This policy explains what personal data we process, why, on what legal basis, for how long, and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is the controller
- Controller
- Adrià Colomer Serra (Pranarp Club)
- Tax ID (NIF)
- 33956328W
- Address
- C/Mallol, 35 2n 2a
- Privacy contact
- info@pranarpclub.com
- Data protection officer
- We have not appointed a data protection officer because we are not required to (art. 37 GDPR and art. 34 LOPDGDD). Any privacy enquiry is handled through the contact above.
2. When we are a controller and when a processor
Pranarp Club processes data in two different roles:
- As a controller, of the data of people who visit this website, ask us for a demo or write to us, and of the account data of each user of the platform (name, email, credentials, language and preferences, acceptance of the terms, and security logs). This policy covers that data.
- As a processor, of the data that each club manages with the application about its players and members (bookings, attendance, phone, level, notes, etc.). In that case the controller is the club, which decides what data it collects and why; we only process it on its instructions and under the Data processing agreement. Each club publishes its own privacy policy. If you are a club’s player and want to exercise your rights over that data, contact the club; if you write to us, we will forward your request to it.
3. What we use your data for
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account and provide the service, including support | Name, email, credentials (the password is stored encrypted), language, application preferences and support messages | Performance of a contract or pre-contractual measures (art. 6.1.b GDPR) | While the account is active and, afterwards, for the limitation periods of legal claims |
| Record that you have accepted the terms of service and the privacy policy | Version accepted and date and time of acceptance | Legitimate interest in proving consent and the contract (art. 6.1.f GDPR) | While the account is active and for the limitation periods |
| Invoice and meet tax and accounting obligations with client clubs | Club tax and billing data | Legal obligation (art. 6.1.c GDPR) and performance of the contract | 6 years (art. 30 of the Spanish Commercial Code) and the periods set by tax law |
| Reply to demo, contact and information requests | Name, email, phone, club and message | Pre-contractual measures at your request (art. 6.1.b GDPR) and your consent (art. 6.1.a) | 12 months from the last contact if you do not become a customer |
| Keep the service secure, prevent fraud and spam, and detect technical errors | IP address, access and activity logs, device identifiers and technical error data | Legitimate interest in protecting the service and its users (art. 6.1.f GDPR) | Up to 12 months, unless needed to investigate an incident |
| Measure use of the website and the application in aggregate | Browsing data collected with analytics cookies | Your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE) | As set out in the Cookie policy |
Where the legal basis is legitimate interest, we have weighed that your interests or rights do not override it. You can ask us for that assessment and object to the processing at any time.
We do not take decisions based solely on automated processing that produce legal effects on you.
4. Mandatory data
The fields marked as mandatory in the forms are needed to handle your request or provide the service. If you do not provide them, we will not be able to do so. You confirm that the data is accurate and that, if you give us data about other people, you have informed them.
5. Who we share your data with
We do not sell your data or hand it over to third parties for their own purposes. We only share it:
- with public authorities when the law requires it (for example, the Spanish Tax Agency);
- with the clubs you sign up to as a player, which receive the data needed to manage your bookings and your membership and which are the controllers of that data;
- with providers that supply us with services and act as processors, under contract and with appropriate safeguards: hosting and email (IONOS), anti-spam protection (Cloudflare) and, with your consent, analytics (Google). The full list, with each provider’s location, is in the Data processing agreement.
6. International transfers
We host the application and its data on IONOS servers in the European Union. Some providers may process data outside the European Economic Area, mainly in the United States. In those cases the transfer relies on the adequacy decision for the EU-US Data Privacy Framework (for certified companies) or on the standard contractual clauses approved by the European Commission, with any supplementary measures required. You can ask us for a copy of those safeguards.
7. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting the lawfulness of the processing carried out before. Write to us at info@pranarpclub.com stating which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, extendable by two further months in complex cases.
If you have an account, you can do it yourself from your profile: export your data as a JSON file (we email you a download link, valid for 48 hours) and delete your account. When you delete it we anonymise your personal data; bookings, payments and invoices already made are kept, without data that identifies you, for the periods required by law.
To withdraw your consent to analytics cookies, use the “Cookie settings” link in the footer.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We would appreciate it if you wrote to us first so we can try to resolve it.
8. Minors
The service and this website are aimed at clubs and at people over 14. We do not knowingly collect data from children under 14. If you believe a child under that age has given us data, write to us and we will delete it. Data about minors that a club manages in the application is the club’s responsibility, and the club must have the consent of their parents or guardians where necessary.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted communications (HTTPS), encrypted passwords, access control by role and by club, backups, activity logs and regular security updates. If a security breach affects your data, we will act in accordance with articles 33 and 34 of the GDPR.
10. Changes to this policy
We may update this policy to reflect legal or service changes. We state the date and version of the latest update at the top of the page and, if the changes are significant, we will let you know by email or in the application.