Privacy Policy

NOTSU OÜ, registry code 16305121, VAT EE102489600, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Soo tn 2, 10414, Estonia. Contact us through the contact page for any privacy request. We have not appointed a data protection officer; privacy requests are handled by the operator.

• Account data: email address, authentication identifiers, sign-in method, account creation and last activity timestamps.
• Profile data: display name, optional photo, city and country, preferred hand and side, years of experience, home club, availability, bio, strengths, visibility setting and 18+ self-declaration where a feature requires it.
• Sport data: PadelSmash rating and rating history, self-reported Playtomic rating and optional public Playtomic profile link, matches played, results, streaks, badges and reliability signals.
• Game data: games you create or join, invitations, private-game participants, chat messages in match and direct conversations, and dispute submissions.
• Wallet and commerce data: SmashToken balances by bucket, ledger entries, store orders, delivery details you provide, payment references and status returned by the payment provider.
• Referral data: your invite code, clicks on your link, sign-ups attributed to it and reward entries.
• Technical data: IP address, device and browser information, error reports and security logs.

We do not ask for special-category data. Card numbers never reach our servers — they are handled by the payment provider.

• Providing the service — creating your account, matching players, running games, ratings, tournaments, wallet, store and messaging: performance of a contract (Art. 6(1)(b)).
• Payments, invoicing and accounting records: legal obligation (Art. 6(1)(c)) and contract performance.
• Security, fraud, abuse prevention, referral anti-abuse and enforcing our rules: legitimate interests (Art. 6(1)(f)) in operating a safe platform.
• Support and dispute handling: contract performance and legitimate interests.
• Service emails such as sign-in links, result confirmations and order updates: contract performance.
• Optional marketing messages, if we ever send them: consent (Art. 6(1)(a)), withdrawable at any time.
• Compliance and country/provider gating checks for competition features: legal obligation and legitimate interests.

We share data only with categories of processors and recipients needed to run PadelSmash:

• Cloud hosting, database, authentication and file-storage providers.
• Payment providers and their fraud/risk services, for the transactions they process.
• Email delivery providers for transactional messages.
• Error monitoring and infrastructure logging providers.
• Logistics partners for physical store deliveries you order.
• Professional advisers, accountants and auditors, and public authorities where the law requires it.
• Other players — only the profile fields your visibility setting allows, plus what you share in games and chats.

We do not sell personal data and we do not share it for third-party advertising.

We prefer EU/EEA hosting. Where a processor operates outside the EEA, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest. You can ask us which safeguard applies to a specific provider.

• Account and profile data: while your account exists, then deleted or anonymised after closure, subject to the exceptions below.
• Accounting and payment records: 7 years, as required by Estonian accounting law.
• Ledger and settlement entries: retained in anonymised or pseudonymised form for audit and reconciliation integrity.
• Dispute, fraud and security records: up to 3 years after the case closes, or longer if a claim is pending.
• Match results and ratings: retained in a form that no longer identifies you once your account is deleted, so other players' historic results stay correct.
• Technical logs: typically up to 12 months.

• Row-level database security so a player can only read and write their own records.
• Server-side authorisation on every privileged action, including all administrative functions.
• Encryption in transit, encrypted storage at rest and signed, time-limited URLs for profile photos.
• Secrets kept server-side only and never exposed to the browser.
• Audit logging of administrative and financial actions.

No system is perfectly secure. If a breach is likely to result in a high risk to you, we will notify you and the supervisory authority as required by the GDPR.

• Access a copy of your personal data.
• Rectify inaccurate data — most profile fields you can edit yourself.
• Erasure — see the account deletion tool in your profile settings and the Account deletion page.
• Restriction of processing, and objection to processing based on legitimate interests.
• Data portability for data you provided under a contract or consent.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn) or your local supervisory authority.

We answer requests within one month, extendable by two further months for complex requests. We may ask you to confirm your identity through your registered account.

PadelSmash is not intended for children under 16. Features involving a participation fee, prize pool or token purchase are restricted to users who declare they are 18 or older. If we learn that an under-age account exists, we close it and delete the data.

Ratings and reliability signals are calculated automatically from confirmed results, and some anti-abuse checks are automated. These do not produce legal effects on you; a human reviews any decision that restricts an account, and you can contest it through the contact page.

PadelSmash uses strictly necessary storage only, mainly to keep you signed in. Details are on the Cookies page. We do not run advertising trackers, and we do not assume consent for any non-essential processing.