. Complaint to the CNPD
If you believe your data has been processed unlawfully, you can complain to the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) at www.cnpd.pt. We would appreciate it if you contacted us first, so we can try to solve the issue.
9. Minors
Lessons and activities for minors are contracted by their parents or legal representatives, who provide and manage the minor’s data and give the necessary consents (for example, for photos). For online services, children under 13 may only give data with the authorisation of their parents or legal representatives (art. 16 of Law no. 58/2019). A trial lesson request for anyone under 18 must be made by a parent or legal representative.
10. Security
We apply appropriate technical and organisational measures: access limited to those who need the data, authentication on our platforms, encrypted communications (HTTPS) and providers with security guarantees. In the event of a data breach, we notify the CNPD within 72 hours when required by law and inform data subjects whenever there is a high risk to their rights.
11. Changes to this policy
We may update this policy. The date of the last update is at the top. If the changes are significant, we will tell you by email or on the website. Where new processing depends on consent, we will ask for it before starting.