At Pong City, we respect your privacy. This Policy explains what personal data we process through the website. pongcitytm.com and the mobile application PongPlay, for what purpose, on what legal basis and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
1. Data Controller
- Responsible: SEVILLA TENIS DE MESA CITY, SL — NIF/CIF B10637932
- Home: Avda. La Prensa, 10, 41007 Sevilla (Sevilla), España
- Contact / Data Protection Officer: miembros@pongcitytm.com
2. What data do we collect and on what legal basis?
We apply the principle of data minimization (art. 5.1.c GDPR): we only collect what is necessary for each purpose.
a) Required information when registering on PongPlay
Name, email address, password (encrypted) and birthdate.
Legal basis: consent (Art. 6.1.a) and performance of the contract (Art. 6.1.b). The date of birth is also considered for the fulfillment of a legal obligation protection of minors (art. 6.1.c GDPR, in relation to art. 8 GDPR and art. 7 LOPDGDD).
b) Optional profile data
Phone number, profile picture, gender, height, and weight. We only process them. if you decide to provide them (for example, height and weight for sports functions such as matchmaking by physical division).
Legal basis: consent (art. 6.1.a).
c) Billing details
Address, postal code, city, province, country and NIF/DNI. We collect the NIF/DNI (Spanish tax identification number/national identity document). only when you request an invoice for the contracted services; it is not used for any other purpose.
Legal basis: legal obligation (art. 6.1.c GDPR and Royal Decree 1619/2012, billing regulations).
d) App usage data
Table reservations, registration and participation in tournaments, matches, ranking (ELO) and attendance at events.
Legal basis: execution of the contract (art. 6.1.b).
e) Community and chat
Posts, comments and messages you send, and moderation reports.
Legal basis: execution of the contract (art. 6.1.b) and legitimate interest in the safety of the community (art. 6.1.f).
f) Security and access
IP address, browser/device type (user agent), passkeys and recovery codes, and access logs.
Legal basis: legitimate interest in security (art. 6.1.f) and legal obligation (art. 6.1.c).
g) Push notifications
Device identifier (token), platform (Android/iOS) and device name.
Legal basis: consent (art. 6.1.a) and execution of the contract (art. 6.1.b).
h) Website contact form and commercial communications
Name, email, city/headquarters and message to address your requests; and your email to send you updates if you authorize it.
Legal basis: consent (art. 6.1.a). We do not send commercial communications to minors.
i) Club membership
Identification and payment data, managed by CrossHero and Stripe. Card details are processed directly by Stripe and they are not stored on our servers.
Legal basis: execution of the contract (art. 6.1.b).
3. Minors
The minimum age to register is 14 years old (Art. 8 GDPR and Art. 7 LOPDGDD). To protect minors, the app actively restricts social functions To individuals under 18 years of age: you may not use the chat, post in communities, or receive challenges from other players. We also do not direct commercial communications to minors. If we detect false age information, we may verify the age and, if necessary, close the account (see Terms and Conditions).
4. Consent and proof
When you register, we collect your consent in a explicit and separate through unchecked boxes (one for the Terms and one for this Privacy Policy). We retain the date and time of acceptance as proof of consent (Art. 7 GDPR). You can withdraw your consent at any time, without affecting the lawfulness of the processing prior to withdrawal.
5. Storage periods
- Billing information: 4 years, in accordance with the tax statute of limitations.
- Profile and account details: as long as you maintain your account and up 30 days after you unsubscribe (for reversal processes), except for what the law requires to be kept for a longer time.
- Age verification document: It is removed immediately after checking the age.
6. Recipients and processors of the data
We do not share your data with third parties except where legally required. They may access it, such as those responsible for the treatment under contract (Art. 28 GDPR): Hostinger (hosting of the website pongcitytm.com), Google Cloud Platform (cloud infrastructure where the PongPlay app is hosted), Google Firebase (push notifications), Stripe (payments), CrossHero (club subscriptions), Resend or another email provider (sending emails), Sentry (error monitoring) and, where applicable, Amazon S3 (storage). To generate default avatars, the following is used ui-avatars.com, to which your name is sent.
7. International Transfers
If any provider processes data outside the European Economic Area, it will be done with appropriate safeguards (standard contractual clauses or other valid mechanisms).
8. Your rights
You can exercise your rights to access, rectification, erasure, objection, restriction and portability, as well as withdraw your consent, by writing to miembros@pongcitytm.com. At PongPlay you can also Export your data and delete your account yourself from Profile → Privacy and data. You have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
We apply appropriate technical and organizational measures (password encryption, passkey authentication, access control) to protect your data against unauthorized access, loss, or alteration.
10. Changes
We may update this Policy. We will post any changes on this page with their update date.