Last updated: 27.08.2026

Privacy Policy

This policy explains what personal data is processed, why it is processed, and what rights users have under GDPR.

Company: ATN TENNIS, Sp. z o.o.

NIP: 9512645383

REGON: 544402697

Registered address: ul. ZYGMUNTA VOGLA nr 28 lok. 02.177, 02-963 Warszawa, Polska

Contact email: info@atntennis.com

Contact phone: +48 571 037 277

Data Protection Officer (DPO): No dedicated DPO appointed at this time

1. General provisions

1.1. This Privacy Policy explains how ATN TENNIS, Sp. z o.o., address: ul. ZYGMUNTA VOGLA nr 28 lok. 02.177, 02-963 Warszawa, Polska, e-mail: info@atntennis.com, processes personal data of users of the ATN TENNIS platform available at https://www.atntennis.com (the “Platform”).
1.2. For matters concerning personal data processing, you may contact us at: info@atntennis.com.
1.3. This Policy has been prepared in light of the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”).
1.4. The Operator has not appointed a Data Protection Officer because there is currently no obligation to do so. If such an obligation arises in the future, relevant information will be published on the Platform.

2. Who is the controller

2.1. The controller of Platform users’ personal data in connection with registration, account management, use of Platform functionality, support, security, analytics and marketing is ATN TENNIS, Sp. z o.o. (the “Operator”).
2.2. If a specific competition is organized by an external Organizer, that Organizer may be a separate controller of participants’ personal data to the extent necessary to run that competition.
2.3. If a specific competition is organized by the Operator, the Operator is the controller of data related to running that competition.
2.4. The competition page indicates who the Organizer is.

3. What data we collect

3.1. Account data. We may process in particular: first and last name or display name, e-mail address, password in secured / hashed form, date of birth if required for certain features, age categories or competitions, and a profile photo if voluntarily uploaded by the user.
3.2. Profile and contact data. We may process: city, district or a more detailed location if voluntarily provided, phone number, WhatsApp number or other messenger details if provided in the relevant field, and other profile data entered voluntarily by the user.
3.3. Sports data. We may process: information about playing level, answers to registration questionnaire questions concerning playing level, skills and experience, an initial assessment of playing level and assignment of an initial NTRP category / ranking, match history, match results, participation in tournaments and leagues, rankings, classifications and related sports statistics.
3.4. Technical data. We may process: IP address, date and time of login, device, browser and operating system data, cookie and similar technology identifiers, system logs and security events.
3.5. Payment-related data. In connection with paid Platform functionalities, including paid participation in tournaments, leagues and other competitions, we may process information about: payment status, amount, currency, transaction type and settlement data necessary for payment processing, accounting and refunds. Online payment processing, including card payments, refunds, settlements and fraud prevention, is provided by Paynow and Autopay S.A. to the extent necessary for those purposes. The Operator does not store full payment card numbers, CVV codes or card authentication data; detailed card payment data are processed by the payment operator in accordance with its own rules.
3.6. User-published data. We may process content published or submitted by the user, such as: comments, messages, descriptions, notices and other materials posted on the Platform.

4. Purposes and legal bases of processing

4.1. Account registration and providing access to Platform functionality. Basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
4.2. Organizing matches, displaying results, maintaining statistics and rankings, competition participation, and determining the user’s initial playing level and assigning an initial NTRP category / ranking. Basis: Article 6(1)(b) GDPR.
4.3. Organizer status verification, competition management and communication with participants. Basis: Article 6(1)(b) GDPR and, where needed, Article 6(1)(f) GDPR — the Operator’s legitimate interest in ensuring the proper functioning of the Platform.
4.4. Ensuring Platform security and preventing fraud, spam, abuse and technical attacks. Basis: Article 6(1)(f) GDPR — the Operator’s legitimate interest in protecting the Platform, users and infrastructure.
4.5. Responding to user inquiries, support and complaint handling. Basis: Article 6(1)(b) GDPR and/or Article 6(1)(f) GDPR.
4.6. Compliance with legal obligations, including accounting, tax and record-keeping obligations. Basis: Article 6(1)(c) GDPR.
4.7. Analytics, measuring Platform use and marketing using analytics and advertising tools. Basis: Article 6(1)(a) GDPR — the user’s consent given through the cookies / consent banner mechanism.
4.8. Establishing, exercising and defending legal claims. Basis: Article 6(1)(f) GDPR — the Operator’s legitimate interest in protecting its rights.

5. The Operator’s legitimate interest

5.1. Where processing is based on Article 6(1)(f) GDPR, our legitimate interest includes: ensuring the security and stability of the Platform, preventing abuse and fraud, protection against legal claims, improving the service and its functionality, and supporting the proper organization of competitions on the Platform.

6. Obligation to provide data

6.1. Providing data necessary to register and use the Platform’s basic functions is mandatory to the extent that without them an account cannot be created or the service cannot be provided.
6.2. Providing additional profile, contact and sports data may be voluntary, but failure to provide such data may limit use of certain Platform features.
6.3. If the user does not provide data necessary to conclude or perform a contract, the Operator may be unable to create an account, provide access to selected features or admit the user to specific competitions.

7. Sources of data

7.1. In most cases we receive data directly from the user.
7.2. Some data are generated automatically when the Platform is used, including technical data, logs and cookie data.
7.3. Some data concerning matches, results, competition participation, sports statistics and rankings may come from other match participants, Organizers, or be generated automatically as a result of using Platform functionality.

8. Recipients of data

8.1. Data may be disclosed to service providers who help us operate the Platform. Such recipients may include in particular: Vercel — as a hosting and frontend infrastructure provider; Supabase — as a backend services provider, including database, authentication and related technical functions; PostHog — as an analytics processor/provider, only after the user gives analytics consent; Meta (Meta Pixel) — as a marketing and advertising tools provider, if the user gives the relevant consent; Google Ads — as a marketing and advertising tools provider, if the user gives the relevant consent; providers of e-mail, notifications, customer support, abuse-prevention and technical support services; Paynow and Autopay S.A. — to the extent necessary to process online payments, card payments, refunds, settlements and fraud prevention.
8.2. If the Platform uses embedded external services such as Google Maps or YouTube, user data may also be disclosed to those entities to the extent arising from use of such features and the user’s consent settings.
8.3. Data may also be disclosed to Organizers to the extent necessary to run a given competition if the user takes part in it. In such cases the Organizer generally acts as a separate personal data controller within the scope of its role and processing purposes.
8.4. Data may be disclosed to public authorities, courts, law-enforcement authorities and other authorized bodies where required by law.
8.5. We disclose data only to the extent necessary to achieve the specific purpose.
8.6. For Meta advertising measurement and conversion attribution, data may be disclosed to Meta Platforms Ireland Limited through Meta Pixel in the browser and Meta Conversions API from the Platform server, only after the User gives Marketing consent.

9. Transfers of data outside the EEA

9.1. Some service providers may process data outside the European Economic Area (EEA), including in the United States.
9.2. In such cases transfers are made using safeguards provided under the GDPR, including: an European Commission adequacy decision, or Standard Contractual Clauses (SCC), or other lawful mechanisms provided under the GDPR.
9.3. The user may request additional information about the safeguards applied by writing to info@atntennis.com.

10. Data retention periods

10.1. Account data are retained for the duration of the account and, after deletion, for the period necessary to perform legal obligations, handle claims and protect the Operator’s rights, generally for no longer than 6 years or for the limitation period applicable to the relevant claim, unless the law requires a longer period.
10.2. Data concerning matches, results, statistics and rankings are retained for as long as necessary for match history, sports statistics and rankings to function, and are then deleted or anonymized, unless further retention is required to protect rights or comply with legal obligations.
10.3. Data concerning support contacts, notices and moderation are retained for the time needed to handle the matter and thereafter for the period needed to defend against claims or demonstrate compliance with the law.
10.4. Technical logs and security data are generally retained for up to 90 days, unless longer retention is necessary to investigate an incident, protect against abuse or comply with legal obligations.
10.5. Data related to accounting, invoicing and tax obligations are retained for the period required by Polish and EU law.
10.6. Data processed on the basis of consent are retained until consent is withdrawn or until the relevant retention period for the given tool or data category expires.

11. Cookies, analytics and marketing

11.1. We use cookies and similar technologies in accordance with the separate Cookies Policy.
11.2. Non-essential cookies, including analytics and marketing cookies, are used only after the user’s consent has been obtained.
11.3. The user may change or withdraw consent at any time using the cookie settings on the Platform.
11.4. After Marketing consent, the Platform may use Meta Pixel in the browser and Meta Conversions API from the server. The current server-side implementation sends completed-registration events and may use the same pseudonymous event ID as the browser event so Meta can deduplicate one conversion received through both channels.
11.5. A server-side Meta registration event may include IP address, browser user-agent, event timestamp, source URL, Meta browser or click identifiers such as _fbp, _fbc or a value derived from fbclid when available, and a pseudonymous event ID. ATN TENNIS does not intentionally send names, e-mail addresses, phone numbers, private messages, payment data, passwords, verification codes or authentication tokens through the current Conversions API implementation.

12. Profiling, matching and ranking

12.1. The Platform uses automated processing of data to calculate sports rankings, determine the user’s initial playing level, assign an initial NTRP category / ranking, match opponents, display statistics and improve the user experience.
12.2. Ranking, NTRP, Elo, Race and other related indicators are informational and sports-related in nature.
12.3. Sports indicators may be used to determine eligibility for selected competitions, participation categories or play formats on the Platform, in accordance with the rules of the relevant event.
12.4. If the user believes that a match result, statistic, ranking or NTRP value has been presented incorrectly, they may contact us at info@atntennis.com or use a dispute / correction mechanism available on the Platform, if provided.
12.5. To the extent that processing involves profiling, the user has the right to obtain information about the rules of such processing and to contest data they consider inaccurate. Where rules on decisions based solely on automated processing apply, the user has the corresponding rights provided by the GDPR.

13. User rights

13.1. The user has the right to: access their personal data; request rectification of inaccurate data; request erasure of data in cases provided by law; request restriction of processing; receive data in a structured format and exercise the right to data portability where applicable; object to processing based on legitimate interest; withdraw consent at any time where processing is based on consent; and lodge a complaint with a supervisory authority.
13.2. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
13.3. To exercise their rights, the user may contact us at: info@atntennis.com.

14. Right to lodge a complaint with PUODO

14.1. If the user believes that their data are processed unlawfully, they have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, Polska, website: https://uodo.gov.pl

15. Data security

15.1. The Operator applies appropriate technical and organizational measures to protect personal data against loss, unauthorized access, disclosure, alteration and destruction.
15.2. Such measures may include in particular access control, event logging, secure data transmission, separation of access privileges and other measures adequate to the nature of the service.
15.3. Despite the safeguards applied, no system of data transmission or storage can guarantee absolute security.

16. Third-party personal data provided by the user

16.1. If the user provides us with data of other persons, the user must have an appropriate legal basis and the right to disclose such data.
16.2. The user is responsible for the lawfulness of disclosing third-party data.

17. Changes to the Privacy Policy

17.1. The Operator may amend this Privacy Policy.
17.2. The current version is always published on the Platform.
17.3. Material changes may additionally be communicated through the Platform interface and/or by e-mail.

18. Contact

18.1. All matters related to personal data protection, exercise of user rights, support, payments, refunds, content notices and moderation may be addressed to: info@atntennis.com.

19. Language of the document

19.1. The Polish-language version of this document is the official and legally binding version.
19.2. Versions prepared in other languages are for information purposes only.
19.3. In the event of discrepancies between language versions, the Polish version shall prevail.

20. PostHog analytics

20.1. Subject to analytics consent, the Operator uses PostHog EU Cloud as an analytics processor/provider for usage and product analytics, navigation analysis, interface-problem detection, product and interface improvement, and Session Replay. Processing may involve online identifiers and technical usage data and, depending on the circumstances, may constitute processing of personal data.
20.2. The application is configured not to intentionally send PostHog names, email addresses, phone or WhatsApp numbers, passwords or verification codes, private messages, payment details, or authentication tokens. Inputs and designated sensitive areas are masked or excluded, and PostHog user identification is not enabled. These safeguards reduce, but cannot absolutely eliminate, the possibility that technical analytics data may relate to an identifiable person.
20.3. PostHog analytics is based on consent and uses the EU endpoint. Consent may be withdrawn through Cookie Settings, after which collection stops. Further details are available in the Cookie Policy and at https://posthog.com/privacy.

21. Google Analytics 4 and Google Tag Manager

21.1. After Analytics consent, the Operator uses Google Analytics 4 (GA4), delivered exclusively through Google Tag Manager (GTM), as a separate analytics provider for measuring traffic, navigation, visit sources, devices and browsers, and aggregate use of the Platform. Google may receive online identifiers and technical usage data, which may constitute personal data depending on the circumstances.
21.2. The Platform uses Basic Google Consent Mode v2. GTM is not loaded before Analytics consent. Analytics consent controls analytics_storage, while Marketing consent separately controls ad_storage, ad_user_data and ad_personalization. Necessary and External-services choices grant none of these Google states. Meta Pixel and Meta Conversions API are currently active only after Marketing consent. No Google Ads tag is currently active.
21.3. The application does not intentionally push names, email addresses, phone or WhatsApp numbers, passwords or verification codes, private messages, payment details, or authentication tokens to the GTM data layer. This does not mean that GA4 processing can never involve personal data.
21.4. Analytics consent can be withdrawn through Cookie Settings. The Google consent state is updated immediately and analytics collection for subsequent activity is disabled. Google code downloaded after an earlier grant may remain in browser memory, and technical consent-state communication may still be possible until the page is closed or reloaded.
21.5. More information about Google privacy practices is available at https://policies.google.com/privacy and https://support.google.com/analytics/answer/12017362.