Privacy Policy
This policy explains what personal data BuscoPadel processes, why, for how long and what rights you have over it. It applies to the BuscoPadel app (iOS, Android and the web version at app.buscopadel.com), to the API that powers it (api.buscopadel.com) and to the website buscopadel.com.
We have tried to write it in plain language. If anything is unclear, write to us.
1. Data controller
- Owner: Ángel Carracedo Ureña
- Tax ID (NIF): 53079120L
- Address: Carrer Pompeu Fabra 8, 08390 Montgat (Barcelona)
- Privacy contact email: info@buscopadel.com
We have not appointed a Data Protection Officer because, given the type and volume of processing, the law does not require one. For any privacy matter, use the email above.
2. What data we process
When you create an account with your email
| Data | Required | Why |
|---|---|---|
| First name and surname | Yes | To identify you within the app |
| Email address | Yes | To sign you in, verify your account and send you service notices |
| Password | Yes | To protect your account. We only store an irreversible digest (hash), never the password itself |
| Date of birth | Yes | To know your age, so we can organise competitions by age category (for example, a youth league) and protect minors in features where players communicate with each other |
| Permission to receive news and offers | No | If you give it, to send you those emails. We store when you gave it, when you withdrew it if you do, and the version of these texts in force |
| Language | Automatic | To write to you in your language (Spanish, Catalan or English) |
| Date and version of the legal texts you accepted | Automatic | To be able to prove what you accepted and when |
When you sign in with Google, Apple or Facebook
If you choose one of these providers, we receive from it your account identifier with that provider, your name and your email address. We use them to create your account or sign you in, just as if you had registered with your email.
- We do not receive or store your provider password or its access credentials.
- Apple lets you hide your real email ("Hide My Email"). In that case we receive a forwarding address created by Apple and never learn your real email.
- The provider processes your data under its own privacy policy: Google, Apple, Meta (Facebook).
While you use the service
- Open sessions: when you sign in, we create an access credential for your device, together with the device name sent by the app (currently just the platform type: iOS, Android or web). The session does not store your IP address or your location.
- Email change: while you confirm a new email address, we store it as "pending" alongside your current one.
- Security: to stop attacks (for example, repeated attempts to guess a password), we use your IP address at the time of the request. It is only stored as an irreversible digest (hash), on its own or combined with the email address, for a maximum of 24 hours.
- Technical logs: the server logs errors and requests, which may include your IP address, in order to fix faults and detect abuse.
News and offers (only if you allow it)
You can allow us to email you BuscoPadel news and offers for tournaments and leagues.
- It is optional. You do not need it to use the service, and saying no costs you nothing.
- You can allow it when you create your account or at any time from My account in the app.
- You can withdraw it whenever you want from the same place, with no explanation. Withdrawing it is as easy as giving it.
- If you withdraw it, you will still receive the emails the service needs: verifying your account, confirming an email change and recovering your password. Those are not advertising and do not depend on your permission.
- We store the date you allowed it, the date you withdrew it and the version of these texts in force at the time, so we can show what you allowed and when.
What we do not do
- We do not send you advertising unless you have allowed us to, and you can withdraw that permission whenever you want.
- We do not build commercial profiles or make automated decisions about you.
- We do not sell or share your data with third parties for their own purposes.
- We do not use analytics or tracking tools, either in the app or on the website.
- We do not access your location, contacts or photos.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account and providing the service | Performance of the contract you accept when registering (Art. 6(1)(b)) |
| Sending you the emails the service needs: account verification, email change confirmation and password recovery | Performance of the contract (Art. 6(1)(b)) |
| Sending you news and offers by email | Your consent (Art. 6(1)(a)), which you can withdraw at any time. Also Art. 21 of Spanish Law 34/2002 (LSSI) |
| Protecting accounts and the service against abuse and attacks | Legitimate interest in keeping the service secure (Art. 6(1)(f)) |
| Keeping proof of which texts you accepted and when | Compliance with legal obligations and legitimate interest in defending ourselves against claims (Art. 6(1)(c) and 6(1)(f)) |
4. How long we keep it
| Data | Period |
|---|---|
| Account that is never verified | Deleted 7 days after registration |
| Data of an active account | For as long as you keep it |
| When you delete your account | Your personal data (name, surname, email, date of birth, password and sessions) is deleted immediately |
| Anonymised record of the deletion | We keep a record with no identifying personal data (an internal number, the language, the version of the texts accepted and the dates). It serves as proof of consent for as long as claims can be brought |
| Dates and version of your permission to receive advertising | While you keep your account and, after deletion, in the anonymised record, as proof of what you allowed |
| Open sessions | Until you sign out or they are closed for security reasons (see section 8) |
| Verification, email change and password recovery links | Expire after 60 minutes |
| Technical logs | 14 days |
| Backups | They are overwritten on a rolling basis: deleted data disappears from them within 30 days at most |
5. Who we share data with
Only with the providers we need in order to run the service. They process data on our behalf and following our instructions (data processors):
- Server hosting: IONOS Cloud S.L.U., with servers in the European Union
- Email delivery: IONOS Cloud S.L.U.
In addition:
- Google, Apple and Meta, only if you choose to sign in with them (see section 2).
- Leaked password check: when you choose a password, we check whether it appears in public data breaches using the Have I Been Pwned service. Only the first 5 characters of an irreversible digest (hash) of the password are sent, never the password or any of your data, so the service cannot tell whose it is.
- Authorities, when the law requires it.
International transfers
Your data is hosted on servers located in the European Union, so we do not transfer it outside the EU. Google, Apple and Meta may process data in the United States. These companies participate in the EU-U.S. Data Privacy Framework, which the European Commission considers an adequate safeguard.
6. Age
There is no minimum age for a BuscoPadel account. Padel is played at any age, and children play at clubs from a very young age.
If the player is under 14, the account must be created and managed by their parent or legal guardian, who accepts these texts on their behalf and is the account holder. Spanish law (LOPDGDD, Art. 7) requires that authorisation for a child of that age to give valid consent.
If we become aware that an account belonging to a child under 14 was created without that authorisation, we will get in touch to obtain it and, if we cannot, we will delete the account.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. To do so, write to info@buscopadel.com from your account's email address. We will reply within one month at the latest.
- You can delete your account directly from the app. See Delete your account.
- If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
8. Security
- Communications are encrypted (HTTPS).
- Passwords are stored using an irreversible hashing algorithm.
- On mobile, the session credential is stored in the system's secure storage (iOS Keychain or Android Keystore).
- Signing out closes the session on that device. Changing your password closes the sessions on your other devices. Resetting your password, confirming an email change or deleting your account closes all of them.
9. Changes to this policy
Each version of this policy is dated and previous versions are kept. New versions are published here with their effective date. If a change significantly affects how we process your data, we will also let you know by email or in the app.