MATCHi Privacy Policy - In Short

Why and how do we process your personal data?

We at MATCHi AB care about your privacy and want you to feel safe when we process your personal data. In order for you to use, and for us to provide, our online booking system and the service MATCHi including our competition tool Padelboard, we will need to process your personal data for different purposes.

We will process your personal data for the following purposes:

• To administrate your registration of a MATCHi account, including to verify that you are not a robot with the help of a service provided by Google.
• To administrate your use of your MATCHi account, which means that we process your personal data to:
  • administrate your log in to MATCHi, your bookings and purchases,
  • enable you to create a personal profile,
  • show your previous and upcoming bookings as well as statistics based on this,
  • suggest relevant activities for you based on your use of MATCHi,
  • enable you to find partners and venues near you,
  • show information on tournaments and matches if you take part in competitions,
  • allow you to reach out to and connect with fellow players,
  • enable you to use our matchmaking function, and
  • collect information concerning you from our connected partners and venues.
• To send newsletters or surveys to you or allow Venues to do so.
• To analyse how MATCHi is used.
• To provide customer service and handle any questions, complaints or queries.
• To comply with our legal obligations.

We do not sell your personal data, but we might need to share it with, for example our connected partners and venues, affiliated companies, our IT-suppliers and the suppliers of the analytic services we use (mainly Google and Amplitude). In certain situations, your personal data will be processed outside the EUbut only when we can ensure an appropriate level of protection for your personal data.

What are your rights?

When we process your personal data, you have certain rights. This means that you, for example, have the right to information and access to your personal data, a right to request that we delete your personal data, a right to withdraw your consent or object to our processing and a right to lodge a complaint with a supervisory authority. You can read more about your rights here.

Who is responsible for the processing of your personal data?

MATCHi AB (Swedish registration number 556871-6129), is responsible for the processing of your personal data. We also process personal data as processors on behalf of our connected partners and venues in order to facilitate your bookings and purchases, you can read more about this here.

If you want to know more about our processing of your personal data or if you want to exercise any of your rights, please contact us and we will help you. Our email address is dataprotection@matchi.se and our postal address is Gullbergs Strandgata, 411 04 Gothenburg.

You can read our full privacy policy below.

Privacy Policy

We at MATCHi AB (“we”, “our” and “us”) care about privacy and want you to feel you are in safe-hands when we process your personal data and we work hard to protect your integrity.

This privacy policy applies to you who use our online booking system and service (the “MATCHi”) on our website www.matchi.se or in our MATCHi app or Padelboard app (together the "Apps").

Here we explain why we process your personal data, what your rightsare, the legal basis on which we handle your data and for how long we store it.

Who is responsible for processing your personal data?

MATCHi AB (Swedish registration number 556871-6129), is responsible for the processing of your personal data.

Please note that we also process data on behalf of our partners and venues. Should you have any questions regarding this or if you wish to exercise any of your rights under data protection legislation, please contact us via our e-mail address dataprotection@matchi.seor write us a traditional letter to our postal address Gullbergs Strandgata, 411 04 Gothenburg, Sweden.

From where do we collect your personal data?

We collect your personal data directly from you when you register a MATCHi account or when you use MATCHi, for example when you make a booking on our website or in one of our Apps (or even a venues website if its bookings are powered by MATCHi) or if you choose to up-date or add to your account information. Much information is voluntary to provide, the more information you choose to contribute, the better functionality you will receive when using MATCHi.

We will also collect your personal data from other sources in the following situations:

• If you book an activity, enter a competition or are a member of a partner or venue, the partner or venue might have provided us with your information which we process on their behalf.
• If you use MATCHi with your personal Facebook or Apple account, we will use data from them to administrate your MATCHi account.
• If you have chosen to activate the optional matchmaking function, we will collect personal data (statistics) from our connected partners and venues to provide you with matchmaking offers.

The personal data you need to provide to us

In general, you are not required to provide personal data to us, but certain information needs to be provided in order to use MATCHi or any of the Apps. In which situations youneed to provide personal data to us is described in the below charts where the legal basis is stated as “Performance of a contract” or “Legal obligation”. If you do not provide such personal data to us, we will not, for example, be able to make MATCHi or the Apps available for you.

Who can gain access to your personal data and why?

Your personal data is primarily processed by MATCHi. This means that your personal data will be handled by our employees and representatives, but only to the extent it is needed for them to conduct their work.

Certain information about you may be visible to others. Whether information is public or not is clearly noted within the system and you can control this via your accounts privacy settings or by the choices you make when using MATCHi or the Apps, opting for the visibility you prefer. The more information you share the more you will be able to access yourself. Please note that when using the Padelboard app, there are less options to set your profile to private and most information is visible to others entering a competition and may be displayed on screens at a venue or other appropriate places. You are generally required to use your real name when using the Padelboard app, this is partly because competitions take place in real life and your team members or competitors have a legitimate interest in knowing who they will be meeting.

Sometimes our partners or venues use MATCHi as administrators. They can then process your personal data if you are affiliated with them through your membership or because you are their customer. They might also show information about activities or events on screens displayed at the venue and such displays can include information entered into MATCHi.

In certain cases, we need to share your personal data with our suppliers, partners and subsidiaries in order to conduct our business efficiently. We are responsible for any sharing of your personal data to such suppliers, partners or subsidiaries and to make sure your personal data is safe when shared with third parties.

We will share your personal data with the following recipients:

• Our IT-suppliers that will process your personal data on our behalf as our processors in order for us to have a functioning IT system and conduct our business efficiently. Your personal data is only shared to the extent necessary for our suppliers to fulfil their obligations in the contract they have with us and according to our instructions. This is applicable to all detailed schedules listed below.
• If you receive our newsletters or surveys, we will share your personal data with the company that provides a system for sending newsletters or conducting surveys.
• Our connected partners and venues to e.g. enable you to enter a competition or make use of the booking you have made through MATCHi with the partner or venue. Your personal data is only shared to the extent necessary for our connected partners and venues to fulfil their obligations in the contract they have with us or directly with You. The venues will process your personal data as controllers because You are also a customer of the venue. In some regards there is an overlap between the information we process and control about you and the information the venue process and control. You will find more information about this here.
• Our payment service providers in order to administrate your payments.
• In order to store information that we are required to store according tobookkeeping, accounting and other mandatory law, we will in some cases use a company that helps us archive such information. The information contains personal data but will only be processed on our behalf and on our instructions.
• The analytic services are mainly provided by Google Ireland Limited and Amplitude Inc. and the check-box service to confirm that you are not a robot is provided by Google Ireland Limited. Therefore, Google and Amplitude will process your personal data on behalf of us and according to our instructions as our processor. Thereafter, Google processes your personal data as controller. For more information about Google´s processing, read here.

Where is your personal data processed?

We, as well as our processors, process your personal data within the EU/EEA. In some instances, we will transfer your personal data outside of the EU/EEA to our IT-suppliers that process personal data as our data processors and according to our instructions. Such transfer only takes place in accordance with applicable data protection legislation, meaning that we will transfer your personal data outside the EU/EEA when we can ensure an appropriate level of protection of your personal data.

Detailed description of how we process your personal data

The below charts describe in detail why we process your personal data, which categories of personal data we process, our legal basis for the processing and for how long we process your personal data. The legal basis is the basis for our processing of your personal data according to the GDPR.

This is partly such information we have a legal obligation to provide and might feel a bit long and complicated – do not hesitate to contact us if you have any questions regarding our processing of your personal data. Our contact detailscan be found in the beginning of this privacy policy.

Processing which we are solely responsible for

If you use MATCHi

To administrate your MATCHi account

To provide you with the features of your MATCHi account

To collect information from our connected partners and venues

To provide customer service and support

To analyse how MATCHi is used

To send newsletters, surveys and keep you informed

If you have any questions or queries

We always strive to keep a good relationship with you and answer all questions you may have. If you have any questions, would want to make a complaint regarding MATCHi or if we would have a claim against you as a user, we will process your personal data as described below. We will collect your personal data from you or provide the information ourselves.

Note that an ongoing matter may mean that we cannot delete all your personal data after your request.

To handle any cancellations, complaints or claims

If you object to receiving marketing from us

We will store information about you who have chosen to object to receiving marketing from us – see the below chart for information about this. We have received the personal data from you.

To comply with marketing legislation

To comply with bookkeeping, accounting and transaction related obligations

Processing which we and our partners & venues each have its own responsibility for

For certain processing of your personal data, we act as processor to our partners and venues where they include some of your personal data in MATCHi. In many cases, this personal data overlap with the data that we ourselves control and sometimes it might contain more information, often such as membership status. This means that if you are a MATCHi user and make a purchase or booking at a venue or enter an activity or competition, we will forward your information to the venue as you are their customer or member and they are responsible for how they process your data independently of us.

If you have a request regarding the data we process on behalf of our partners or venues, we will always have to consult the controller before we take any action. If you want information about how the respective venue or partner processes your data, we direct you towards the venue and you can always find contact details to the responsible partner or venue in MATCHi and in your booking information or receipt. If you are a member or customer of a particular venue, other venues which are not affiliated with your venue will not be able to access your personal data that is processed by us on behalf of a particular venue.

The data that may overlap is described in the schedule below listing our purposes and legal basis on which we process it. The below is provided to give an overview of the information involved and is not meant to be exhaustive. Each venue processes information for their own purposes, which might differ from ours and make their own decision on what ground the processing takes place.

To administrate your bookings, purchases, activities, applications and memberships

What are your rights when we process your personal data?

• A detailed description.

You have certain rights regarding your personal data and we outline them below.

If you want to know more or if you want to exercise any of your rights, please contact us and we will do our best as we are happy to help. Our contact information can be found at the beginning of this privacy policy.

Right to information and access

You have the right to obtain confirmation as to whether we are processing personal data about you or not.

In detail: Information we provide include the following:

- the purpose of the processing;

- categories of processed personal data;

- recipients or categories of recipients to whom personal data can be shared, especially if located in third countries;

- expected retention times for storage or the criteria used to establish such time;

- information about your rights to have personal data corrected, deleted or limit the processing thereof or your right to object to such processing;

- your right to lodge a complaint with a supervisory authority;

- any application of automated decision making, including profiling in accordance with GDPR, articles 22.1 and 22.4; and

- if personal data is transferred to a third country or international organisation, you also have the right to information about what measures, in line with GDPR article 46, have been taken to ensure an appropriate level of data protection.

You also have the right to obtain a copy of the personal data processed by us. Should you request more copies we may choose to charge a reasonable fee to cover administrative costs. If the information is requested via e-mail, you will receive the information in a common electronic format.

Right to rectification

You have a right to correct any inaccurate personal data concerning you that we may be processing and to ask us to have incomplete personal data completed.

In detail: With consideration of the purpose you have a right to complete any non-complete personal data. If possible and within reasonable efforts, we will inform each recipient with whom the personal data has been shared in case of any rectification. If you want more information about such recipients you are welcome to contact us. Our contact information can be found at the beginning of this policy.

Right to erasure (“the right to be forgotten”)

Under certain circumstances, you have a right to request that we delete your personal data. In addition to our own processing of personal data, we also process data on behalf of venues as data processors. If you request that MATCHi delete your personal data, we will handle your request as related to our own processing but should you also want a venue to stop processing your personal data, you must contact the venue directly.

In detail: You have the right and we have the obligation to delete your personal data without undue delay if any of the following applies:

- personal data are no longer necessary for purposes which they were collected or processed,

- you object to the processing pursuant to Article 21.1 of the GDPR and there are no legitimate reasons for the processing outweighing your reasons, or you object to the processing in accordance with Article 21.2 of the GDPR,

- personal data has been non lawfully processed, or

- personal data must be deleted in order to fulfil a legal obligation under EU law or any applicable national law to which we are subject.

In the event that we have made public the personal data and are required to delete it as above, we will, taking into account available technology and the cost of implementation, take reasonable steps including technical measures, to notify the controllers of your request and that you wish they delete any links to, or copies or reproductions of specific personal data.

Please note that our obligation to delete and notify does not apply to the extent processing is necessary for the following reasons:

- to exercise the right to freedom of expression and information,

- to fulfill legal obligations under EU law or applicable national law to which we are subject, or

- to be able to establish, assert or defend legal claims.

We delete your personal data at your request, provided that we do not have an obligation to save the personal data in accordance with applicable laws and regulations.

We will notify each recipient to whom the personal data has been shared of any deletion that has taken place as described above, unless this proves to be impossible or entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. You will find ourcontact information at the beginning of this privacy policy.

Right to restrict processing

Under certain circumstances, you also have a right to request that we restrict our processing of your personal data.

In detail: The right applies if:

- you dispute the accuracy of the information (but only for such time that allows us to verify),

- the processing is illegal and you oppose the deletion of personal data and instead request a restriction on the use of the data,

- you need the personal data to assert or defend legal claims even though we no longer need the data for our purposes, or

- you have objected to the processing in accordance with Article 21.1 of the GDPR and we have not done an assessment of whether our legitimate interest in the processing outweighs your legitimate reason for restricting the processing of your personal data.

If the processing referred to above is restricted, such personal data (with the exception of storage) may only be processed with your consent or to establish, assert or defend legal claims or to protect the rights of any other persons or for reasons of public interest. Furthermore, we will notify you before ceasing to restrict any processing.

We will notify each recipient to whom the personal data has been disclosed of any restriction on processing taken place as described above, unless impossible or if it entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. You will find our contact information at the beginning of this privacy policy.

Right to data portability

Under certain circumstances, you have a right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another company (“data portability”).

In detail: The right to data portability applies to personal data that you have provided to us in a structured, widely used and machine-readable format, if the processing is based on the legal basis of performance of contract (GDPR, Article 6.1 b) and the processing is automated.

The exercise of the right to data portability does not affect the application of Article 17 of the GDPR, which shall not apply to processing that is necessary for the performance of a task of general interest or that is part of the exercise of authority performed by us.

Your right to data portability must not adversely affect the rights and freedoms of others.

Right to withdraw your consent and object to processing

You have a right to object to our processing of your personal data when the processing is based on the legal basis “legitimate interest” and we will always consider your objection. You always have a right to withdraw any consent you have given us, partly or completely. For example you can always withdraw consent to use your data for marketing and profiling purposes, such as sending newsletters, surveys or giving you customised suggestions. You can read more about this in the charts above.

In detail: If you object, we may no longer process your personal data as long as we can not demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms or whether it is for the determination, exercise, or defence of legal claims.

Right to lodge a complaint with a supervisory authority

You always have the right to lodge a complaint with a supervisory authority. You may do this in the EU/EEA member state where you live, work or where an infringement of applicable data protection laws is alleged to have occurred. The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).

Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests”

As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs other concerns. This assessment is done with caution and we strive to strike a fair balance.

If you want more information about any aspect of how we process your data or if you want to exercise any of your rights, you are very welcome to contact us. Our contact information can be found in the beginning of this privacy policy.

***

This Privacy Policy was adopted by MATCHi AB on the 21 of July 2022 and the latest revision was made on the 31 of October 2023.