Privacy Policy — Palarena
1. Who uses your data?
The publisher of Palarena is identified in the legal notice. For any question about your data or to exercise your rights, write to contact@palarena.com.
Palarena is the controller of the processing necessary for its site, demo requests, the global account, connecting users, platform-wide sports features, security and its commercial relationship with the Clubs.
The Club identified on the offer and the confirmation is responsible for its sports service, its customer file, its legal obligations and its invoicing. Palarena also processes certain data on its behalf, in particular to host its schedule, its management notes and its supporting documents. The Club’s information notice is available on its page and before the order. A single flow may involve processing that falls under these different roles.
2. What data, and for what purpose?
We receive the data you provide, the data transmitted by the Club or the organizer of your activity, the technical information generated during use and the payment statuses transmitted by Stripe. Mandatory fields are marked at the time of collection; without them, the request or feature concerned cannot be processed. Optional information is not necessary to create a basic account.
| Use | Data concerned | Legal basis |
|---|---|---|
| Responding to a demo or callback request | name, email, phone, Club, city, sports, number of courts, availability and exchanges | pre-contractual steps requested by the person; for a contact representing a Club, legitimate interest in responding to their professional request |
| Creating and using an account | email, last name/first name, identifiers, verification, hashed password, sessions and preferences; phone and profile where provided | performance of the requested service |
| Using Google sign-in, where it is offered and chosen | Google identifier, email, authorized profile information | performance of the requested sign-in; Google also processes data under its own policy |
| Booking, joining and organizing an activity | identity of the participants, Club, court, slot, status, price and accepted rules; license number if the activity requires it | performance of the requested service; for participants added by a third party, legitimate interest in organizing the activity, subject to their rights |
| Paying for a booking or a pass offered by a Club | Stripe references, card brand and last digits, expiration date, amount, payment mandate, membership/pass, charge, refund and dispute | performance of the requested service; targeted retention of evidence for legal obligations or the defense of rights |
| Saving a card to make separate future purchases easier | card reference at Stripe, display elements and proof of the choice | separate, optional and revocable consent; it is not inferred from acceptance of the Terms of Use |
| Using a sports profile and open matches | username, optional photo, city, sport, level, answers to the questionnaire, results, level history and participation | performance of the requested sports feature; visibility depends on the context announced in the interface |
| Receiving the service’s confirmations and notifications | contact details, transactional content, sending events, preferences and in-app notifications | performance of the service; legitimate interest in ensuring delivery and resolving incidents |
| Taking out and managing a professional subscription | Club representative, authorizations, contract, invoices and status of the Stripe account | performance of the contract or legitimate interest in managing professional contacts; accounting obligations |
| Providing support and security and handling reports | exchanges, access, IP, browser, server-side security logs, administrative actions, items strictly useful for a complaint | legitimate interest in protecting the service and its users; legal obligation where it applies |
| Enabling the optional diagnostics of the Manager or the administration app | browser, technical errors and performance, technical diagnostic session; depending on the environment and feature enabled | optional consent, which can be changed and revoked in the privacy settings |
| Receiving commercial news | email or other chosen channel, choice and proof of that choice | consent or applicable legal exception; in France, legitimate interest for professional marketing related to the recipient’s role, with simple objection |
| Measuring the audience | technical browsing data, depending on the tool enabled | optional consent for the site’s Umami audience measurement |
Declining to save a card for future purchases does not prevent the current order. The data and the mandate necessary for this order, for its deferred payment or for a membership already taken out may remain stored for that sole purpose.
Invitations, booking confirmations and security messages do not add you to a marketing list. You can refuse marketing at any time, using the link in the message or by writing to us. Withdrawal of consent does not call into question the processing already carried out. Where a commercial message falls under Canada’s anti-spam legislation, we apply its rules on consent or its specific exception, on identification and on unsubscribing; a business address is not enough to authorize sending.
If you request a nearby search, the location provided is used for that search. The browser’s permission concerns access to the device; it does not constitute a general authorization to reuse your position.
We do not ask for medical data to create your profile. Do not enter any in a description or a free-text note. The Club informs you separately if it needs to collect a particular supporting document for its activity.
3. Who can see this information?
The Club and its authorized persons access the data necessary for their activity: participants, relevant contact, booking, pass sold by that Club, collection and complaint. This transmission does not authorize it to send you advertising automatically. Your sports profile is accessible to signed-in users and may show your first name, last name, username, photo, levels and sports statistics. A match invitation link allows those who hold it, including without an account, to see the names and photos of the participants: share it only with the people concerned. Sports profiles and invitation links do not display your contact details or your financial information.
The lists of participants in the Club’s events have separate rules: they may show an initial to visitors without an account, or the first name and photo to signed-in users, without a full name or contact details. For a sanctioned tournament, access to the list is reserved for registrants and may remain limited to their own registration for as long as their withdrawal is free of charge. These restrictions do not apply in the same way to a match invitation link shared by an organizer.
If a Club adds you as a guest, it transmits to us the participation and contact data it has collected. This does not, on its own, create an account allowing you to sign in. You may request the rectification of this data or report an error to Palarena or to the Club. Access to an account and attachment to its history require the checks provided for by the service. Information about this indirect collection is provided as soon as possible, at the latest at the first contact or at the first transmission to another recipient if that occurs earlier, and in all cases within one month, unless a legal exception applies.
Photos and other media intended for display are delivered through public storage and cache addresses; a person who has that address can access the file. Do not upload any confidential document there. When a removal request is well founded, we deal with the file and the caches we control; copies already saved independently by third parties are not automatically erased by the removal of the source file.
Our authorized staff and the necessary service providers may process data for hosting, storage, emails, meetings, authentication or payment. The list of service providers specifies their services, their roles and the transfer information. Palarena does not sell your data.
Stripe collects the data necessary for payment directly. Palarena stores neither the full card number nor the card security code. Payments for services are made to the Club on its Stripe account; the Club’s software subscription is paid to Palarena. Depending on the processing, Stripe acts as a processor or as a controller, in particular for its regulatory checks and fraud prevention. See its privacy policy.
Some service providers may process data outside the European Economic Area. If you use the offer of a Club established outside that area, that Club may also access the data necessary for its service, including through its interface or an export. It is a recipient distinct from the technical service providers. The transfer requires a mechanism suited to the recipient: an adequacy decision within its exact scope, or appropriate safeguards such as the standard contractual clauses, with supplementary measures where necessary. Canada’s adequacy concerns commercial organizations subject to PIPEDA; that of the United States concerns organizations participating in the EU–U.S. Data Privacy Framework. The above-mentioned list describes the services and the location information available; it does not, on its own, constitute proof that the safeguards have been contractually agreed. A copy or a description of the safeguards applicable to the data flow that concerns you may be requested from our privacy contact, subject to the confidential information to be protected.
4. For how long?
Working data is distinct from the documents kept for a legal obligation or a dispute. These archives are not used for marketing or to maintain a public profile.
| Data | Period or criterion |
|---|---|
| Account and profile | period of use; review after 3 years without activity, with 30 days’ notice before deletion where contact remains possible; services in progress are handled separately |
| Demo request with no follow-up | 12 months after the last exchange; if a commercial relationship begins, retention in its file |
| Authorized commercial marketing | until withdrawal or objection, at most 3 years after the prospect’s last active contact or the end of the commercial relationship |
| Evidence of booking, payment and contract | necessary documents for 5 years after the service or the end of the relationship concerned; archiving for 10 years where a specific obligation requires it, in particular the electronic contract of at least €120 covered by the French obligation; this threshold in euros is not carried over to an amount in dollars |
| Invoices and accounting documents | 10 years from the close of the financial year concerned |
| In-app notifications | 90 days; a contractual supporting document sent by email follows the period of its evidence |
| Ordinary email sending traces | 12 months; technical delivery and payment events: 90 days once their processing is complete |
| Technical application logs and diagnostic traces | 7 days in the routine observation system; sessions follow their validity period and targeted security traces are kept for up to 12 months |
| Routine assistance | 12 months after closure; only the documents useful for a complaint or litigation are archived for longer |
| Data processed on behalf of a Club | duration of the Club’s lawful instructions and of the service, then return and deletion in accordance with the Professional Agreement |
A request for erasure does not result in the destruction of an invoice that must be kept or in the automatic cancellation of a booking. We tell you which data is kept, the reason and its expiry date. A dispute may justify the restricted retention of only the documents concerned. Backups expire according to their documented cycle; during a restoration, the deletions and restrictions already decided are reapplied.
5. Your rights
Under the conditions provided for by the GDPR, you have the rights of access, rectification, erasure, restriction, portability for the processing concerned, as well as the right to object to processing based on legitimate interest. You can object to commercial marketing at any time. You may also define instructions regarding what happens to your data after your death.
Write to contact@palarena.com. Requests are free of charge in principle. For requests under the GDPR, we respond within one month; if their complexity or number justifies an extension of two additional months, we inform you, with the reason, within the first month. A proportionate identity check may be necessary in case of reasonable doubt. We do not systematically ask for an identity document.
For data specific to the Club, we direct you to its contact or forward the necessary request to it; we handle the part that falls to Palarena ourselves. You may lodge a complaint with the CNIL or with the authority competent for your situation.
Where Canadian or Quebec legislation on the protection of personal information applies, you may exercise the rights it provides, in particular access and rectification, and send a complaint to the same contact. The ordinary time limit for responding to an access request is then 30 days; any extension must be authorized by the regime concerned and announced within the applicable time limit. The matter may be referred to the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec depending on the processing. Data may be processed outside Quebec, in particular in France, depending on the recipients and safeguards described above.
Your initial sports level is calculated from the answers to the questionnaire; it may change according to the results of confirmed competitive matches. It is used to present your profile, the rankings and suitable activities. You may ask for explanations, contest a score through the flow provided or ask support for a review. The use of a solely automated decision having a legal effect or a similarly significant effect requires specific information and safeguards before it is put in place.
6. Minors and security
Palarena is reserved for adults, in accordance with the Terms of Use. No date of birth is requested: the user declares that they meet this condition when creating their account.
Palarena arranges access limited to authorized persons and implements protective measures suited to the risks. In the event of a data breach, the operator examines the consequences, documents the incident and makes the required notifications, in particular to individuals where a high risk justifies it.
7. Cookies and embedded services
Operations strictly necessary for sign-in, security and the requested payment feature may be exempt from consent where they meet the legal conditions. Other trackers require your prior agreement. The actual inventory and the way to change your choice are available at Trackers and embedded services.
A meeting can be arranged with Calendly when you request this feature. Accessing a third-party service transmits certain technical information to it and, if you provide them, your contact details and your slot. Loading on request does not remove the need to obtain consent for the trackers that require it. You can also request a meeting at contact@palarena.com.
The Umami audience measurement of the landing site and the Grafana Faro technical diagnostics of the Manager or the administration app, where they are configured, remain disabled without your agreement. Each application offers its own choice, valid for 180 days in this browser, which can be changed from the privacy settings. Withdrawal stops the sending; an explicit reload removes the diagnostic components already loaded. Their storage and their duration are described in that inventory. The mere fact that a tool is self-hosted or advertised as “cookieless” does not constitute a general exemption from verification.
A substantial change to this policy is announced to the individuals concerned. The version and its date of application remain identifiable.