Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

Name

[TODO: publisher legal name]

Registered address

[TODO: registered address]

KRS

[TODO: KRS number]

Registry court

[TODO: registry court]

Share capital

[TODO: share capital]

NIP (tax ID)

[TODO: NIP]

REGON

[TODO: REGON]

Represented by

[TODO: representative]

Email

support@tenniswarsaw.club

Privacy matters

privacy@tenniswarsaw.club

Phone

[TODO: phone]

For anything about your personal data, write to privacy@tenniswarsaw.club. [TODO: data protection officer]

Coaches who use the Service to run their lessons also use some of your data (for example your name and your booking) for their own business; for that use, the coach is a separate controller.

2. What data we process and where it comes from

Your account

• your name and, depending on how you sign in: your Telegram ID, username, name, profile photo and language (Telegram); your email address, name and profile photo (Google); your email address (email code, in the Crabo app); your phone number (SMS code, in the Crabo app);
• technical account data: internal identifiers, the sign-in method, when you joined and last signed in.

We never see your Telegram or Google password. One-time sign-in codes are created and checked by our authentication provider.

Your profile

• your name (also in your native alphabet, if you add it), photo, sports (tennis, padel) and your self-rated level (NTRP for tennis, a padel level);
• optional details: date of birth, sex, country, height, the year you started playing, forehand and backhand, preferred surface, play style, your coach and racket;
• when and where you like to play (days, times of day, Warsaw districts) and your favourite clubs;
• contact details you add — phone, email, Telegram, WhatsApp, Instagram, Facebook — each with a public/private switch;
• settings: language, notification preferences, "Open to matches", and which optional details your profile shows.

Your activity in the Service

• event registrations and what happens to them: waiting list and its reason, attendance confirmations, withdrawals, replacements, doubles partners;
• matches and scores (including who entered or changed a score), standings, rankings, points, prizes, achievements, and your estimated level calculated from results (section 4);
• match requests you create, receive, accept or decline; open slots and offers; court alerts;
• lessons you book or take part in; reviews you write about coaches; reactions you give on profiles;
• donations (a supporter badge on your profile) and invitations of friends.

Messages

• chat messages between you and other users;
• messages between you and our Telegram bot — both the messages you send it and a log of the messages we send you (text, time, delivery status);
• your support requests, reports about content, and our decisions on them.

If you are a coach

Your coach profile (display name, bio, city, contact link, lesson types, sports, prices, photo, video, academy), working hours, time off, lesson offers and lessons, the people you add to lessons (including names of clients who don't use the Service), attendance, payments you mark as received and your private notes.

Photos and videos

Your profile photo, the short videos of your game you upload and their preview frames, a coach's photo and video, and photos from events published by organisers (section 7).

Payments

Your tPLN balance and its history (entry fees, top-ups, refunds, free entries); crypto payments (amount, currency, status and the payment provider's reference data); Telegram Stars donations (amount, date, Telegram's payment identifier, subscription status). We never receive your bank card, bank account or crypto wallet credentials.

Technical data

• push-notification tokens of your devices and browser push subscriptions (with the browser's user agent);
• server logs: IP address, time, the page or function used, browser or app details;
• error and crash reports: what went wrong and on which device and app version; reports from our servers can also include your player or Telegram ID when it is needed to fix the problem (section 15);
• information stored on your device (section 15).

Data we receive from others

• Organisers and other players: an organiser may register you for an event (by your name or Telegram username), a partner may name you as their doubles partner, a player may enter the score of your match or offer you their place, and users may report content concerning you.
• Coaches may add you as a participant of a lesson.
• Telegram: when you ask to join the club's Telegram group we receive your Telegram ID, name and username; our bot reads messages in the group to remove spam, and the club's Telegram account uses the group's member list to deliver messages (section 6).
• Google or Telegram when you sign in with them (above).

You don't have to give us your data, but without the data needed to sign in and to create a profile (your name and level) you can't use the Service. Everything marked as optional is optional.

3. Why we use your data and on what legal basis

Where we rely on legitimate interests you can object (section 11). Where we rely on consent you can withdraw it at any time; this does not affect what we did before.

We don't use your data for advertising, we don't sell it, and we don't make decisions about you with AI. We don't ask for sensitive data (such as health); please don't share it in messages.

4. Levels, rankings and other automated processing

For tennis we calculate an estimated level (NTRP) from the results of your completed singles matches and your opponents' levels. This is profiling within the meaning of the GDPR. The estimate is shown with your name (in rankings, events, leagues, share cards, results posts and your level tag in the club's Telegram group) and is used to check an event's level limit when you register: if the estimate — or, without one, your self-rated level — is below the limit, you are put on the waiting list.

The Service also applies some rules of the events automatically:

• the waiting list moves up by itself when a place frees up;
• a player who has withdrawn from two or more events without ever completing one is registered as a reserve until they pay the fee or the event is about to start;
• a top-two finish moves you up a category, and a last place in category A moves you down;
• after three completed matches between the same two players, both join the league that matches the lower level;
• monthly supporters are registered automatically for new tournaments;
• our bot removes spam from the club's Telegram group and may remove its senders if they are not registered players.

These rules only organise amateur sports events and do not have legal or similarly significant effects on you, so they are not automated decisions under article 22 GDPR. Organisers can review and override them — for example, admit a player below the level limit — and you can always ask a person to look at your case, explain your level or correct it: write to privacy@tenniswarsaw.club or contact the organiser.

5. What other people can see

Everyone, including people without an account, can see:

• rankings: your name, photo, levels, points, number of events, wins and losses, and prizes;
• event pages: participants' names, photos and levels, their registration status (including the waiting list and its reason), attendance confirmations, doubles partners, draws and results, and the podium on the event's preview image;
• league tables: names, photos and levels;
• coach profiles and reviews (reviewers are shown by first name and initial, or anonymously);
• a match request you share as a link: your first name, photo and level, the dates, areas and your note.

We ask search engines not to index player, event and ranking pages, but they are public.

Other signed-in users can also see:

• your profile: name, photo, sports, levels and their history, country, the playing details you filled in (such as racket, play style, preferred surface, days and times), favourite clubs, match history, prizes, reactions (as numbers only) and your videos;
• your age (never your date of birth), sex and height — only if you choose to show them; they are hidden by default;
• your supporter badge, unless you hide it;
• on the clubs map, if you mark favourite clubs: your name, photo, level and when and in which districts you like to play;
• the contact details you marked as public;
• whether your entry fee for an event is paid;
• your open slots and match requests; the players on the same match request see each other's Telegram username so that they can arrange the game.

Members of the club's Telegram group and channel see our posts: event announcements with participants' names, attendance reminders mentioning participants' usernames, match requests with the names and usernames of the players involved, results with names, places, prizes, points and level changes, the top of the rankings, photos from events, and the level tag next to your name.

People you deal with — your opponents and partners, the organisers of your events, a coach you book, people you chat with — see what they need for that (for example, a coach sees your name, photo, level and your message).

Our administrators can see the data they need for their role, including contact details and payment records.

Other users never see your email address or phone number unless you make them public, your date of birth, your sign-in identifiers, your messages to our bot, your support requests or your payment details.

6. Telegram

• Sign-in. When you open the Mini App or sign in with Telegram, Telegram gives us your Telegram ID, name, username, language and profile photo. We copy your Telegram photo to our storage to show it in the Service.
• Our bot sends you messages about events, matches, invitations, payments and your account, and receives what you write to it. We keep a log of these messages (section 10).
• The club's Telegram account. If you haven't started our bot, some messages (for example match reminders and a welcome message) may come from the club's own Telegram account instead. To reach you, it uses the member list of the club's Telegram group.
• The club's group and channel. When you ask to join the group, the bot asks for your level and approves the request; this creates or updates your player profile. The bot reads messages in the group to remove spam and keeps members' level tags up to date. Our posts are described in section 5.
• Stars donations are processed by Telegram; we receive only the amount, date and Telegram's payment identifier.

Telegram processes your data as an independent controller, under its own terms and privacy policy, outside the European Economic Area. Anything you send to the bot or post in the group also passes through Telegram.

7. Photos and videos

• Profile photo. You can upload a photo or use the one from Telegram or Google. It is stored as a public file: anyone who has its link can open it.
• Videos of your game. You can add a few short clips to your profile; signed-in users can watch them. The clips are stored privately and shown through links that expire after 3 hours. To check each clip and make a preview frame, it is processed once on our server in Germany (EU), which deletes its copy straight away.
• Coach photos and videos are public, like the coach profile.
• Photos from events. Organisers may publish photos from events on the event page and in our posts in the club's Telegram group. If you don't want to appear in them, tell the organiser or write to privacy@tenniswarsaw.club — we will not publish, or will remove, photos in which you can be recognised.
• Club videos on social networks. We make short videos from events and publish them on the club's YouTube, Instagram, Facebook, Threads and TikTok accounts. We publish a video in which you can be recognised only with your consent (your consent to the dissemination of your image, article 81 of the Polish Copyright Act). You can withdraw it at any time: we will stop using such videos and remove those already published from our accounts. Before publication, videos are processed on our server in Germany (EU) and, for Instagram, Facebook and Threads, placed briefly on a public file-hosting service (catbox.moe) from which these platforms fetch them. Once published, a video is public and the platforms process it under their own terms.
• Camera and photo library. The Crabo app uses them only when you choose to take or pick a photo or video.

8. Who receives your data

We share data only as far as needed. Our providers (processors) act on our instructions under data processing agreements; the others receive data as independent controllers.

Our own administrators (club staff and volunteers who act on our behalf) have access only to what their role requires. If the Service is transferred to another entity, it may take over the data; we will tell you in advance.

9. Transfers outside the European Economic Area

The Service's database and files are stored in the EU. Some providers are US companies or may access data from outside the European Economic Area (for example for support or security), and Vercel's network may handle a request at the location closest to you. Such transfers are protected by:

• the European Commission's adequacy decision on the EU-US Data Privacy Framework (for certified companies such as Vercel, Sentry, Google and Apple), or
• standard contractual clauses adopted by the European Commission (for example with Supabase).

Telegram, the social networks (when you consent to a club video) and the providers whose content your device loads directly process data outside the EEA as independent controllers when you use them. You can ask for a copy of the safeguards at privacy@tenniswarsaw.club.

10. How long we keep data

We keep data longer only where the law requires it or where it is needed to establish, exercise or defend legal claims — until the claims are time-barred.

11. Your rights

You have the right to:

• access your data and get a copy of it (art. 15);
• rectification of inaccurate data (art. 16) — you can edit most of it in your profile;
• erasure (art. 17) — delete your account or ask us to delete particular data;
• restriction of processing (art. 18);
• data portability (art. 20) — Download my data gives you all the personal data we hold about you in a machine-readable JSON file;
• object (art. 21) to processing based on our legitimate interests, for reasons relating to your situation — for example to being named in group posts or appearing in event photos. We will stop unless we have compelling legitimate grounds or need the data for legal claims;
• withdraw consent at any time (art. 7(3)) — for error monitoring in the browser (cookie settings) and for club videos (write to us);
• ask a person to review automatically applied rules and contest your level (section 4).

Use the tools in Profile → ⚙️ Settings → Privacy & data or write to privacy@tenniswarsaw.club. We reply within one month; for complex requests we may extend this by two more months and will tell you why. It is free of charge. We may ask you to confirm your identity, for example from the email address or Telegram account linked to your account.

You also have the right to lodge a complaint with a supervisory authority. In Poland it is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl); you can also go to the authority of the EU country where you live or work. We would be grateful for the chance to resolve your concern first.

12. Deleting your account and downloading your data

• Download your data: Profile → ⚙️ Settings → Privacy & data → Download my data. The website saves a my-data.json file; the app opens the share sheet with the same data.
• Delete your account: Profile → ⚙️ Settings → Privacy & data → Delete account, in the Crabo app, in the Mini App (/profile/settings) or on the website. You can also write to privacy@tenniswarsaw.club.

Deletion takes effect at once. We erase your name, contact details and identifiers, sign-in accounts, photos, videos and other files, push registrations, messages with the bot, support requests, the chat messages you sent, the reactions and reviews you gave, blocks, alerts, notification settings and achievements, and we remove your name and Telegram details from event history. Your sports results and payment records stay, linked to an anonymous player. What we must keep, and for how long, is explained on the account deletion page.

13. Children

The Service is for people aged 16 and over: in Poland, 16 is the age at which a person can consent to online services themselves. We don't knowingly create accounts for younger children. If you believe a child under 16 has an account, write to privacy@tenniswarsaw.club and we will delete it.

Coaches may give lessons to children. Such lessons are booked and managed by a parent or guardian, and the coach may record the child's first name for the lesson with the parent's or guardian's consent.

14. How we protect your data

• Connections are encrypted (HTTPS/TLS), and our providers encrypt the database and files at rest.
• Access is controlled: each user gets only the data they are entitled to, the database cannot be read with the app's public key, and administrators' access is limited to their role.
• Your videos are stored privately and shown through expiring links. Profile photos, coach media and event photos are public files — anyone who has the link can open them.
• We don't keep passwords: you sign in through Telegram, Google or one-time codes. In the Crabo app your session is kept in the device's secure storage (Keychain on iPhone, encrypted storage on Android).
• We keep our software up to date, monitor errors and back up the database.
• If a personal data breach occurs, we notify the President of UODO within 72 hours where required, and we tell you if the breach is likely to put your rights at high risk.

15. Cookies and storage on your device

We store information on your device only to make the Service work and to remember your settings. We don't use analytics, advertising or tracking cookies. The only optional item is error monitoring in your browser (Sentry), which runs only if you choose Accept in the cookie banner; with Only essential it doesn't start. You can change your choice at any time:

Website and Telegram Mini App

Crabo app

The app asks for access to the camera, photos and notifications only when you use a feature that needs it. It does not use your location, contacts or microphone, and it does not track you across other apps.

Content loaded from other providers

Some parts of the Service load content directly from other providers, which then receive your IP address and browser details: Telegram's Mini App script (telegram.org, on every page of the website), map images (Esri), club logos on the website (kluby.org), the map library in the app (cdnjs by Cloudflare), and profile photos stored with Google or Telegram.

16. Changes to this policy

We update this policy when the Service or the law changes. The version and the date of the last update are at the top of this page. We will tell you about significant changes in the Service, and through the bot or by email, before they take effect. If a change requires your consent, we will ask for it.