P

PadelMints

Data Processing Agreement

Version 2026-10-23 · Last updated: 23 October 2026

This Data Processing Agreement ("DPA") forms part of the Club Terms between the padel club that registers on PadelMints (the "Club" or "Controller") and Capital AI S.R.L., Via Giuseppe Ripamonti 19, 20136 Milano (MI), Italy, VAT No. / Tax Code 13856590966, REA MI-2748256, PEC capital-ai@pec.it (the "Processor"). It meets the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR) and takes effect when the Club accepts the Club Terms, for the version shown above.

1. Subject matter, duration, nature and purpose

• Subject matter: the Processor processes personal data on behalf of the Controller to provide the PadelMints club management software (bookings, customer list, CSV export, email campaigns to the Club's customers, reporting, calendar sync).
• Duration: for as long as the Club uses PadelMints, plus the period needed to return or delete data under section 9.
• Nature of processing: collection, recording, storage, organisation, retrieval, consultation, use, transmission (including email delivery), export, restriction and erasure.
• Purpose: only to provide the service to the Club as described in the Club Terms and the Controller's documented instructions.

2. Categories of data and data subjects

• Data subjects: the Club's customers (players who book or play at the Club or whom the Club contacts), the Club's staff users, and individuals included in bookings or split payments.
• Personal data: identification and contact data (name, email, phone if provided), booking history (court, date, time, price, status, attendance and no-shows), payment status (not full card numbers), playing profile information the player chooses to share (e.g. match results, intent tags), and communications sent through the platform (email campaign content, delivery status).
• No special categories of data (Art. 9) are intended to be processed. The Controller must not enter such data into free-text fields or email campaigns.

3. Controller's instructions and responsibilities

The Processor processes personal data only on documented instructions from the Controller, which are given by these terms and by the Controller's use of the platform's features (for example sending a campaign or exporting a list), unless EU or Italian law requires otherwise, in which case the Processor informs the Controller beforehand unless the law forbids it. The Processor will tell the Controller if it believes an instruction infringes data protection law. The Controller is responsible for the lawfulness of the data it provides and of its instructions, for informing its customers, and for having a legal basis for its own use, including consent or another valid basis for marketing emails.

4. Processor obligations

• Confidentiality: persons authorised to process the data are bound by confidentiality obligations and access it only as needed.
• Security (Art. 32): the Processor maintains appropriate technical and organisational measures, including:
  • encryption of data in transit (TLS) and at rest on Google Cloud infrastructure;
  • data hosted in the EU (Firestore and Cloud Functions in europe-west1, Belgium);
  • access control through authentication and Firestore security rules, so that Club users can access only their own Club's data;
  • least-privilege access for the Processor's personnel and service accounts;
  • secrets kept in environment configuration and not in source code;
  • passwords hashed by Firebase Authentication; and
  • logging and monitoring of the service, and a process to handle security incidents.
• Assistance with data subject requests: taking into account the nature of processing, the Processor assists the Controller, by appropriate technical measures (such as customer list access, CSV export and deletion tools), in responding to requests to exercise data subject rights. If a data subject contacts the Processor directly about the Club's data, the Processor will forward the request to the Controller and not respond itself beyond acknowledging it.
• Assistance with Arts. 32 to 36: the Processor assists the Controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to it.
• Records: the Processor keeps the records of processing required by Art. 30(2) GDPR.

5. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and in any case within 48 hours. The notification will describe, as far as known, the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences and measures taken or proposed, and will be supplemented as more information becomes available. The Controller remains responsible for notifying the supervisory authority and data subjects where required.

6. Sub-processors

The Controller gives a general authorisation for the Processor to engage sub-processors. The Processor imposes on each sub-processor data protection obligations no less protective than those in this DPA and remains liable to the Controller for their performance. The sub-processors that process Club customer data are:

If the Controller connects Google Calendar, Google acts under the Controller's authorisation for that integration. The Processor will inform the Controller of any intended addition or replacement of sub-processors by email or in the dashboard at least 30 days in advance. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected service in accordance with the Club Terms.

7. Audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it. Audits require reasonable prior written notice (generally at least 30 days), must be conducted during business hours without unreasonable disruption, are subject to confidentiality, and are limited to once per year unless a breach or supervisory authority requires otherwise. The Processor may satisfy audit requests first by providing relevant documentation or reports.

8. International transfers

The Controller's data is stored in the EU. Where the Processor or a sub-processor transfers personal data outside the EEA, it does so only on the basis of an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses, with supplementary measures where necessary, so that the transfer complies with Chapter V GDPR.

9. Return and deletion at the end of the service

The Controller may export its customer data (CSV) and download its data at any time. After termination the Processor will, at the Controller's choice, return and then delete the Controller's personal data, or delete it, within a reasonable period (and no later than 90 days) unless EU or Italian law requires storage. Data the Processor holds as an independent controller or must keep by law (for example invoices and subscription billing records, kept 10 years) is not covered by this deletion obligation. Bookings linked to a player's own account are anonymised, not deleted, when that player deletes their account.

10. Liability, governing law, order of precedence

Liability under this DPA is subject to the limitations in the Club Terms, to the extent permitted by Art. 82 GDPR. This DPA is governed by Italian law and the jurisdiction clause of the Club Terms applies. In case of conflict on the processing of personal data, this DPA prevails over the Club Terms.

11. Contact

Capital AI S.R.L. · privacy@capital-ai.eu · PEC capital-ai@pec.it. No Data Protection Officer has been appointed. See also the Privacy Policy.