Privacy Policy

1. Introduction

This Privacy Policy describes how Ace ("we," "our," or "us") collects, uses, and protects your personal information when you use our tennis community platform and related services. This policy applies to all services offered through our website, mobile applications, and related platforms (collectively, the "Service"). We process your personal data based on various legal grounds as described in Section 4 of this policy, including contract performance, legitimate interests, consent where required, and legal obligations. We adhere to the principles of data minimization (Article 5(1)(c) GDPR) and purpose limitation (Article 5(1)(b) GDPR) by collecting and processing only the data necessary for the respective purposes.

When you download the app from the Apple App Store or Google Play, the respective store operator processes information such as your store account details, device information and download activity under its own responsibility. Apple's or Google's privacy notice applies to that processing. This policy describes the subsequent processing by Ace.

2. Data Controller

The data controller responsible for your personal data is: Ace Labs UG (haftungsbeschränkt) Bodelschwinghstr. 1 48527 Nordhorn, Germany Email: admin@playace.de

Club administration and processing on behalf of clubs

We are responsible for your personal Ace account and the platform features we provide. Where a club uses Ace for membership administration, court bookings, fee administration or member communications, the club determines the purposes and legal bases of that processing. We process this club data on the club's documented instructions under a data processing agreement pursuant to Article 28 GDPR. It may include personal and contact details, dates of birth, emergency contacts, bookings, fee and SEPA data, and details of legal guardians. Depending on the club features used, health information or records concerning criminal record checks may also be processed. The club must ensure the necessary legal basis and additional conditions under Article 9 or Article 10 GDPR and inform the people concerned. This also applies to minors and members without their own Ace account. Please address requests concerning this club data to your club; we assist it in handling requests. If responsibility is unclear, contact admin@playace.de.

3. Information We Collect

We may collect the following types of information:

• Personal Information: Name, email address, phone number, date of birth, profile picture, postal address, and other contact details you provide during registration or account updates.
• Profile Information: Tennis skill level, playing preferences, availability, match history, club affiliations, tournament participation, rankings, achievements, and other tennis-related information you choose to share.
• Usage Data: Information about how you use our platform, including matches played, messages sent, communities joined, events attended, booking history, search queries, feature usage, and other interactions with our Service.
• Device and Technical Information: IP address, browser type and version, device type and model, operating system, language preferences, referring URLs, access times, pages viewed, click-stream data, and other technical information about your device and internet connection.
• Location Data: With your explicit consent, we may collect precise or approximate location data through GPS, Wi-Fi, or IP address to suggest nearby players, courts, events, and clubs.
• Communication Data: Content of messages you send through our platform, support tickets, feedback, and other communications with us or other users.
• Payment Information: Payment method details, billing address, transaction history, and other financial information necessary to process payments (processed securely through our payment providers).
• Biometric Data: We optionally allow you to use your device's biometric authentication features (e.g., FaceID, TouchID) for sign-in. Use is voluntary and serves as an alternative to PIN entry. At no time do we have access to your raw biometric data; verification is performed exclusively locally on your device by the operating system.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: Art. 6(1)(a) GDPR: Where you have given explicit consent for specific processing activities, such as marketing communications or location tracking.
• Contract Performance: Art. 6(1)(b) GDPR: Processing necessary for the performance of our contract with you or to take steps at your request before entering into a contract, including account management and service provision.
• Legitimate Interests: Article 6(1)(f) GDPR: ensuring secure and reliable operation, troubleshooting, backups, preventing abuse and handling general enquiries. We take your interests and fundamental rights into account. Optional product analytics through PostHog are based on your consent. You can object to this processing under Article 21 GDPR (see Section 9).
• Legal Obligation: Art. 6(1)(c) GDPR: Processing required to comply with legal obligations, such as tax reporting or responding to legal requests.
• Vital Interests: Art. 6(1)(d) GDPR: Processing necessary to protect vital interests of you or another person in emergency situations.
• Special Categories of Personal Data: Processing health data requires both a legal basis under Article 6 GDPR and an exception under Article 9(2) GDPR, such as explicit consent. Where we process such data on behalf of a club, the club determines and is responsible for the legal basis. Data relating to criminal convictions and offences are subject to the separate requirements of Article 10 GDPR.

5. How We Use Your Information

We use the collected information for various purposes, including:

• Service Provision: To create and manage your account, authenticate users, provide our core services, process transactions, and deliver requested features.Legal basis: Art. 6(1)(b) GDPR.
• Player Matching: To connect you with compatible tennis players based on skill level, location, preferences, and availability using our matching algorithms.Legal basis: Art. 6(1)(b) GDPR; where we use your device location, your consent (Art. 6(1)(a) GDPR).
• Communications: To send you service-related notifications, updates, security alerts, support messages, and respond to your inquiries.Legal basis: Art. 6(1)(b) GDPR for messages about your account and your use of the Service; Art. 6(1)(f) GDPR for answering general enquiries.
• Platform Improvement: To analyze usage patterns, diagnose technical problems, conduct research, and enhance the functionality, performance, and user experience of our platform.Legal basis: Art. 6(1)(f) GDPR (interest in a stable, error-free service); usage-based product analytics only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Personalization: To customize content, features, and recommendations based on your preferences, behavior, and interactions with our platform.Legal basis: Art. 6(1)(b) GDPR where the customisation is part of the features you use (e.g. suggestions based on your profile details); otherwise Art. 6(1)(f) GDPR (interest in relevant suggestions).
• Marketing: With your explicit consent, to provide you with news, special offers, promotional materials, and information about other services, events, and features that may interest you.Legal basis: Your consent (Art. 6(1)(a) GDPR).
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, security threats, abuse, and other harmful activities that may affect our Service or users.Legal basis: Art. 6(1)(f) GDPR (protecting our systems and users); where security measures are required by law, Art. 6(1)(c) GDPR in conjunction with Art. 32 GDPR.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.Legal basis: Art. 6(1)(c) GDPR.
• Analytics: To understand how our Service is used, measure performance, and generate insights to improve our offerings.Legal basis: Your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), given in the cookie banner and revocable at any time.

6. Data Storage and Security

We operate our database on self-hosted infrastructure at IONOS in Germany and additionally use backups at Hetzner within the EU. Our safeguards include encrypted transmission (TLS), access controls, role-based permissions and backups. Backups are encrypted before they are stored; the decryption key is not kept on our servers or at Hetzner. The live database itself is not yet fully encrypted at rest. Sections 13 and 15 describe other recipients and possible processing outside the EEA.

7. Data Retention

We retain personal data for as long as needed for its purpose or required by law. Account data are generally processed for the lifetime of the account. The following data have specific retention periods; scheduled cleanup takes place in the respective regular deletion run:

• Push queue: 48 hours. This period applies to the technical delivery queue, not automatically to messages or notifications in your account.
• Location reports near clubs (showing how many players are currently on site): 4 hours; the deletion run takes place hourly.
• In-app notifications: read ones after 30 days, all others after 90 days; the deletion run takes place daily.
• Chats: for as long as you take part. Conversations without remaining participants and conversations without a new message for 24 months are deleted in the daily deletion run.
• Login events: 90 days. Recognised login devices: 12 months since last use.
• Logs of club administration actions: 5 years for accountability and investigation of security incidents.
• Unconfirmed registrations: cleanup after 30 days without confirmation; the deletion job runs daily.
• Privacy data exports: deletion after the stated validity of the download link expires, during the daily cleanup run.
• Backups: local copies are kept for 7 days; the last 10 external backups are retained and replaced as new backups are created. Data from deleted accounts may remain in backups until the relevant rotation.
• Records subject to statutory retention: in particular, accounting vouchers and invoices generally for 8 years, books and annual accounts for 10 years, and commercial and business correspondence for 6 years (section 147 of the German Fiscal Code and section 257 of the German Commercial Code). The period generally starts at the end of the relevant calendar year. Statutory extensions, for example for ongoing tax proceedings, may apply. Only the data needed for these purposes are retained; account deletion does not remove these obligations.
• Club data: according to the instructions and retention obligations of the responsible club. Our data processing agreement provides for a 90-day grace period for data exports after processing services end, followed by deletion unless statutory retention obligations apply.

Account deletion

You can request deletion of your account in account settings or by contacting admin@playace.de. The request covers personal data and files associated with your account and the necessary cleanup with integrated service providers. Records required by law or data needed to establish, exercise or defend specific legal claims may be retained for those purposes. Identifying information is removed where it is no longer necessary; this does not promise complete anonymisation of all payment records. Deleting your Ace account does not automatically end your club membership or lawful processing by your club.

8. Data Sharing and Disclosure

We may share your information in the following circumstances:

• Other Users: Your profile information, match history, and tennis-related data are visible to other users as necessary for the functioning of our platform. You can control the visibility of certain information through your privacy settings.
• Service Providers: Third-party vendors who provide services on our behalf, such as payment processing (Stripe), email delivery, data analysis, and customer support. These providers are contractually bound to protect your data.
• Legal Requirements: When required by law, court order, subpoena, or governmental authority, or when we believe disclosure is necessary to protect our rights, property, or safety, or that of our users or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the involved parties. We will notify you of any such change in ownership or control.
• With Your Consent: We may share your information for other purposes with your explicit consent.

9. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: You can request copies of your personal data that we hold, including information about how it is processed.
• Right to Rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): You can request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the original purpose.
• Right to Restriction of Processing: You can ask us to restrict the processing of your personal data in certain situations.
• Right to Data Portability: You can ask us to transfer your personal data to another organization or directly to you in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to processing based on legitimate interests and to processing for direct marketing. Details are in the highlighted notice on the right to object at the start of this section.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significant impacts. Our platform uses ELO-based local sorting recommendations and match suggestions to help display suitable tennis players based on factors such as skill level, location, playing preferences, availability, and match history. The algorithm provides suggestions only; there is no exclusivity in which players may be viewed, and you can manually override, adjust, or disable filters at any time. These calculations are an optional regional filtering and sorting aid, do not produce legal effects, and do not constitute deep or extensive systematic monitoring. Notwithstanding this, pursuant to Article 22(3) GDPR, you may request human intervention at any time, express your point of view, and request a review; you may also object to this type of processing. Please contact us at admin@playace.de.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent by contacting us at admin@playace.de or through your account settings where applicable (e.g., marketing preferences).
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable law. The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany (www.lfd.niedersachsen.de). However, you may also contact the supervisory authority in your country of residence.

For requests concerning your data, contact admin@playace.de. We will generally inform you of action taken within one month of receipt. Where legally permitted, this period may be extended by up to two further months for complex or numerous requests; we will inform you of the extension and reasons within the first month. Where we have reasonable doubts, we may request further information to verify your identity. Requests are generally handled free of charge, subject to statutory exceptions for manifestly unfounded or excessive requests.

10. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage patterns, and provide personalized content. Cookies are small text files stored on your device. You can control cookie settings through your browser preferences or our cookie consent banner, but disabling certain cookies may limit some functionality of our Service.

The storage of information on the end user’s terminal equipment or the access to information already stored on the terminal equipment is carried out on the basis of § 25(1) TDDDG (Telecommunications Digital Services Data Protection Act), provided the end user has given consent on the basis of clear and comprehensive information. For technically essential cookies that are strictly necessary to provide a service explicitly requested by you, storage or access is carried out on the basis of § 25(2) TDDDG. The GDPR applies as a legal basis only for the subsequent processing of personal data collected through cookies or comparable technologies (in particular Art. 6(1)(a) GDPR for consent, Art. 6(1)(f) GDPR for legitimate interests).

You can manage your cookie preferences at any time through our cookie settings banner or by contacting us. Your consent preferences are stored locally on your device and can be changed at any time. Where technically available, we take browser privacy signals such as Global Privacy Control (GPC) into account when controlling consent-based tracking features.

To document and demonstrate your consent decisions (Art. 5(2), Art. 7(1) GDPR), we record your IP address and browser user agent each time you change your consent preferences. This data is processed solely to fulfil our legal accountability obligation under Art. 6(1)(c) GDPR and is deleted after the applicable statutory retention period.

11. Profiling and Match Suggestions

Our platform uses profile-based data processing to provide local sorting recommendations and match suggestions. This involves:

12. Data Breach Notification

We notify the competent supervisory authority of personal data breaches without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals' rights and freedoms (Article 33 GDPR). Where a high risk is likely, we also notify affected individuals without undue delay, unless a statutory exception applies (Article 34 GDPR). We explain the nature of the breach, likely consequences, measures taken or proposed, and how to contact us for further information.

13. International Data Transfers

Some providers listed below are based outside the European Economic Area or use affiliates and service providers there. An EU storage location does not automatically exclude access from third countries. Article 45 GDPR applies to transfers covered by an applicable adequacy decision. The EU-U.S. Data Privacy Framework can only be relied on for the specifically certified US recipient and data within the scope of that certification. Where no applicable adequacy decision covers the transfer, appropriate safeguards under Article 46 GDPR are required, in particular EU Standard Contractual Clauses and, where necessary, supplementary measures. You can obtain information about the safeguards used for a specific recipient and a copy by contacting admin@playace.de. The linked privacy notices provide additional information from the providers.

14. Children's Privacy

A personal Ace account is available from the age of 7. For users under 16, processing is only permitted with the consent of a parent under Art. 8 GDPR: the child enters a parent's email address in the app, we send a confirmation link to that address, and the parent gives consent on a web page. Until then the account stays locked; if consent is not given within 14 days of the first request, we delete the account. As proof of consent (Art. 7(1) GDPR) we store the parent's email address and name as well as the time and IP address of the confirmation. Usage analytics (PostHog) are never enabled for users under 16. The date of birth is mandatory at registration; a date of birth that involves an age under 16 can only be changed through support. Parents can revoke their consent at any time by emailing admin@playace.de; the child's account is then deleted. This is separate from the administration of underage club members: a club may process the data of younger members without their own Ace account as part of club administration; legal guardians may be involved through the available features. The club is responsible for the legal basis and any necessary information or consent. For questions about processing minors' data, contact admin@playace.de or, for club data, the responsible club.

15. Third-Party Services and App Stores

We use the following services depending on the feature you use. Not every service receives data on every visit. In addition to processors acting on our behalf, some providers may be independently responsible for their own processing, for example for login, payments or app store use. When your device connects directly, the provider also receives your IP address and technical connection data. Server-side requests generally transmit our server's IP address. Section 13 explains transfers to third countries.

16. Hosting

Our Service is hosted on servers provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When accessing our website or using our Service, the hosting provider automatically processes information transmitted by your browser. The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our Service).

We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with IONOS SE. This agreement ensures that IONOS processes the personal data of our website visitors and users only in accordance with our instructions and in compliance with the GDPR.

17. Collection of General Data and Information (Server Log Files)

Our web server automatically stores so-called server log files with each access by default. These include the IP address of the accessing computer, date and time of access, name and URL of the retrieved file, the web browser used, the operating system, and the referring page (referrer URL). This data is processed exclusively to ensure trouble-free operation and to improve the IT security of our systems.

The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the IT security and trouble-free operation of our systems).

These server log files are automatically deleted after 14 days, unless further retention is required for evidentiary purposes in the event of specific security incidents.

18. Bunny.net

We use the Content Delivery Network (CDN) of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (Bunny.net) to increase the security and delivery speed of our website. This corresponds to our legitimate interest (Art. 6 para. 1 lit. f GDPR). A CDN is a network of distributed servers capable of delivering optimized content to website users. For this purpose, personal data may be processed in server log files by Bunny.net. Please refer to Section 16 “Hosting” for further information.

Bunny.net is a recipient of your personal data and acts as a processor for us. This corresponds to our legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR in not operating a Content Delivery Network ourselves.

You have the right to object to the processing. Whether the objection is successful must be determined in the context of a balancing of interests.

The processing of the data specified in this section is neither legally nor contractually required. The functionality of the website is not guaranteed without the processing.

According to Bunny.net, connection data on the edge servers is kept in memory for only 20 to 30 seconds and is not stored permanently.

For more information on how to object to and remove data from Bunny.net, please visit: Bunny.net DPA / GDPR

Bunny.net is based in the EU. For our website and app we have enabled only edge locations and storage in the EU, so your data is not transferred to third countries. For more information on Bunny.net’s sub-processors, please visit: Bunny.net GDPR & Sub-processors

19. Public Club Profiles

Ace operates a directory of tennis clubs. For clubs that have not yet claimed their profile, we create a profile containing organisation-related information (club name, address, club phone number, club email address, website, number and type of courts, opening hours).

Source: This information comes from publicly accessible sources such as club websites and federation or club directories. On unclaimed profiles we do not publish information about individuals such as contact persons, board members or members. If a public source contains a personal contact detail (for example a personalised email address), it can be reported to us and removed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a findable directory of tennis clubs that helps players find clubs near them. The processing is limited to organisation-related data.

You have the right to object to this processing under Art. 21 GDPR and to request rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR). Clubs can claim their profile and maintain it themselves. You can request a correction, removal or objection via the form at /inhalte-melden or by email to admin@playace.de.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

21. Changes to This Policy

We update this privacy policy when our processing activities or legal requirements change. The current revision date appears at the beginning. We communicate material changes appropriately, including by email or within the service where necessary. Where consent is required, we obtain it separately; continued use alone does not constitute consent.