Privacy Policy

1. Controller and scope

WIXYS GLOBAL SOLUTIONS, S.L. owns Play&Pair and is the controller of personal data associated with accounts, the platform and its digital services.

This policy applies to website and app users, players, organizers, club representatives and anyone who contacts us. Where an organizer or club processes data for its own purposes and under its own instructions, it must inform you of its identity and the conditions of that processing.

2. Data we process

The specific data depends on how you use Play&Pair. We do not request data that is not reasonably necessary for the features you use.

• Account and contact data: email address, telephone number, language, encrypted credentials and account verification and security information.
• Profile data: first and last name, display name, date of birth, gender, photograph and chosen location or area.
• Sporting activity: registrations, teams, tournaments, matches, results, rankings, level and information required to manage participation.
• Organization data: contact details, published activities, clubs, courts, rules, communications and operations managed by organizers.
• Payments: amount, currency, status, transaction references, cancellations and refunds. Play&Pair does not store full card details.
• Communications: enquiries, incidents, complaints, notifications and communication preferences.
• Technical, security and measurement data: IP address, session or device identifiers, date and time, access logs, errors and signals required to prevent fraud and protect the Service. Cloudflare Web Analytics provides aggregate metrics about visits, pages viewed, approximate geographic origin, referrers and performance without using cookies, local storage or fingerprinting to identify visitors.
• Third-party data: information supplied by an organizer, a sign-in provider such as Google or a payment provider when you use those features.

3. Purposes and legal bases

We process data only where there is a valid legal basis and for as long as necessary for the relevant purpose.

• Performance of a contract: creating and administering accounts, providing requested features, and managing registrations, tournaments, results, rankings, payments, refunds and support.
• Legal obligation: meeting tax, accounting, consumer and anti-fraud duties, responding to authorities and establishing or defending legal claims.
• Legitimate interests: keeping the Service secure, preventing abuse, diagnosing errors, measuring aggregate use and performance through Cloudflare Web Analytics, improving the Service and defending claims, after balancing the rights of affected individuals.
• Consent: marketing, optional device permissions, non-essential cookies and other processing for which consent is specifically requested. You may withdraw it at any time.

4. Visible data and sporting participation

For tournaments and rankings to operate, information such as display name, team, results, position and statistics may be shown to other participants or published where an activity is public. Before publishing an activity, the organizer must have an appropriate legal basis for the data it supplies.

Visibility settings and each activity's features determine the extent of publication. You may request information or correction of inaccurate data, subject to the retention of results where there is a legitimate reason or applicable obligation.

5. Recipients and providers

Where needed to provide the Service, data may be disclosed or made accessible to organizers and clubs for activities you join; hosting, database, email, support and security providers; Cloudflare for site delivery, protection and aggregate measurement; Stripe for payment processing; and Google when you use sign-in, place search or map features.

Providers receive only the data needed for their function and act under their own obligations or data-processing agreements. We may also disclose data to public bodies, authorities, courts or third parties where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal data.

6. International transfers

Some providers may process data outside the European Economic Area. Where this occurs, we use a mechanism recognized by data protection law, such as an adequacy decision, the European Commission's Standard Contractual Clauses or other appropriate safeguards. You may ask about applicable safeguards at willi@wixys.com.

7. Retention

Account data is retained while the account remains active and afterwards for the period needed to close it and address potential liabilities. Transaction, invoicing and payment data is retained for periods required by tax, accounting and anti-fraud law. Security logs are kept for limited, proportionate periods.

Tournament, result and ranking data may remain while a competition is active or published and afterwards where needed to preserve sporting history, resolve incidents or comply with obligations. When data is no longer needed, it is deleted, anonymized or restricted for legally required periods.

8. Your rights

You may request access, rectification, erasure, restriction, objection and portability. You may also withdraw consent without affecting prior lawful processing and object to automated decisions where applicable. Play&Pair does not currently make solely automated decisions producing legal or similarly significant effects on users.

To exercise a right, email willi@wixys.com, state the right concerned and provide enough information to identify your account. We may request further proof where there are reasonable doubts about identity. Requests are free except where the law provides otherwise.

If you believe processing breaches the rules, you may complain to the Spanish Data Protection Agency (www.aepd.es), without prejudice to any other available remedy.

9. Children

Children must use Play&Pair with a parent or legal guardian where their involvement is required. In Spain, a child may independently consent to personal-data processing from age 14; below that age, consent must be given by a parent or guardian unless another rule requires their assistance for the relevant act.

Organizers of activities involving children must apply the required authorizations, notices and safeguards. If we learn that a child's data was supplied without a sufficient basis, we may request verification or delete it.

10. Security and user responsibilities

We apply reasonable technical and organizational measures to protect data against loss, alteration, unauthorized access or disclosure. No system is entirely invulnerable, so measures are reviewed in light of risk and changes to the Service.

You must protect your credentials and promptly report unauthorized use. If you provide another person's data, you confirm that you are entitled to do so and have given them any required information.

11. Cookies, changes and contact

Cookies and similar technologies are explained in a separate Cookie Policy. We may update this policy for legal, technical or Service changes. We will publish the new date and communicate material changes where required.

For questions about privacy or this policy, email willi@wixys.com.