Privacy Policy
Effective Date: September 2, 2026
Last Updated: September 2, 2026
This Privacy Policy explains how UP PADEL CORP, a Delaware corporation with its principal place of business in Southampton, New York, doing business as World Padel Rating (“World Padel Rating,” “WPR,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information about players who use the World Padel Rating mobile application and the player-facing website at worldpadelrating.com (together, the “Player App”).
World Padel Rating also operates a separate portal for club directors and tournament organizers, called WPR Manager. WPR Manager is governed by its own privacy policy. If you are a club director or tournament organizer, please refer to the WPR Manager Privacy Policy.
This policy applies to personal information we process as a controller, meaning we determine the purposes and means of the processing. It describes the choices and rights available to you and how to exercise them. Please read it together with our Terms of Use.
If you do not agree with this policy, please do not use the Player App. Your use of the Player App does not by itself constitute consent to all processing described here; where the law requires consent for a particular use, we ask for that consent separately and you may decline or withdraw it as described in this policy.
Contact at a Glance
You can reach us about this policy or your personal information using the details below.
Email: support@worldpadelrating.com
Mail: UP PADEL CORP World Padel Rating, 580 North Sea Mecox Road, Southampton, NY 11968, United States
1. Personal Information We Collect
We collect the categories of personal information described below. The category names in parentheses are the categories used in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), so that California residents can match what we collect to their statutory rights.
| Category | Examples | CCPA category |
|---|---|---|
| Identifiers and contact data | First and last name; email address; telephone number; account username; hashed password and hashed PIN used for two-factor authentication; IP address and device identifiers | Identifiers (Cal. Civ. Code 1798.140(v)(1)(A)); Internet or other electronic network activity (1798.140(v)(1)(F)) |
| Demographic data | Date of birth; age; gender; nationality; city, postal code, and country of residence. Gender and nationality are collected because the International Padel Federation (FIP) and national federations require them for rankings, points, and event entry | Characteristics of protected classifications, where applicable (1798.140(v)(1)(C)); Identifiers |
| Profile data | Profile photograph; main padel club affiliation; self-reported sport level; self-reported physical activity level (optional); self-reported playing experience | Customer records (1798.140(v)(1)(B)); see Sensitive Personal Information below for certain items |
| Gameplay data | Event and tournament registrations; match results and scores; tournament history; rating | Commercial information (1798.140(v)(1)(D)); Inferences (1798.140(v)(1)(K)) |
| Communications | Support requests submitted by email or through our help desk; messages you send through the Player App | Customer records (1798.140(v)(1)(B)) |
| Technical and usage data | Browser type, device type, and operating system; pages visited and actions taken; date and time of access; mobile push notification tokens | Internet or other electronic network activity (1798.140(v)(1)(F)) |
| Request and security logs | For each request your device sends to our servers, we log the IP address, your user ID and role, the request headers (including authentication tokens, cookies, user-agent, and origin), the request body (which may include information you submit, such as your name, email address, or telephone number), and the response body (which may include information about other players returned to you). These logs are used for security, troubleshooting, and abuse detection | Identifiers (1798.140(v)(1)(A)); Internet or other electronic network activity (1798.140(v)(1)(F)) |
| Location data | Precise geolocation collected from your device when you enable location features | Geolocation data (1798.140(v)(1)(G)); also Sensitive Personal Information (see below) |
| Device sensor and fitness data | Activity, motion, and performance data collected from your device sensors or fitness integrations when you enable those features | Sensory data (1798.140(v)(1)(H)); may include health information (see Sensitive Personal Information below) |
| Biometric data | Where you enable a feature that uses it, a biometric identifier used to recognize you | Biometric information (1798.140(v)(1)(E)); also Sensitive Personal Information (see below) |
| Payment-related data | Records that a payment occurred, the amount, and the date. Card and bank credentials are collected and processed by Stripe, not by us; we do not store card numbers or bank account details | Commercial information (1798.140(v)(1)(D)) |
We do not knowingly collect more personal information than is reasonably necessary for the purposes described in this policy. Some items are optional, and the Player App functions without them.
1.1 Sensitive Personal Information
Some of the information above is “sensitive personal information” under the CCPA. Cal. Civ. Code 1798.140(ae) treats the following categories, which we may process, as sensitive: precise geolocation (defined as data used to locate you within a radius of 1,850 feet); biometric information processed for the purpose of uniquely identifying you; and personal information collected and analyzed concerning your health, which can include activity, fitness, and performance data and self-reported physical-activity information.
We collect and use sensitive personal information only to provide and secure features you ask for, such as locating nearby courts and events, recognizing you where you enable a biometric feature, and reflecting activity or performance data in your profile or rating. We do not use or disclose sensitive personal information to infer characteristics about you for purposes beyond providing these features. California residents have the right to limit our use of sensitive personal information, as described in the “Your Rights and Choices” section.
If you are in Illinois, Texas, Washington, or another state with a specific biometric-privacy law, additional rights and consent requirements may apply to biometric data. Where required, we obtain your separate consent before collecting a biometric identifier and we maintain a retention and destruction schedule for it.
1.2 Information About Children
The Player App is used by minors who participate in padel, subject to the age thresholds and parental-consent process described in the “Children’s Privacy” section. Where a minor uses the Player App, we may collect the same categories of personal information described above, including precise geolocation and, where enabled, biometric and fitness data, only after the required parental consent has been obtained.
1.3 Special Categories of Personal Data (EU and UK)
For users in the European Economic Area (“EEA”), the United Kingdom, and Switzerland, biometric data processed to uniquely identify you and data concerning your health are “special categories” of personal data under Article 9 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR. We process special categories of personal data only on the basis of your explicit consent under Article 9(2)(a), and you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
2. Sources of Personal Information
We collect personal information from the following sources:
Directly from you, when you create and maintain your account, complete your profile, register for events, send messages or support requests, and enable optional features such as location, sensor, fitness, or biometric features.
Automatically from your device, when you use the Player App, including technical and usage data, and, where you enable them, precise geolocation and device-sensor data.
From a parent or legal guardian, where the account is for a minor and the parent or guardian provides consent and account information.
From padel federations and the Tournated platform, where you participate in federation-sanctioned events and results or profile data are returned to us.
From club directors and tournament organizers, who enter or update event and result information that relates to you.
From our service providers, such as our payment processor confirming that a payment occurred.
3. How We Use Personal Information
We use personal information for the purposes below:
Providing the Player App: creating and authenticating your account, registering your player profile with USA Padel as described in Section 4.2, registering you for events, tracking matches, and calculating and displaying your ratings, including rating assignments and adjustments made by clubs and event organizers under our Terms of Use.
Public profiles and leaderboards: displaying your name, profile photograph, rating, match history, and tournament results on public leaderboards and profiles. Public display is a core function of the Player App; the “Children’s Privacy” section explains how this works for minors.
Communications: sending transactional messages such as registration confirmations and match results, service and security notices, and, where you participate in events, tournament notifications by email or SMS.
Location, sensor, and fitness features: providing features you enable that rely on precise geolocation, device-sensor data, or fitness data.
Biometric features: recognizing you where you enable a feature that uses a biometric identifier.
Improving and securing the Player App: understanding how the Player App is used, maintaining and improving it, and detecting, preventing, and responding to fraud, abuse, duplicate accounts, and violations of our Terms of Use, including through the request and security logs described in Section 1.
Legal compliance: complying with applicable laws, responding to lawful requests, and establishing, exercising, or defending legal claims.
3.1 Legal Bases for Processing (EU and UK)
If you are in the EEA, the United Kingdom, or Switzerland, we process your personal information under the following legal bases in Article 6(1) of the GDPR and the UK GDPR:
Performance of a contract (Article 6(1)(b)): to create and operate your account, register you for events, calculate and display your rating, and provide the features you request.
Legitimate interests (Article 6(1)(f)): to secure the Player App, prevent fraud and abuse, maintain the integrity of ratings and results, and improve our services. We balance these interests against your rights, and you may object as described in the “Your Rights and Choices” section.
Consent (Article 6(1)(a)): for optional features that rely on precise geolocation, device-sensor data, fitness data, or non-essential cookies, and for direct marketing where we send it. You may withdraw consent at any time.
Legal obligation (Article 6(1)(c)): to comply with legal requirements, such as tax and financial record-keeping.
Where we process special categories of personal data, such as biometric data used to identify you or health-related fitness data, we rely on your explicit consent under Article 9(2)(a) in addition to a legal basis in Article 6(1). For minors, consent is given or authorized by the holder of parental responsibility as described in the “Children’s Privacy” section.
3.2 Automated Calculation of Your Rating
Your ratings are generated automatically from your match results and self-reported information using our rating method, and each rating carries a confidence level that reflects how much match data supports it. We may also use automated tools, including AI-assisted tools, to establish an initial rating. Clubs and event organizers may assign an initial rating and may adjust a rating where it does not reflect your demonstrated level of play, as described in our Terms of Use, and those adjustments are recorded. Ratings affect matchmaking, division placement, and eligibility for certain events. Ratings do not produce legal effects concerning you or similarly significant effects, and a human reviews every rating appeal and every account decision. If you are in the EEA, the United Kingdom, Switzerland, or Quebec, you may contact us for information about the logic involved in the rating and to express your point of view, and you may ask us to review a rating you believe is inaccurate. California residents may request information about our use of automated decisionmaking technology as described in Section 8.
4. How We Share Personal Information
We share personal information only as described below.
4.1 Service Providers
We use the service providers listed below to operate the Player App. They process personal information on our behalf, under contract, and only for the purposes we specify.
| Service provider | Purpose |
|---|---|
| Stripe, Inc. | Payment processing |
| Amazon Web Services (AWS) | Cloud hosting and infrastructure |
| MongoDB Atlas | Database hosting |
| Twilio | SMS notifications |
| Rollbar | Error monitoring |
| Zoho Desk | Customer support |
| SignNow | Electronic signatures for parental consent |
4.2 USA Padel, Other Federations, and the Tournated Platform
USA Padel registration. We operate the Player App in partnership with USA Padel (formerly the United States Padel Association or USPA), the national governing body for padel in the United States. When you create an account, we register your player profile with USA Padel and share the information needed to maintain that registration, which may include your name, date of birth, gender, nationality, country, club affiliation, contact details, ratings, and results. USA Padel registration is integral to the Player App: the rating system and sanctioned-event participation depend on it, and an account cannot be created without it. USA Padel acts as an independent controller of the information it receives and uses it under its own privacy policy. For users under 13, the parental consent form describes this registration and the parent consents to it as part of creating the Minor Account. For users aged 13 to 15 in the United States, we ask you to confirm your own authorization for this sharing at signup.
Other federations and Tournated. When you participate in federation-sanctioned events, we share your profile and results with the relevant padel federation, such as the Pan American Padel Confederation (PAC) and the International Padel Federation (FIP), through the Tournated platform. The federations and Tournated act as independent controllers of this information, which means they determine their own purposes for using it and are responsible for it under their own privacy policies and applicable law. We share this information to enable your participation in events you choose to enter. The exchange of information with a federation may be two-directional, so that results recorded by the federation are reflected in your WPR profile.
4.3 Club Directors, Tournament Organizers, and Coaches
When you register for an event, the club director or tournament organizer running that event receives the registration information needed to manage it, such as your name, email address, telephone number, and rating. When you request a verified rating from an authorized coach, club, or event organizer, or enter an event that requires one, that coach, club, or organizer receives your name and contact details so they can carry out the rating. They access this information through WPR Manager and are required under our WPR Manager Terms of Use to use it only for that purpose and to keep it confidential. Coaches, clubs, and organizers who use your information for their own separate purposes act as independent controllers for that use.
4.4 Public Display and Public Programming Interface
Information shown on public leaderboards and profiles, such as your name, profile photograph, rating, and match results, is visible to other users and to the public. We also offer a public programming interface (API) that authorized third-party applications, such as club-management and court-booking systems, can use to access your publicly visible information. Information you choose to make public, or that is public as a core function of the Player App, may be copied or retained by others outside our control.
4.5 Event Photography and Media
Events run on the platform may be photographed, filmed, streamed, or broadcast. Your image may appear incidentally in event coverage, such as crowd shots, court footage, and results graphics, which we, the host club, and the event organizer use to document and broadcast the event on the basis of our legitimate interest in operating and reporting on events. Where we, a host club, or an event organizer wish to feature you individually in marketing or promotional content in which you are identifiable, we rely on your consent, which we request at event registration or before the use and which you may withdraw at any time. For a child under 13, a photograph or video that includes the child’s image is personal information under COPPA, and we obtain parental consent before featuring the child. If you are in the EEA, the United Kingdom, Switzerland, or Quebec, you may object to, or withdraw consent for, the use of your image as described in Section 8.
4.6 Legal, Safety, and Business Transfers
We may disclose personal information where we believe in good faith that doing so is required by law, regulation, or legal process, or is necessary to protect the rights, property, or safety of World Padel Rating, our users, or others. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy or a successor policy.
We do not disclose personal information to third parties for their own independent purposes except as described in this section.
5. Sale, Sharing, and Targeted Advertising
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as the terms “sell” and “share” are defined in the CCPA. We also do not use or disclose your personal information for targeted advertising, as that term is used in other US state privacy laws, and we do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. If this changes, we will update this policy and provide any opt-out and consent mechanisms that the law requires before we begin.
Disclosures to USA Padel and other federations, to club directors and tournament organizers, and to coaches described above are made to provide the services you request, including the rating system and event participation, and are not sales or shares for advertising. We receive no payment or other valuable consideration from USA Padel in exchange for your personal information.
6. International Transfers of Personal Information
We are based in the United States, and we store and process personal information in the United States, including on AWS infrastructure located in Virginia. Request and security logs are stored in AWS CloudWatch in the us-east-1 (Northern Virginia) region. If you use the Player App from outside the United States, including from the EEA, the United Kingdom, Switzerland, or Quebec, your personal information will be transferred to, and processed in, the United States and other countries that may not provide the same level of data protection as your home jurisdiction.
Where we transfer personal information out of the EEA, the United Kingdom, or Switzerland, we use appropriate safeguards recognized under applicable law, such as the European Commission’s Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum, together with additional measures where needed. You may contact us using the details in the “Contact Us” section to request information about these safeguards.
If you are in Quebec, we assess privacy-related factors before releasing personal information outside Quebec, as required by applicable law, and we put in place protections appropriate to the sensitivity of the information.
7. How Long We Keep Personal Information
We keep personal information for as long as your account is active and for as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law. Our general retention periods are below.
| Type of data | Retention period |
|---|---|
| Account information (name, email, and similar) | Duration of the active account plus 12 months after deactivation |
| Match history and results | Retained in identifiable form while needed for ratings; anonymized on account deletion (see below) |
| Rating data | Retained while needed for the rating function; anonymized on account deletion |
| Payment records | 7 years, to meet tax and financial record-keeping requirements |
| Support tickets | 3 years after resolution |
| Parental consent records | Duration of the minor’s account plus 3 years after closure |
| Request and security logs | 365 days |
| Email address and telephone number after account deletion (see below) | Up to 30 days after deletion, then permanently destroyed |
When you delete your account, your profile immediately stops being searchable or displayed, and we remove or replace with placeholder values the information that identifies you in your account record, such as your name, profile photograph, and date of birth. Your match history and ratings remain in the public record of the Player App, attributed to “WPR Player” with no personal information attached, so that the records of other players remain accurate. Because players may not delete an account to reset their competitive record, we keep your email address and telephone number internally for up to 30 days after deletion, solely to detect duplicate accounts and re-registration and, where we detect one, to re-apply your competitive record to the new account. During those 30 days we treat that information as personal information and protect it accordingly. After 30 days it is permanently destroyed, the account cannot be recovered, and your match history cannot be re-associated with you. We may retain information for longer where we are required to do so by law, or where we need it to establish, exercise, or defend legal claims, in which case we isolate and protect it until the obligation or need ends.
8. Your Rights and Choices
Depending on where you live, you have some or all of the rights described below. We honor these rights regardless of your location where we reasonably can, and we do not discriminate against you for exercising them.
Access and know: request confirmation of whether we process your personal information, a copy of it, and information about the categories we collect, the sources, the purposes, the categories of recipients, and the specific pieces we hold about you.
Delete: request deletion of personal information we have collected from you, subject to exceptions, including our need to keep certain records by law and to preserve the integrity of other players’ match histories.
Correct: request correction of inaccurate personal information and completion of incomplete personal information.
Data portability: receive personal information you provided to us in a structured, commonly used, machine-readable format, and, where technically feasible, have it transmitted to another controller.
Limit sensitive personal information (California): direct us to limit our use and disclosure of your sensitive personal information to what is necessary to provide the features you request.
Restrict processing (EEA, UK, Switzerland): ask us to restrict processing in certain circumstances.
Object (EEA, UK, Switzerland): object to processing based on our legitimate interests, and to direct marketing at any time.
Withdraw consent: where processing is based on consent, withdraw it at any time, without affecting processing carried out before withdrawal.
Appeal (Virginia, Colorado, Connecticut, and similar states): appeal a decision we make on your privacy request.
Lodge a complaint (EEA, UK, Switzerland, Quebec): complain to your supervisory authority or to us. The relevant authorities appear in the “Contact Us” section.
De-indexing and cessation of dissemination (Quebec): in certain circumstances, ask us to stop disseminating personal information or to de-index a hyperlink that gives access to it.
Information about automated processing (EEA, UK, Switzerland, Quebec): where a decision is based on automated processing, ask for information about the personal information used and the principal factors, and ask us to review it.
Automated decisionmaking technology (California): our rating system does not currently make a “significant decision” as defined under California law (e.g., it does not determine financial, housing, employment, educational, healthcare, or criminal-justice outcomes), so the California pre-use notice, information, and opt-out rights for automated decisionmaking technology do not currently apply. If that changes, we will provide the required notice and opt-out beginning January 1, 2027, or before the new use begins, whichever applies.
Your image: object to, or withdraw consent for, the featured promotional use of your image as described in Section 4.5.
We do not sell or share your personal information for cross-context behavioral advertising, so no opt-out of sale, sharing, or targeted advertising is needed. If that ever changes, we will provide the required opt-out before we begin.
9. How to Exercise Your Rights
To exercise any of the rights above, contact us by email at support@worldpadelrating.com, or by mail at the address in the “Contact Us” section. You do not need an account to make a request, although having one may help us verify your identity. Where we offer a dedicated request form or portal, you may also use it: https://worldpadelrating.com/contact-us/.
We verify requests before acting on them, to protect your information. Depending on the request and the sensitivity of the information, we may ask you to confirm details we already hold, or to verify control of the email address associated with your account. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly.
We respond within the time the law allows. We generally respond to CCPA requests within 45 calendar days, with an extension where permitted, and to GDPR and UK GDPR requests within one month, with an extension of up to two further months for complex requests. For Quebec requests, we respond within 30 days. If we cannot grant a request in full, we will explain why, to the extent the law allows, and, where you have a right to appeal, how to do so.
10. Children’s Privacy
We take particular care with the personal information of minors. The rules below apply in addition to the rest of this policy.
10.1 Age Thresholds
General threshold: the Player App is intended for users who are at least 13 years of age. A user under 13 may not create or use an account without verifiable parental consent.
United States (children under 13): the federal Children’s Online Privacy Protection Act (“COPPA”) applies, and we obtain verifiable parental consent before collecting, using, or disclosing personal information from a child under 13.
European Economic Area, United Kingdom, and Switzerland: the age at which a child can consent on their own to online services is 16, or a lower age set by your country that is not below 13. Below the applicable age, processing based on consent requires consent given or authorized by the holder of parental responsibility.
Quebec: personal information about a minor under 14 is not collected without the consent of the person having parental authority or the tutor, unless collection is clearly for the minor’s benefit.
10.2 What We Collect From Minors, Including Geolocation and Biometric Data
Where a minor uses the Player App, we may collect the categories of personal information described in Section 1, including precise geolocation and, where the relevant feature is enabled, device-sensor, fitness, and biometric data. Because precise geolocation, biometric identifiers, and photographs or videos containing a child’s image are personal information under COPPA, we describe them specifically in the parental consent process, and we obtain verifiable parental consent that covers them before collecting them from a child. The parental consent process also describes the registration of the child’s profile with USA Padel, which is integral to the Player App, and the parent consents to that registration as part of creating the Minor Account. We do not condition a child’s participation in any activity on the child providing more personal information than is reasonably necessary for that activity.
10.3 Parental Consent Process
To create an account for a child below the applicable age threshold:
A parent or legal guardian must have an active WPR account.
The parent or guardian goes to the child-registration request page in the Player App.
The parent or guardian reviews and accepts the Terms of Use and this Privacy Policy on behalf of the child.
The parent or guardian completes a binding electronic consent form through SignNow that identifies the personal information we collect, including precise geolocation, biometric data, and images where applicable, how we use and disclose it, and the registration of the child’s profile with USA Padel.
We review the signed consent and create the child’s account.
10.4 Parental Rights
A parent or legal guardian of a minor user has the right to:
Review the personal information we have collected from the child.
Request correction of the child’s personal information.
Request deletion of the child’s personal information and account.
Refuse to permit our further collection or use of the child’s personal information.
Withdraw consent at any time. On withdrawal, we deactivate the child’s account and de-identify the child’s personal information within 30 days, subject to the retention of match history and ratings attributed to “WPR Player” and the 30-day retention of contact details described in Section 7. We do not retain a child’s personal information for longer than is reasonably necessary for the purpose for which it was collected.
To exercise any of these rights, contact us at support@worldpadelrating.com.
10.5 Age Verification and Discovery of Underage Accounts
We determine age from the date of birth provided at registration, and we apply the check both in the Player App and on our servers. Accounts cannot be created for children under 13 through our public programming interface or by third-party applications; the API allows only the linking of an existing account. If we learn that we have collected personal information from a child without the required parental consent, we take steps to delete that information promptly.
11. Cookies and Tracking Technologies
Our website uses cookies and similar technologies. A cookie is a small file stored on your device that lets a site recognize your browser. We use the categories below.
Essential cookies: required for authentication, security, and core functionality. These are always active because the site cannot work properly without them.
Analytics cookies: help us understand how visitors use the site so we can maintain and improve it. We use Google Tag Manager to manage tags on our site, which may set analytics cookies.
12. How We Protect Personal Information
We use administrative, technical, and physical measures designed to protect personal information, including:
Encryption of data in transit using TLS.
Encryption of data at rest.
Hashing of passwords and PINs, which are never stored in readable form.
Access controls for internal systems.
Request and security logging, with logs retained for 365 days and access to them restricted.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us at support@worldpadelrating.com.
13. Data Breach Notification
If a breach of security affects your personal information, we will notify affected users and the relevant authorities as, and within the time, applicable law requires.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and notify you by email or through a notice in the Player App. For changes that require it, such as a material change to how we handle children’s personal information, we will obtain renewed consent where the law requires it before the change takes effect.
15. Contact Us
For questions about this policy or your personal information, or to exercise your rights, contact us:
Email: support@worldpadelrating.com
Mail: UP PADEL CORP World Padel Rating, 580 North Sea Mecox Road, Southampton, NY 11968, United States
Supervisory Authorities
EEA: you may lodge a complaint with the data protection authority in your country of residence, place of work, or place of the alleged infringement.
United Kingdom: the Information Commissioner’s Office (ICO), at ico.org.uk.
Quebec: the Commission d’acces a l’information du Quebec (CAI), at cai.gouv.qc.ca.