PRIVACY POLICY
INFORMATION NOTICE PURSUANT SECTION 13 AND 14 OF REGULATION (EU) 2016/679
Dear User,
in compliance with Sections 13 and 14 of Regulation (EU) 2016/679 (so called GDPR), Playtomic S.L. informs you about the processing of your personal data.
Who will process your personal data?
Your personal data will be processed by Playtomic S.L. (hereinafter, also “Playtomic”), with registered office in 28046 Madrid (Madrid), Paseo Castellana (ed Cadagua), 93 - 10, Spain, which will act in quality of “Data Controller”; you will be able to contact the Data Controller at the following email address: privacy@playtomic.io.
Personal data can be processed in the name and on behalf of Playtomic also by others subjects who will be duly appointed “Data Processors“, belonging to the following categories: hosting providers, software providers, social networks. The list of the Data processors is at your disposal, under request.
The Data Controller has also appointed a Data Protection Officer (called DPO), contactable to the email address: dpo@playtomic.io.
How and why we will process your personal data?
Your data will be processed for specific purposes pertaining different field of activities. Namely:
(i) Navigation on the site www.playtomic.io
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Creating account, login and management of your profile and role | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW1
PW6 |
Making a user member of a private club | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW2 |
Making a reservation | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW3 |
Consulting all users’ bookings | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW4 |
Buying club offers | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW5 |
Customer support Chat | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last access | PW7 |
Facilitation in navigation | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Legitimate Interests | Up to the end of the session | PW8 |
Contact form | Name,
Surname,
E-mail,
Phone number,
Cookies and IP Address (PW8),
City,
Country | Execution of a contract | 10 years from the last contact | PW9 |
(ii) Usage of the mobile app “Playtomic”
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Creating account, login and management of your profile and role | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA1, PA11 |
Making a user member of a private club | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA2 |
Making a reservation | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA3 |
Organizing public matches (name, surname and statistics will be visible to other users) | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA4 |
Providing a group chat related to the match | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA5 |
Organizing classes | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA6 |
Organizing tournaments | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA7 |
Contact List / Accessing your mobile agenda to (i) invite your
contacts to join activities (tournaments and
matches) (ii) find friends already registered in
Playtomic with the purpose to add them to
activities and to your community. The data will
not be stored in our system; by giving the
consent, you also confirm to have the
authorization of your friends to share their data
with Playtomic. | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Consent | Up to the withdrawal of the consent | PA7.1 |
Providing a private chat service between users | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA8 |
Calculating and publishing the ranking of the user | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Consent | Up to the withdrawal of the consent | PA9, PA10 |
Allow club managers to access the chat related to the matches for organizational reasons | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Consent | Up to the withdrawal of the consent | PM3, PM4 |
Purchase of a premium profile by the user (the person will be identifiable as a premium user by means of a specific indicator) | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA12 |
In public activities, the phone number of the organizer will be shared with people enrolled in the specific activity. | Name, Surname, Image, Gender, E-mail, Phone number, Level (PA1), Fitness evaluation (PA2), Credit Card information (PA2 – PA3 – PA4), Agenda (PA7.1), Level / Ranking (PA8 – PA9 – PA10) | Execution of a contract | 10 years from the last access | PA13 |
(iii) Marketing purposes
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Marketing communications | Name, E-mail, User behaviour data (M2) | Consent | Up to the withdrawal of the consent | M1 |
Analysys of users behaviour | Name, E-mail, User behaviour data (M2) | Consent | Up to the withdrawal of the consent | M2 |
Sending random questionnaires | Name, E-mail, User behaviour data (M2) | Consent | Up to the withdrawal of the consent | M3 |
Data transfer to social networks (e.g. Facebook, Instagram etc) for sending, on behalf of Playtomic, commercial or advertising communications to the customers. | Name, E-mail, User behaviour data (M2) | Consent | Up to the withdrawal of the consent | M4 |
Social Media Marketing (Interaction with the customers on the Facebook and Instagram fan page of Playtomic). Please consider that, with reference to the function “Insight” of Facebook, related to your visit statistics, we are joint controller with Facebook Ireland Limited (“Facebook Ireland”). | Name, E-mail, User behaviour data (M2) | Consent | Up to the withdrawal of the consent | M5 |
(iv) Notifications
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Under consent, Playtomic will send to your email address communications related to your Playtomic experience. The notifications will be delivered in the case an event occurred in relation to (i) Application process (ii) Booking (iii) Payment (iv) Tournaments (v) Classes (vi) Leagues (vii) Matches | Name, Surname, E-mail, Phone number | Consent | Up to withdrawal of the consent | NE |
Under consent, Playtomic will send to your device push communications related to your Playtomic experience. The notifications will be delivered in the case an event occurred in relation to (i) Booking (ii) Chat (iii) Matches (iv) Community interactions | Name, Surname, E-mail, Phone number | Consent | Up to withdrawal of the consent | NP |
Under consent, Playtomic will send to your phone number SMS communications related to your Playtomic experience. The notifications will be delivered in the case an event occurred in relation to (i) Application process (ii) Booking | Name, Surname, E-mail, Phone number | Consent | Up to withdrawal of the consent | NS |
(v) Customer success
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Customer support via chat | Name, E-mail, Phone number | Execution of a contract | 10 years from the last access | CS1 |
Customer experience (through random questionnaires) | Name, E-mail, Phone number | Consent | Up to withdrawal of the consent | CS2 |
Whatsapp Communications | Name, E-mail, Phone number | Consent | Up to withdrawal of the consent | CS3 |
(vi) Community
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Supply of a social platform for autonomous interaction between users | Name, City, Social interactions (Comments, likes, tags) | Execution of a contract | Until the user asks for the removal of the account | COM1 |
Automatic sharing of contents | Name, City, Social interactions (Comments, likes, tags) | Consent | Up to withdrawal of the consent | COM2 |
(vii) Other processings generally applicabile
PURPOSE | CATEGORIES OF PERSONAL DATA | PRINCIPLE OF LAWFULNESS | PERIOD OF STORAGE | REFERENCE ON RECORDS OF PROCESSING ACTIVITY |
Research and Development of new products / features | Name, Surname, E-mail, Phone number | Legitimate interest | Up to the end of the intervention | RD1 |
Maintenance, operation and security of IT services | All your personal data | Legitimate interest Legal obligation | Up to the end of the intervention | CT1 |
Identification, analysis and management of company data for a proper performance of the business | Name, Surname, E-mail | Legitimate interest | Up to the end of the intervention | B1 |
Furthermore, please take in due consideration the following information:
DATA PROVISION | In all those cases in which we ask for consent to the processing of your personal data, their provision is purely optional. Consequently, failure to provide your personal data will have no consequences, other than in terms of the impossibility of processing the data for such specific purposes.
In all other cases where we do not ask for consent to the processing of your personal data, their provision is mandatory and necessary to comply with contractual or legal provisions and for the purpose of the proper conduct of business. Consequently, failure to provide such information would not make it possible to comply with these requirements and to carry out business activities properly. |
CATEGORIES OF RECIPIENTS | In addition to the Data Processors above mentioned, your personal data will be shared with:
(i) the club managers related to your booking;
(ii) subsidiaries and affiliates companies. |
AUTOMATED DECISION- MAKING PROCESS | There are no automated decision-making procedures. |
TRANSFERS EXTRA EU OR TO INTERNATIONAL ORGANIZATIONS | Some Data Processors, in providing their services to the Data Controller, may transfer your personal data to servers located in non-EU territory. Please note that not all non-EU countries guarantee the same European safety standards; by giving consent to the processing of your data, where applicable, you also consent to their transfer to servers located in these territories. |
LEGITIMATE INTEREST OF DATA CONTROLLER | The legitimate interest of the Data Controller indicated for the following purpose:
(i) Facilitation in navigation / cookies (ref.PW8): is the correct and fluid operation of the site;
(ii) Research and Development of new products / features (ref. RD1) and Identification, analysis and management of company data for a proper performance of the business (B1): is the ordinary interest in the evolution of the company;
(iii) Maintenance, operation and security of IT services (ref. CT1): is the proper and safe conduct of the business activity. |
SOURCE ORIGINATING THE DATA | Your data could be provided by subsidiaries or affiliated companies (e.g. PrenotaUnCampo), IT providers (e.g. Google Login) and social networks (e.g. Facebook Login, Fan Page). |
Which are your rights?
You can exercise the following rights by sending a specific request to the Data Controller at the following email address: privacy@playtomic.io
RIGHT | DESCRIPTION |
ACCESS (see Article 15 GDPR) | The data subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him are being processed, and, where that is the case, access to the personal data and to the following information: purpose of management, categories of processed data, recipients (if any), transfer and adequate guarantees (if any), period for which personal data will be stored, rights of data subjects, existence of an automated decision-making process (if any). The Data Controller provides a copy of personal data. If the request is made by electronic means, information are supplied in a commonly used electronic format, unless otherwise indicated. |
RECTIFICATION (see Article 16 GDPR) | The data subject has the right to obtain the rectification of wrong personal data and the integration of incomplete personal data. |
ERASURE (see Article 17 GDPR) | The data subject shall have the right to obtain from the Data Controller the erasure of his personal data in the following cases: the personal data are no longer necessary in relation to the purpose for which they were collected or otherwise processed, withdrawal of consent (and there is no other legal bases for the processing), he opposes the processing for the reasons related to his particular situation (and the are no overriding legitimate grounds for the processing), he opposes the processing for direct marketing purposes, the personal data have been unlawfully processed, the personal data have to be erased for compliance with legal obligation, the data have been collected in relation to the offer of information society services. The right shall not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purpose in the public interest, scientific and historical research purpose or statistical purpose, for the establishment, exercise or defence of legal claim. |
RESTRICTION OF PROCESSING (see Article 18 GDPR) | The data subject shall have the right to obtain from the Data Controller the restriction of processing if: the accuracy of the personal data is contested by the the data subject (for a period enabling the Controller to verify the accuracy), the processing is unlawful (but the data subject opposes the erasure of the personal data and requests the restriction of their use rather than erasure), the personal data are required by the data subject for the establishment, exercise or defence of legal claim e, although the Data Controller no longer needs it, he exercised the right to object (while the Data Controller verifies the existence of legitimate and prevailing reasons). |
OBJECTION (see Article 21 GDPR) | The data subject shall have the right of object to processing of personal data if (i) it is based on public interest or legitimate interest and (ii) if personal data are processed for direct marketing purpose, including profiling. |
DATA PORTABILITY (see Article 20 GDPR) | The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data Controller, in a structured, commonly used and machine- readable format (applicable to automated decision- making processes). |
WITHDRAWAL (see Article 13, d.2, d) | The data subject has the right to withdraw the consent any time without affect the lawfulness of processing based on the consent before withdrawal. |
COMPLAINT (see Article 13, d.2, d) | The data subject has the right to pledge a complaint with a supervisory authority. |
Trustly,
Playtomic S.L..
Accessing your mobile agenda to (i) invite your
contacts to join activities (tournaments and
matches) (ii) find friends already registered in
Playtomic with the purpose to add them to
activities and to your community. The data will
not be stored in our system; by giving the
consent, you also confirm to have the
authorization of your friends to share their data
with Playtomic.