RYSE — Privacy Policy

1. Data Controller

Y Padel, Zeppenheimer Straße 32, 40489 Düsseldorf, Germany. Email: info@ypadel.net. Owner: Youssef Ahmed Amen Abdelmajeed elDidi.

2. Purpose

This privacy policy describes the processing of personal data when using YPADEL, for memberships, and when registering for and participating in RYSE tournaments.

3. User Account

We may process, in particular, name, email address, phone number, gender (where provided), account data, and authentication information. The purpose is account setup and management, authentication, support, and platform operation. The legal basis is generally Art. 6(1)(b) GDPR, insofar as processing is necessary for contract performance.

4. Tournament and Ranking Data

On a RYSE registration we may process, in particular, name, team assignment, tournament, skill level, tier, results, ranking points, division history, membership status, and relevant payment/transaction information. The legal basis may be Art. 6(1)(b), Art. 6(1)(c), or Art. 6(1)(f) GDPR, depending on the specific purpose.

5. Public Ranking Information

To operate the ranking, selected information such as player name, placement, points, and tournament results may be displayed publicly. Only the information necessary for ranking purposes is published.

6. Payments / Stripe

Payments for memberships and tournaments are processed via Stripe (Stripe Payments Europe, Limited or Stripe Technology Europe, Limited). Payment data is processed for payment processing, refunds, fraud prevention, and compliance with legal obligations; Y Padel does not store full card details. Processing takes place under the Stripe Data Processing Agreement (stripe.com/legal/dpa) and may involve data transfer to the USA, safeguarded by the EU Standard Contractual Clauses under Art. 46 GDPR.

7. Server, Security, and Technical Data

Depending on the technical infrastructure, IP address, browser/device information, session/authentication data, and server logs may be processed. Purposes are operation, security, error analysis, and abuse prevention.

8. Email Communication

Transactional emails may include registration confirmations, payment confirmations, tournament information, password resets, and important service information. Marketing communication about new RYSE/YPADEL tournaments is sent only on a permitted legal basis, e.g. consent via a double opt-in process; unsubscribing free of charge is possible at any time.

9. Cookies

Y Padel currently uses only technically necessary cookies, in particular for login, session management, and security-related functions (legal basis: Art. 6(1)(f) GDPR or § 25(2) TDDDG). No analytics or marketing cookies are used. Should this change in the future, a consent banner with granular consent options will be implemented before such cookies are used, and this privacy policy will be updated accordingly.

10. Photo and Video

Photos and videos may be taken at RYSE events. General event footage, in which participants are recognisable in the background or as part of a group, relies on our legitimate interest in event documentation (Art. 6(1)(f) GDPR, § 23(1) Nos. 2 and 3 KunstUrhG). For individual shots for promotional purposes, we obtain explicit consent (Art. 6(1)(a) GDPR, § 22 KunstUrhG). Material may be published on ypadel.net, on RYSE/YPADEL social media channels (including Instagram, YouTube), and in promotional materials and tournament recaps; this may involve a data transfer to the USA, for which the respective providers offer appropriate safeguards. Participants who do not wish to appear in promotional individual shots can contact info@ypadel.net, ideally before the event; consent given can be withdrawn at any time with effect for the future. RYSE is currently open exclusively to participants aged 18 and over, so no footage of minor participants is created. Further details are set out in the RYSE Photo & Video Notice.

11. Withdrawal of Membership Contracts

In connection with exercising the statutory right of withdrawal for memberships (withdrawal declaration, electronic acknowledgement of receipt under § 356a BGB, reversal of payment), we process the data required for this on the basis of Art. 6(1)(c) GDPR in conjunction with Art. 6(1)(b) GDPR. Details are set out in the RYSE Withdrawal Notice.

12. Service Providers and Processors

We use payment, hosting, email, and infrastructure service providers who support us in operating and securing the platform. Where required, we have data processing agreements and appropriate data protection safeguards in place with these providers.

13. Retention Period

Personal data is retained only for as long as necessary for the respective purpose. In particular, the following standard periods apply: invoicing and accounting records 10 years (§ 147 AO, § 257 HGB), commercial correspondence 6 years. Account data is generally retained for 2 years after the membership ends or the account is deleted, unless statutory retention obligations require otherwise. Server log files are automatically deleted or anonymised after 30 days, unless needed longer to investigate a specific security incident. Statutory retention obligations otherwise remain unaffected. Data may also be retained for as long as necessary to assert or defend legal claims.

14. Rights of Data Subjects

• Access to the personal data processed
• Rectification of inaccurate data
• Erasure, where the requirements are met
• Restriction of processing
• Data portability, where applicable
• Objection to certain processing
• Withdrawal of consent with effect for the future

15. Contact and Right to Complain

Requests regarding data protection rights can be sent to info@ypadel.net. Data subjects also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for Y Padel: Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf. Phone: +49 (0)211 38424-0 · Email: poststelle@ldi.nrw.de · Web: www.ldi.nrw.de