Privacy Policy

• Identity and profile: first name, last name, display name, profile photo, gender, date of birth, and language preference.

• Contact details: email address and, optionally, phone number.

• Account security: your password (stored only in encrypted form) or, if you sign in with a third-party account (for example Google or Facebook), the basic account information that provider shares with us (see 2.4 and 6).

• Location: your city, area, or country of residence. If you choose "use current location" or select a point on the map, we also process your precise location. Location is optional and used to recommend nearby venues and competitions.

• Sporting data: match results, scores, competition entries, challenges, and the rating and global ranking calculated from your results (see 5).

• Bookings and payments metadata: your court bookings, attendance, booking name visibility preference, reminder preferences, and, per venue, your credit or wallet balance and its transaction ledger, together with the payment status and payment type (for example cash, card, or credit) recorded by the venue.

• Content you submit: photos, messages, venue and club information (if you are a venue or club administrator), uploaded documents, and announcements.

• Support requests: when you contact our support, the name, email, message, and any file you attach.

• Login history and timestamps.

• Device and technical information (for example browser type and operating system).

• IP address, for security.

• Action logs on venues and competitions, which record administrative actions with before-and-after detail for accountability.

• Cookies and similar technologies (see the separate Cookie Policy).

Users can invite others who do not yet have an account, by entering an email address (and sometimes a name) when sending a challenge, inviting a player or member, or using a mass invitation (pasting addresses or uploading a file). If your email address has been entered this way, we process it in order to send you the invitation and, if you do not respond, we delete it after a set period (see 8). The person who entered your details is responsible for having a proper basis to share them. You can ask us to remove your details at any time at support@2ndcourt.com.

To offer our services to tennis clubs and venues, we collect and process business contact details of clubs, venues, and the people who represent them (for example name, role, email, phone, and public social handles). We obtain these from publicly available sources, such as sports federation directories and club or venue websites, and we use them to contact clubs and venues about 2ndCourt (see 3.2 and 12). Anyone contacted this way can object at any time, after which we stop (see 10 and 12).

We do not seek to collect special categories of data (for example health, ethnicity, or political beliefs) within the meaning of Article 9 GDPR. Please do not submit such data on the platform.

We process your personal data only where a legal basis under the GDPR applies.

• create and manage your account and authenticate you,

• run bookings, matches, challenges, competitions, rankings, clubs, and venues,

• send you essential service messages (for example booking confirmations, result confirmations, invitations, and password resets), by email and in-app.

• keep the platform secure and prevent fraud and misuse,

• measure and improve how the platform is used (analytics); where analytics rely on non-essential cookies, we use them only with your consent (see the Cookie Policy),

• maintain stability, and keep action logs for accountability,

• send invitations that an existing user has asked us to send to another person,

• contact clubs, venues, and their representatives about our services (business outreach).

Where we rely on legitimate interests, you can object at any time (see 10).

• optional marketing or promotional emails,

• precise location data,

• the promotional use of content that identifies you (for example a recognisable photo or a personal result used in our marketing),

• non-essential cookies.

You can withdraw consent at any time, without affecting processing already carried out.

Where the law or a valid authority requires it.

Your rating and global ranking are calculated automatically from the match results submitted and confirmed on the platform. This is the only automated processing we carry out that meaningfully affects your profile, and it does not produce legal or similarly significant effects within the meaning of Article 22 GDPR. Results normally require confirmation by the other player before they count.

Some information is part of the public, community nature of the platform: your display name, profile photo, match results, and your rating, ranking, and statistics.

The platform will include a player directory (the Find Player page) so that people can discover others in the tennis community, similar to other social platforms. When it launches, your profile will be included in this directory by default, and you will be able to turn this off in your settings so that you are not listed there. Separately, in-feed search by name returns only players you follow or have already played, and anyone else can reach you only if they already know your full email address.

If you use "open for a match", the contact email and phone number you provide for that post are shared with players who may join your booking, so they can arrange the match with you.

If you book at a venue or belong to a club, its administrators can see the data needed to manage you, for example your bookings, attendance, contact details, membership, and wallet balance at that venue.

Our authorised personnel can access account and security data (for example your email, login history, and security-related records) where needed to operate and protect the platform.

We use carefully selected providers who process personal data on our behalf under a data processing agreement. They act on our instructions and may not use your data for their own purposes.

• Hosting and infrastructure: Amazon Web Services (AWS), primary hosting and database. Region: EU (Frankfurt).

• Authentication: AWS Cognito for account authentication and token management, together with social sign-in options where you choose them (currently Google, with Facebook being added, and possibly other providers in future).

• Email: Brevo, for service emails and, with your consent, marketing emails.

• Maps and address lookup: Google Maps Platform (Places), used when you search for a venue or club address so it can be located automatically.

• Customer support: we may use a third-party tool to handle the enquiries you send us; the details you include in a support request are processed to answer you.

• Payments: Stripe, for payment processing. Card and payment credentials are handled directly by Stripe and are not stored by 2ndCourt.

• Analytics: PostHog and Google Analytics, for usage statistics. Google Analytics sets cookies and may transfer data to Google outside the EEA under an appropriate safeguard, and runs subject to your cookie consent.

We will keep the list of processors current as the platform develops.

We aim to keep personal data hosted within the EU (our primary hosting is in Frankfurt). Some of our providers operate globally (for example Google and Stripe) and may process data outside the European Economic Area. Where that happens, we rely on an appropriate safeguard under the GDPR, such as an adequacy decision or Standard Contractual Clauses.

Personal data of all users is currently handled in the same way and in the same EU hosting environment as data of EU users.

We keep personal data only as long as necessary for the purposes above.

• Account and profile data: retained until you delete your account.

• Match results, ratings, and rankings: retained to keep the integrity of the community record. Because a result involves more than one player, results may be retained in a pseudonymised or anonymised form after an account is deleted, so that other players’ records remain accurate.

• Login and email logs: up to 12 months, for security.

• Invitations to people who are not registered: deleted if not accepted within 30 days.

• Support correspondence: up to 24 months.

• Backups: stored securely and deleted on a rolling cycle, within 90 days.

When you delete your account, your personal data is erased or anonymised, unless we are required to retain something by law.

We use technical and organisational measures appropriate to the risk, including: encrypted communication over HTTPS, encryption of passwords and security tokens, network isolation, access limited to authorised personnel, and audit logging. No system can be guaranteed to be completely secure, but we follow recognised good practice and keep our measures under review.

Subject to the conditions in the law, you have the right to:

• access the personal data we hold about you,

• have inaccurate data corrected,

• have your data erased ("right to be forgotten"),

• restrict how we process your data,

• receive your data in a portable format,

• object to processing based on our legitimate interests,

• withdraw consent at any time where we rely on it,

• lodge a complaint with a data protection authority (see 14).

To exercise any of these rights, contact us at support@2ndcourt.com. We will respond within the time the law allows.

The platform is intended for users aged 16 and over, and is not directed at children under 16. We do not knowingly process the personal data of anyone under 16. If we learn that we hold such data without the required authorisation, we will delete it. We may in future introduce a supervised category for younger players, which would rely on verifiable consent from a parent or legal guardian; if we do, this Policy will be updated accordingly.

We only send marketing or promotional emails to registered users who have opted in. You can opt out at any time using the link in the email or by contacting support@2ndcourt.com.

We contact tennis clubs, venues, and their representatives about 2ndCourt using business contact details obtained from public sources (see 2.4). We do this on the basis of our legitimate interest in offering a relevant professional service. Every such message identifies us and offers a simple way to opt out, and you can object at any time (see 10), after which we will not contact you again.

Messages necessary to operate your account (for example confirmations and password resets) are not marketing and are sent on the contract basis in 3.1.

We may update this Privacy Policy from time to time. Where changes are material, we will tell you through the platform or by email. The version date at the top shows when it was last updated.

This Policy applies worldwide and reflects the GDPR as our global baseline. Depending on where you live, your local data protection law may give you additional rights, and where it applies we comply with it.

If you are in the European Economic Area, you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Slovenian Information Commissioner (Informacijski pooblaščenec), and you may also complain to the authority in your own country of residence. Users in other countries may likewise have the right to complain to their local authority.

For any question about this Policy or your personal data, contact us at support@2ndcourt.com.