Privacy Policy

Last updated: 03/10/2026

This policy explains how personal data is processed when you use CtrlCourt, an online booking and management software for padel clubs, and our website ctrlcourt.com. We apply the General Data Protection Regulation (GDPR) and, where relevant, equivalent local laws.

1. Who is responsible for your data?

It depends on who you are:

• Clubs, club managers and administrators (our customers) and visitors to our website: DEVBOX is the controller of your data (account, subscription, billing, support, website).
• Players, coaches and staff of a club who use a club's booking space: the club is the controller of your data. It decides why and how your data is used. DEVBOX only acts as a processor on the club's behalf (Article 28 GDPR), under our Data Processing Agreement. The club's own privacy notice applies to you, and you should contact your club first to exercise your rights; we help the club respond.

Publisher and controller for the data described in point 1, first bullet:

2. Data we collect

Clubs and club managers

• Identity and contact details: name, business email, phone number, role within the club.
• Club information: club name, address, courts, opening hours, logo and colours, settings.
• Subscription and billing data: plan, invoices, billing address, VAT number, payment status. Payment details are collected and processed directly by Paddle, our reseller and Merchant of Record; we only receive technical information (e.g. card brand, last four digits, expiry date).
• Support exchanges and emails you send us.
• Technical and security data: IP address, login dates and times, browser, error and security logs.

Players, coaches and club staff (processed on behalf of the club)

• Account data: name, email address, phone number, password (stored in hashed form), optional playing level, role.
• Activity within the club: bookings, coaching sessions and courses, event registrations, prepaid credit (token) balance and transactions, payment method recorded by the club (cash, card at the counter, credits).
• For coaches: availability, bio, hourly rate.
• Technical data: IP address, connection logs, language preference.

We do not collect any payment card data from players: players pay their club directly.

Website visitors

Technical data required to display the site (IP address, browser, pages requested) and the data you enter in the forms (e.g. sign-up form).

Chat assistant: if you use the chat on our website, we process the questions you type and the answers given, to answer you and improve the information we provide. Please do not enter sensitive data in the chat.

3. Purposes and legal bases (where we are controller)

We do not sell personal data. Apart from measuring our own ads as described above, we do not use it for advertising. For players' data, we only process it on the club's documented instructions, to provide the Service to the club.

4. How long we keep data

• Account and club data: as long as the account is active, then 30 days after the end of the subscription or of an unconverted trial, after which it is deleted (backups are overwritten in their normal rotation cycle).
• Invoices and accounting records: 10 years, or the period required by the applicable law.
• Security logs: 12 months.
• Support exchanges: for the duration of the business relationship, then as long as necessary to handle any claim.
• Players' data: as defined by the club; in any case deleted with the club's data at the end of the contract as described above. A player's account may be deleted earlier by the club.
• Chat assistant conversations: 90 days.
• Google click identifier (gclid) of a club that came from an ad: 90 days after the club is created.

5. Recipients and sub-processors

Data is only accessible to authorised persons at DEVBOX who need it, to the club concerned (for its own data) and to the following service providers, bound by confidentiality and data protection obligations:

We may also disclose data where required by law or by a competent authority.

6. Transfers outside the European Union

The application and its databases are hosted in France. Some providers may process data outside the European Economic Area:

• Paddle may transfer billing data outside the EU (in particular to the United Kingdom and the United States).
• When a club enables online payment of bookings, players' payment data is processed by the club's own Stripe account, for which the club is responsible; Stripe may transfer this data to the United States. These transfers are governed by the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
• Google Fonts: fonts are loaded from Google's servers when pages are displayed, which means your IP address and browser information are sent to Google, which may process them in the United States. These transfers are governed by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
• Anthropic processes the messages typed in the website chat assistant in the United States, under the European Commission's Standard Contractual Clauses.
• Google Ads: the click identifiers sent to measure our ads may be processed by Google in the United States, under the Standard Contractual Clauses and, where applicable, the Data Privacy Framework.

7. Security

We implement appropriate technical and organisational measures, including: encrypted connections (HTTPS), a separate database for each club, passwords stored in hashed form, regular backups, access restricted to authorised persons, and monitoring of security logs. No system is completely secure, but we work to protect data against loss, misuse and unauthorised access. In the event of a personal data breach, we act in accordance with the GDPR.

8. Cookies

We only use cookies set and read by our own website:

• session cookie (keeps you logged in and remembers your navigation);
• CSRF security token (protects forms against malicious requests);
• language preference;
• origin cookie (90 days, public pages of the CtrlCourt website only): the link or website your first visit came from (for example a Google ad and the identifier of that click), to know which channels bring clubs.

We do not load any third-party advertising script or audience measurement tool (no Google Ads tag, Google Analytics or social network pixel). Session, security and language cookies are essential to the Service and do not require your consent. You can block cookies in your browser; the origin cookie is not needed to use the website, the others are.

9. Your rights

Under the GDPR, you have the right to:

• access your data and obtain a copy;
• have inaccurate data rectified;
• have your data erased;
• restrict the processing;
• data portability;
• object to processing based on our legitimate interest.

Clubs, managers and visitors: send your request to contact@ctrlcourt.com. We may ask for proof of identity if we have reasonable doubts. We respond within one month, which may be extended in the cases provided for by law.

Players, coaches and club staff: please contact your club, which is the controller of your data. If you write to us, we will forward your request to the club and help it respond.

You also have the right to lodge a complaint with a supervisory authority, in particular the one in your country of residence or place of work: for example the CNIL in France (www.cnil.fr), the AEPD in Spain (www.aepd.es), the Data Protection Authority in Belgium, or the ICO in the United Kingdom.

10. Changes

We may update this policy. The date at the top of the page indicates the latest version. Significant changes will be notified to clubs by email or in their administration area.

11. Contact

For any question about this policy or your data: contact@ctrlcourt.com.