Privacy Policy

PUP is a loyalty and engagement platform for padel clubs and their players. This policy explains what personal data we handle, why, and what you can do about it. It covers the gopup.app website, the PUP mobile app, and the PUP backoffice used by clubs.

We have tried to write this in plain language. Where we say "we", "us" or "PUP" we mean the controller named below.

Who is responsible for your data

Martinr B.V.
Meester Cornelisstraat 4, 2023 DG Haarlem, the Netherlands
Chamber of Commerce (KvK): 94615675
Email: info@gopup.app

PUP is a product of Martinr B.V. If PUP is later transferred to its own legal entity, we will update this page and tell you before the change takes effect.

We have not appointed a Data Protection Officer. We are not required to have one. For any question about this policy or your personal data, write to info@gopup.app.

Two different roles

This matters, because it decides who you go to with a question.

PUP as controller. When you create a PUP account, use the app, earn or spend coins, or complete challenges, we decide what happens with your data. We are the controller and this policy applies in full.

PUP as processor. Clubs can connect their own booking or point-of-sale system (currently Playtomic and Lightspeed K-Series) to their PUP backoffice, and import their own member administration into it. That member data belongs to the club. The club decides what is imported and why; we only process it on the club's instructions under a data processing agreement. If you are a club member who has never created a PUP account and you want to know why the club holds your data, ask the club — they are the controller. We will always help the club answer you.

What we collect

When you create an account

Handled by our own identity service, which we host ourselves in Germany:

• Email address

• Username

• First and last name

• Password (stored only as a salted hash — we never see it)

Your player profile

Optional unless stated otherwise. You choose how much of this to fill in:

• Country, club, short bio

• Date of birth, gender

• Preferred hand and position on court

• KNLTB profile link and ID, and ratings from rating providers you connect

• Skill points and your PUP score

• Profile picture

• Language preference

• Your loyalty code

• Your profile visibility setting, which controls what other players can see

When you use the app

• Coins and rewards — your coin balance, every coin transaction, reward orders, and redemptions. We keep a full transaction history because a loyalty balance has to be auditable.

• Challenges — which challenges you start, complete or abandon.

• Location — only when you tap "near me" on the clubs or challenges screen. We read your position once, use it to sort by distance, and convert it to a city name for the label on screen. We do not track you in the background and we do not store your coordinates.

• Camera — only to scan a QR code when a club verifies a reward. Images are not stored or uploaded.

• Photos — only when you pick or take a profile picture.

• Push notifications — if you allow them, we store a device push token so we can send you notifications. You can turn them off in the app or in your device settings.

• Wallet passes — if you add your PUP loyalty pass to Apple Wallet or Google Wallet, the pass contains your name and loyalty code.

From your club

If your club has connected Playtomic or a Lightspeed K-Series point of sale, we receive, on the club's behalf:

• Name, email address and phone number as held in the club's system

• Sports played, benefits, and the date of the last booking

• Purchases made at the club: which products, quantities and amounts

The club is the controller for this data. See "Two different roles" above.

Technical data

• Server logs and error reports, so we can keep the service running and fix bugs. Error reports carry no profile content.

• On the website, a single functional cookie that remembers your language choice.

What we deliberately do not do

We think this is worth stating plainly:

• No advertising. We do not sell, rent or share your data with advertisers.

• No tracking on the website. No Google Analytics, no advertising pixels, no third-party tracking scripts, no cookie wall — because there is nothing to consent to beyond the language cookie.

• No profile data in error reports.

• No card payments. PUP never processes payment card details. Coins are a loyalty balance, not money, and cannot be exchanged for cash.

Why we use your data, and on what legal basis

Where we rely on consent, you can withdraw it at any time and it is as easy to withdraw as it was to give. Withdrawing does not affect anything we did before you withdrew.

Who can see your data

Other players

What other players see depends on your profile visibility setting, which you control in the app.

Your club

If you are a member of a club on PUP, that club's managers can see, in their backoffice, your data as it relates to that club: your contact details, the coins you earned and spent there, the rewards you redeemed there, your challenge activity there, your PUP score, and any data the club already holds about you in its own Playtomic or point-of-sale system.

A club cannot see your activity at other clubs. Your history at one club is not visible to another.

Clubs also group members into segments — for example, "members who have not booked in three months" — to decide who to invite to a challenge or campaign. This is profiling in the sense of the GDPR. It has no legal effect on you and no decision is made about you by automated means alone.

Service providers

We use a small number of processors. Each is bound by a data processing agreement.

Everything that can reasonably be kept in the EU is kept in the EU. Our servers, our databases, your profile picture, our email and our error reports never leave Europe.

International transfers

Push notifications and wallet passes are the exception. Apple and Google operate the only delivery channels that exist for iOS and Android notifications, so if you enable push, a device token and the notification content pass through their infrastructure in the United States. The same applies if you add your loyalty pass to Apple Wallet or Google Wallet. These transfers rely on the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. If you would rather this did not happen, do not enable push notifications and do not add a wallet pass — the rest of PUP works without them.

When you use "near me", your device asks Apple's or Google's built-in geocoder to turn your coordinates into a city name. That happens on your device, through the operating system, and we do not receive or store the coordinates.

Others

We disclose data to authorities only where we are legally obliged to. If PUP is ever sold or merged, your data may transfer to the acquirer, and we will tell you before that happens.

How long we keep it

Deleting your account

You can delete your PUP account yourself, from Settings → Delete account in the app. No email, no form, no waiting for us to get round to it.

When you do, we do something a little unusual, and we think it is worth explaining. PUP is built on an event log — a permanent, append-only record of everything that happened, which is what makes a coin balance trustworthy. You cannot simply delete a row from a ledger without breaking it.

So instead, every piece of personal data in that log is encrypted with a key that belongs to you and only you. When you delete your account, we destroy your key. The events stay, so the books still balance, but the personal data inside them becomes permanently unreadable — to us as much as to anyone else. It cannot be recovered. This is a genuine erasure, and it is irreversible.

Anything that identifies you elsewhere is deleted outright, including your identity record, your profile picture, and your push tokens.

Your rights

Under the GDPR you can ask us to:

• Access — get a copy of the personal data we hold about you

• Rectify — correct anything that is wrong

• Erase — delete your data (see above)

• Restrict — pause our use of your data while something is disputed

• Port — receive your data in a machine-readable format

• Object — object to processing based on legitimate interest

• Withdraw consent — for marketing, at any time, in the app or via the unsubscribe link in any marketing email

Write to info@gopup.app. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive.

If you are unhappy with how we handled it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country. We would rather you came to us first.

How we protect your data

• Names, email addresses, phone numbers, dates of birth and gender are stored encrypted, with a separate encryption key for every user. A breach of the database alone does not expose them.

• All traffic runs over TLS.

• Access tokens on your phone are held in the device keychain (iOS) or keystore (Android), never in plain storage.

• Access to production systems is restricted to the people who need it.

• Our infrastructure sits in a single EU datacentre, behind a firewall, with monitoring and alerting.

No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens within 72 hours and tell you directly.

Children

Padel is a family sport and clubs have junior members, so PUP is open to players under 16. Running your account, your coins and your challenges rests on our agreement with you, not on consent, so a younger player can use PUP the same way anyone else does.

Marketing is different. Under Dutch law, consent given by someone under 16 needs a parent or guardian behind it. So if you are under 16:

• We will still send you the messages you need to use your account — verification, password resets, reward confirmations.

• We will not send you marketing by email, push or WhatsApp unless a parent or guardian has agreed to it.

• We do not build marketing profiles or segments about you for advertising purposes.

Clubs may also hold junior members in their own administration, and that data can reach PUP through a club integration. There the club is the controller and is responsible for the parental consent that covers it — see "Two different roles" above.

If you are a parent or guardian and want to see, correct or delete your child's data, or withdraw a consent you gave, email info@gopup.app and we will act on it.

Cookies

The gopup.app website sets one cookie, i18n_redirected, which remembers whether you want the site in English or Dutch. It is strictly necessary for that function, it contains no identifier, and it is not used to track you. That is why you do not see a cookie banner: there is nothing here that requires your consent.

The PUP app does not use cookies.

App permissions

The app asks for these, and nothing else. Each is optional and each is requested only at the moment it is needed:

We do not request background location, microphone, contacts, or your calendar.

Changes to this policy

If we change how we handle your data in a way that affects you, we will update this page and, for anything significant, tell you in the app or by email before it takes effect. The date below always reflects the current version.