privacy policy

the controller under gdpr is: npr sports gmbh augsburger str. 31 86551 aichach germany email: hello@oakpadel.co

account data: name, email address and, for google sign-in, profile data provided by google (name, email, profile picture, google account id).

booking data: information about your bookings (courts, courses, appointments, open-match participation, cancellations).

payment data: transaction-related data (amount, payment status); actual card/payment details are processed exclusively by our payment provider stripe and never pass through our servers.

voucher and credit data: information on purchased or redeemed vouchers and credits, including sender/recipient data for gifted vouchers.

communication data: content of emails we send you for contract purposes (e.g. booking confirmations, sign-in links), sent via our email provider resend.

technical data: standard technical data (e.g. ip address, browser type, access time) processed automatically by our hosting provider for delivery and security purposes.

• to perform the booking contract (account creation, booking, payment processing, customer service) — art. 6(1)(b) gdpr. • to comply with legal obligations (e.g. tax retention requirements for invoices) — art. 6(1)(c) gdpr. • to pursue legitimate interests, e.g. fraud prevention, platform security, and improving our service — art. 6(1)(f) gdpr. • based on your consent where given (e.g. for certain cookies or marketing communication) — art. 6(1)(a) gdpr; you may withdraw consent at any time with future effect.

we use carefully selected service providers acting as processors (art. 28 gdpr), including in particular:

• stripe (card payment processing) • resend (transactional email delivery) • google ("sign in with google" / oauth) • our hosting and infrastructure provider (platform and database hosting)

we have data processing agreements in place with all processors. transfers outside the eu/eea only occur where an adequate level of data protection is ensured (e.g. an eu adequacy decision or standard contractual clauses).

we use technically necessary cookies/storage required to operate the platform (e.g. to maintain your login session), based on § 25(2) ttdsg / art. 6(1)(b)/(f) gdpr; no separate consent is required for these.

if we introduce additional, non-essential cookies (e.g. analytics or marketing) in the future, we will inform you separately and obtain consent where required.

we retain personal data only as long as necessary for the stated purposes or as required by law (e.g. commercial/tax retention obligations of typically six to ten years for invoices). booking history generally remains in your account for as long as the account exists.

under gdpr you have the right to access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), and objection (art. 21).

to exercise these rights, contact hello@oakpadel.co at any time. you also have the right to lodge a complaint with a data protection supervisory authority, in particular the bavarian data protection authority (lda bayern).

we implement appropriate technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access (e.g. encrypted transmission, access restrictions).

we may update this privacy policy to reflect changes in law or in our services. the version in effect at your next visit applies.

for any privacy-related questions, contact hello@oakpadel.co at any time.