Privacy notice

1. Controller and scope

The controller is Oliver Reifgens, trading as ÉliteReplay, Calle Tarabilla 1, C 48, 35660 Corralejo, Las Palmas, España. Contact for privacy questions and data-subject rights: contact@elitereplay.de.

This notice applies to https://elitereplay.de, the contact channels offered there and evidenced delivery functions on this domain. A specific club, event, MatchBoard deployment, recording, app or Wallet pass may require additional notices that take precedence for that processing.

2. Service boundaries

3. Website requests and hosting

• Data: IP address, requested path, time, HTTP request and response data, and technical browser, device, referrer and error information to the extent transmitted during access or recorded by the host.
• Purpose: website delivery, stability, error diagnosis, and detection of misuse and attacks.
• Legal basis: Article 6(1)(f) GDPR; the legitimate interest is secure and reliable website operation.
• Recipient: Vercel Inc. and its subprocessors as hosting and infrastructure providers.
• Retention: Vercel makes runtime logs available for the plan- and feature-dependent availability period. The website code sets no additional log period or separate log archive. Logs preserved for a specific incident are kept beyond that only for as long as necessary to investigate and pursue legal claims.
• Provision: this technical data is necessary to retrieve the website; without it the website cannot be transmitted.

4. Contact and club-pilot enquiries by email

• Data: name, email address, club or organisation, role, location, number of courts, requested use case, message and email communication metadata.
• Flow: the website form sends nothing to a web server. It creates a draft in your browser, which you send yourself using your email application. Only sending the email transmits the details.
• Required information: name, club or organisation and email address are required for the prepared draft; role, location, court count, use case and message are optional. Without the required details the form cannot create a meaningfully addressed draft; you may instead write directly to contact@elitereplay.de.
• Purpose and legal basis: answering the enquiry and taking pre-contractual steps under Article 6(1)(b) GDPR; for enquiries made on behalf of an organisation, also Article 6(1)(f) GDPR and the interest in business communication.
• Recipients: your email provider, united-domains GmbH as provider of the ÉliteReplay mailbox, and only those people within ÉliteReplay who handle the enquiry.
• Retention: the website does not store the draft. Sent messages remain until the enquiry is complete and, where a contract or evidential record results, for the applicable statutory documentation and limitation periods in the mailbox or backups. The basis is Article 6(1)(c) GDPR for legal duties and Article 6(1)(f) GDPR for evidence and legal defence. No automatic deletion period is evidenced.
• This form does not create an automatic newsletter subscription. Electronic marketing is sent only where there is an applicable legal basis and can be stopped at any time free of charge.

5. PadelHouse enquiries through WhatsApp

• Data: name and email address, plus optional playing level and preferred month. If you open WhatsApp or send the message, WhatsApp also processes in particular your phone number, profile information, message and communication metadata, and device, connection and usage data under its own policy.
• Flow: only after your action does the PadelHouse form open a prepared wa.me link. The entered details are then passed to WhatsApp; you decide there whether to send the message.
• Required information: name and email address are required for the prepared text; playing level and preferred month are optional. The form cannot be submitted without the required details. You may use contact@elitereplay.de as an alternative without WhatsApp.
• Purpose and legal basis: handling the requested pilot-camp enquiry and pre-contractual steps under Article 6(1)(b) GDPR.
• Recipients: WhatsApp Ireland Limited and the other Meta companies and providers named in WhatsApp's privacy policy. Alternative without WhatsApp: contact@elitereplay.de.
• Retention: ÉliteReplay retains the chat according to the same criteria as an enquiry. Additional storage by WhatsApp is governed by WhatsApp's settings, contracts and notices; ÉliteReplay cannot promise its own fixed deletion period for that storage.
• WhatsApp privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

6. Experimental session start

A published technical start route is a demo/pilot implementation, not evidence of a production recording or highlight system. If used, it processes email address, court ID, session code, creation time, status, and technically empty highlight/consent fields.

• Purpose and legal basis: creating the expressly requested test session, Article 6(1)(b) GDPR.
• Recipient: Vercel Inc. as hosting provider; access via the generated session link.
• Required information: a valid email address and an enabled court ID are technically required. No test session is created without them.
• Retention: the code uses a JSON file without an automatic deletion routine. This flow therefore must not be presented as a production service with a fixed period; storage location, period and deletion process must be set before production use.
• Browser storage: after this correction, the email address is no longer saved in localStorage for later visits.

7. Highlight and media delivery by link

• Data: released video and image files and, if present in the relevant dataset, match ID, title, names or display names, team/court assignment, score and moment information.
• Purpose and legal basis: providing agreed match or camp moments. Where personal delivery is part of an offer requested by the data subject, Article 6(1)(b) GDPR applies. Recording, publication and marketing are separate and, in consent-based setups, may take place only on the basis of separate consent under Article 6(1)(a) GDPR. Club or event engagements must define the responsibility roles and any different basis in their participant notice.
• Recipients and access: Vercel Inc. for the website and Vercel Blob, plus anyone who receives or guesses a delivery or direct Blob URL. The highlight and match routes have no sign-in and some IDs are predictable. The camp link key is an access hurdle, not personal authentication. The URLs must therefore not be understood as private or restricted exclusively to authorised recipients.
• Retention: the website code configures neither automatic deletion nor a fixed period for Blob files. Files remain available until manually deleted. A specific deletion date for each delivery and an operational deletion process are not yet evidenced; legal evidence or defence needs may justify limited further retention.
• Use for public club communications, sponsorship or other marketing takes place only on the basis of a separate, purpose-specific decision and never merely because someone visited the website.

8. Cookies, browser storage, analytics and embedded media

• Language: the language is part of the URL path. The NEXT_LOCALE cookie that was previously set by default is disabled in the corrected configuration.
• Web Analytics: the website uses Vercel Web Analytics for aggregated audience measurement based on our legitimate interest in operating a technically and editorially appropriate website (Article 6(1)(f) GDPR). Page views and technical data such as URL or route, referrer, filtered query parameters, approximate city and country, browser, operating system and device type are processed. Vercel describes the measurement as cookie-free and without a persistent identifier usable across people or websites; a visitor identifier derived from the request is discarded after 24 hours. The recipient is Vercel Inc. No advertising or profiling tags are used. Provider information: https://vercel.com/docs/analytics/privacy-policy.
• Browser storage: the experimental start page no longer stores the email address persistently in the browser. No other non-essential storage is evidenced on the reviewed active pages.
• Media: general website images and videos are delivered by the site's hosting infrastructure. On unlocked camp pages, previews and videos load from Vercel Blob. WhatsApp opens only following a deliberate click.
• If non-essential cookies, SDKs or trackers are added later, they will be blocked before consent and offered with an equally prominent reject option; this notice alone would not be sufficient.

9. Recipients and international transfers

Vercel Inc. is a US provider. Vercel states that it uses the EU-US Data Privacy Framework for covered transfers to the United States and the 2021/914 EU Standard Contractual Clauses otherwise. Primary processing may take place in the United States. Provider information: https://vercel.com/legal/privacy-notice and https://vercel.com/legal/dpa.

Within the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited. WhatsApp describes global processing, including in the United States, and identifies the EU-US Data Privacy Framework and EU Standard Contractual Clauses as applicable transfer mechanisms. Details: https://www.whatsapp.com/legal/privacy-policy-eea.

ÉliteReplay does not assume processing restricted exclusively to the EEA. The Vercel region and subprocessors used depend on the account and Blob configuration; the current provider documents linked above apply. A person outside the EEA merely accessing the public website is not in itself a disclosure initiated by ÉliteReplay to a provider in that country.

10. Security, sources and automated decisions

ÉliteReplay takes technical and organisational measures appropriate to the risk. We do not claim absolute security, end-to-end encryption for every processing step, regular audits, or an exclusively local processing location.

Data generally comes from you, your browser or – in a specific match/club setup – the participating club, organiser, MatchBoard and recording devices. If data is not obtained directly from you, the relevant product or event notice must also identify the source and categories.

The website makes no solely automated decisions that produce legal or similarly significant effects and carries out no profiling. The website does not process payments.

11. Your rights, withdrawal and complaints

• Subject to the GDPR's conditions, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability.
• You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation; you may object to direct marketing at any time.
• You may withdraw consent at any time free of charge and with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.
• To exercise your rights, send a message to contact@elitereplay.de. Where there are reasonable doubts, we may request only the additional information needed to verify identity.
• You may complain in particular to the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD): https://www.aepd.es. You may also contact the supervisory authority at your habitual residence, place of work, or the place of the alleged infringement.

12. Minors

There is no blanket age limit for merely reading the website. Contact, contracting, match participation, recordings, image rights and consent-based purposes must each be assessed for the specific service and applicable law. Where minors are recorded or receive their own service, the relevant club, event or app notice must address the required involvement of a parent or guardian.

13. Changes to this notice

We update this notice when evidenced data flows, providers or legal requirements change and publish the new date. Continued use alone is not consent. If consent is required for a new purpose, it will be requested separately.