Privacy Policy of the Website and the Application

Version 4 · Updated 5 October 2026

This is a translation; in case of discrepancy the Spanish version prevails.

This Privacy Policy governs the processing of personal data carried out by RALLY RATING, S.L. (hereinafter, the "Data Controller") through the website rallyrating.app (hereinafter, the "Website") and the RALLY mobile application (hereinafter, the "Application" or the "App"), jointly referred to as the "Platform".

The Data Controller is committed to protecting users' personal data and guarantees that it is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD") and other applicable legislation.

1.-WHO IS THE DATA CONTROLLER?

Data Controller: RALLY RATING, S.L.

Tax ID: B88743380

Registered office: Calle del Príncipe de Vergara 86, 1ª, 28006 Madrid

Contact email: support@rallyrating.app

Privacy email: hello@rallyrating.app

2.-WHAT PERSONAL DATA DO WE COLLECT?

The Data Controller collects personal data provided directly by the user during:

registration
access to the Website
use of the Application
use of sporting and statistical features

Certain technical data may also be collected automatically through the operation of the Website and the Application.

Types of data we process:

Identification and contact data: first and last name, email address and username. The profile image is generated automatically from the user's initials; no photographs are collected.

Profile and sporting data: date of birth (optional), gender (optional), city of residence and country. Country is taken from the region setting of the user’s device; the Platform does not access the device’s geolocation. Sport played (tennis or padel), match history, rivals and results, playing surface, ranking and rating history, sporting metrics and analysis of sporting performance.

Level data declared at sign-up: years playing the sport, federation rating or level and other answers to the initial level questionnaire, used to calculate the user’s starting rating.

Social connection data: friend requests sent, received, accepted and declined; the friends list and the date of each connection; and friend suggestions generated from mutual friends and users the user has played recorded matches with on the Platform.

Availability and match data: time slots marked as available; open matches posted or joined; match proposals; match status (open, locked, cancelled or played); and any external court-booking link the user pastes.

Match chat messages: message content, sender, and date and time.

Competition participation data: competitions joined, scheduled and played matches, results and standings position.

The Platform does not access the user’s device address book.

The Platform does not use sporting data to infer information about users' health.

The Platform does not process special categories of data under Article 9 GDPR.

Moderation and safety data: reports submitted by the user or received in relation to the user, the reason and detail provided in the report, and blocks made between users, together with the date of each of these records.

Technical data: IP address, Device ID, Operating System, Browser type, date and time of access, technical logs, push notification token (collected only after the user grants the relevant permission) and information on use of the Website and/or Application. The Platform does not currently use third-party analytics, advertising or tracking tools.

User ID: The Data Controller assigns the user an internal unique identifier in order to manage their activity within the Platform and ensure that rankings and statistics function correctly.

The Platform is aimed exclusively at persons over 18 years of age. On sign-up, the user declares they are over 18. The Data Controller does not knowingly collect data from minors.

Should accounts belonging to minors be detected, the Data Controller may:

suspend the account
delete the associated data
request documentation proving age

The Data Controller may also implement additional age verification mechanisms in line with future regulatory obligations.

Children’s Privacy (COPPA). The Platform is not directed at children under 13, and Rally does not knowingly collect personal information from children under 13 in compliance with the U.S. Children’s Online Privacy Protection Act (COPPA). If Rally becomes aware that it has collected personal information from a child under 13, it will promptly delete that data. Parents or guardians who believe that their child has provided personal information may contact hello@rallyrating.app.

3.-FOR WHAT PURPOSES DO WE USE YOUR DATA?

Personal data may be processed for the following purposes:

To manage user registration and accounts.
To enable access to and operation of the Website and/or the Application.
To generate sporting rankings, ratings and statistics.
To calculate the starting rating from the level questionnaire.
To manage friend requests, the friends list and friends ranking.
To suggest friends based on mutual friends and users the user has played recorded matches with on the Platform.
To show the user’s profile, rating and availability to friends and, subject to the user’s privacy settings, to friends of friends, and to enable invitations and friend links.
To enable username searches solely to log a match played between users.
To manage availability and open matches and propose four-player matches by rating and availability. This is not a decision with legal or similarly significant effects under Article 22 GDPR; the user decides whether to join.
To enable match chat.
To manage competition entries, schedules, results and standings.
To manage match results and sporting histories.
To ensure the security of the Platform and prevent fraudulent activity.
To manage reports and blocks between users, to moderate content and conduct contrary to the General Terms and Conditions of Use, and to take the appropriate measures in relation to offending accounts.
To respond to queries, incidents or requests.
To improve the operation and user experience.
To comply with applicable legal obligations.
To send communications relating to the service.

Additionally, and only where the user has given prior consent:

To send commercial or promotional communications.
To carry out statistical analysis and non-essential advanced analytics.

Profiling. Where the user consents, the Data Controller will build profiles from the data provided at registration and from the user's sporting activity on the Platform, in order to personalise the experience and to direct communications and recommendations suited to their sporting profile. This profiling is not based solely on automated means producing legal or similarly significant effects for the user within the meaning of Article 22 GDPR. The user may object to this processing or withdraw their consent at any time.

4.-WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR DATA?

The legal bases legitimising the processing of data are:

Performance of the contractual relationship: Art. 6.1.b GDPR, to create and manage your account, provide the services offered, calculate the starting rating from the level questionnaire, generate rankings and statistics, enable use of the Platform, manage friends, enable friend links and username searches solely to log matches played between users, open matches and availability, match proposals, match chat, competitions and standings.

Compliance with legal obligations: Art. 6.1.c GDPR. For processing necessary under applicable legislation.

Legitimate interest: Art. 6.1.f GDPR. Fraud prevention, security of the Platform, detection of abuse, management of reports and blocks, moderation of content and conduct, technical improvement of the service, friend suggestions based on mutual friends and users the user has played recorded matches with on the Platform, visibility of the user’s profile, rating and availability to friends of friends, and retention of reported messages for moderation. The user may object at any time by switching off “Visible to friends of friends” in the App privacy settings, in which case their profile, rating and availability will be visible only to accepted friends. Availability will be shown to friends of friends only if the user expressly enables it.

Consent: Art. 6.1.a GDPR. For sending commercial communications, or non-essential analytics technologies and optional features. Marketing consent may be withdrawn at any time via the switch in the App’s Settings. The user may withdraw other consent at any time.

Withdrawal of consent. Users may withdraw marketing consent at any time via the switch in the App’s Settings, or withdraw other consent through the in-app privacy settings or by emailing hello@rallyrating.app. Withdrawal of consent is as easy as giving it, in accordance with Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

5.-WITH WHOM DO WE SHARE YOUR DATA?

The Data Controller may share data with providers that supply services necessary for the operation of the Platform, including:

cloud hosting
authentication
technical support
communications

All providers act as data processors and are subject to contractual obligations of confidentiality and security.

Data may be disclosed to the competent authorities where there is a legal obligation to do so.

Certain information may be visible to other users as follows:

Accepted friends see the user’s profile, rating, friends ranking, availability and open matches.
Friends of friends (one step only) see the username, initials, city, sport and rating and, if enabled, availability and open matches, unless this is switched off.
Friend link: when the user shares their friend link, the associated web page shows their first name, rating and city to anyone who has the link, whether signed in or not. The user decides with whom to share the link.
Username search: any signed-in user can find another user by username and see their rating, unless hidden, solely to log a match played between them.
Match chat is visible only to the four players and, for reported messages, RALLY’s moderation team.
League standings are visible to all signed-in users of the App, never published on the Website or accessible without signing in. Private competition standings are visible only to their participants and organiser.
Apart from the shared friend link, username search for match logging and league standings, unconnected users do not see the user’s profile.
Blocked users cannot see or interact.
Clubs named as venues receive no personal data via the Platform. Third-party booking links (e.g. Playtomic) are governed by the relevant third party’s privacy policy.

Reports between users are treated confidentially. The identity of the reporting user is not disclosed to the reported user.

6.INTERNATIONAL DATA TRANSFERS

Some of the technology providers supplying services to the Data Controller (cloud hosting, authentication, technical support, communications and other services necessary for the operation of the Platform) may be located outside the European Economic Area (EEA) or process data from third countries. In such cases, the Data Controller may transfer personal data to those third countries.

These international transfers will be carried out only where one of the appropriate safeguards provided for in Chapter V of the GDPR applies, in particular:

Adequacy decisions: where the European Commission has declared that the third country, territory or sector guarantees an adequate level of protection (Article 45 GDPR).

Standard contractual clauses (SCCs): entering into with the provider the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical, organisational and contractual measures (Article 46.2 GDPR).

Other legally recognised mechanisms: any other appropriate safeguard permitted by applicable legislation, such as binding corporate rules or, failing that, the derogations for specific situations provided for in Article 49 GDPR.

Users may obtain further information about the safeguards applied to these transfers, and a copy of the mechanisms adopted, by writing to: hello@rallyrating.app.

7.HOW LONG DO WE KEEP YOUR DATA?

Personal data will be retained:

for as long as the user keeps their account active
for as long as it is necessary in order to provide the service
for the periods required by law
Friend connections are retained until the connection is removed or the account is deleted.
Regular weekly availability is kept until the user changes it or deletes their account. One-off availability dates are deleted automatically once the date has passed.
Unlocked open matches are deleted on expiry.
Results form part of the user’s sporting history.
Competition standings are kept while the competition exists and then merged into sporting history or anonymised.

Match chat messages are deleted automatically twenty-four (24) hours after the scheduled start time of the match or, if the match is cancelled, immediately upon cancellation. This applies to both friend matches and league and competition matches. Where a message has been reported before deletion, RALLY will keep a copy of the reported message and the context messages immediately preceding and following it, isolated from the chat and accessible only to the moderation team, until the report and any appeal have been resolved and for twelve (12) months after resolution, after which they will be deleted. This retention applies even if the reporting user or the reported user deletes their account. If a longer period is required by law or for the establishment, exercise or defence of legal claims, the data will instead be kept blocked under Article 32 LOPDGDD.

When data is no longer necessary, it will be deleted or may be retained in blocked form in accordance with applicable legislation.

Reports and moderation records will be retained for as long as necessary to handle the incident, take the appropriate measures and demonstrate compliance with our obligations, and in any event for the periods required by law.

Statistical or anonymised data may be retained indefinitely where it does not allow the user to be identified.

8.WHAT RIGHTS DOES THE USER HAVE?

To the extent applicable, users may exercise the following rights before the Data Controller free of charge:

The right to request access to their personal data and therefore to know how we are processing their data and what that data is.

The right to request rectification of their data where it is inaccurate, incomplete or out of date.

The right to request erasure of their data (the right to be forgotten) where, among other cases, it is no longer necessary for the purposes for which it was collected, they withdraw their consent, or they object to the processing, without prejudice to the retention periods required by law.

The right to request restriction of processing in certain circumstances, meaning that we may temporarily restrict its processing or retain it beyond the necessary period.

The right to object to the processing of their data, among other cases where the processing is based on the Data Controller's legitimate interest.

The right to withdraw, at any time, consent given for those purposes based on it. Marketing consent may be withdrawn at any time via the switch in the App’s Settings.

The right to request the portability of your data for processing based on the performance of a contract or on consent.

These rights may be exercised by sending written communication to the postal address at Calle del Príncipe de Vergara 86, 1ª, 28006 Madrid or by email to hello@rallyrating.app, telling us which right you wish to exercise.

The user may switch off “Visible to friends of friends” in the App privacy settings; if switched off, their profile, rating and availability will be visible only to accepted friends, and availability will be shown to friends of friends only if the user expressly enables it.

Rally will respond to data subject rights requests without undue delay and in any event within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of the requests. Where the period is extended, Rally will inform the user of the extension and the reasons for the delay within the initial one-month period, in accordance with Article 12(3) GDPR.

Users may also delete their account at any time from within the Application, in the settings section.

Finally, we inform you that you have the right to lodge a complaint with the relevant data protection authority, which in Spain is the Spanish Data Protection Agency, www.aepd.es

9.SECURITY MEASURES

The Data Controller has adopted the technical and organisational measures necessary to safeguard the security, integrity, availability and confidentiality of your data. This includes internal review and verification processes covering the measures applied to guarantee the security of the processing.

10.DATA BREACH NOTIFICATION

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, Rally will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to affected individuals, Rally will also notify those individuals without undue delay, in accordance with Article 34 GDPR. Rally will also comply with applicable U.S. state data breach notification laws.

11.CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

This section applies to California residents.

Categories of personal information. Rally may collect the categories of personal information described in Section 2, including identification and contact data, profile and sporting data, level data declared at sign-up, social connection data, availability and match data, match chat messages, competition participation data, moderation and safety data, technical data and User ID data.

Sale and sharing of personal information. Rally does not sell or share personal information with third parties for commercial purposes or cross-context behavioural advertising.

California residents may have the following rights, subject to applicable legal limitations:

The right to know what personal information Rally collects, uses, discloses or sells, including the categories and purposes of such activities.
The right to delete personal information collected from them, subject to applicable exceptions.
The right to opt out of the sale or sharing of personal information.
The right to non-discrimination for exercising these rights.

Users may exercise California privacy rights by emailing hello@rallyrating.app.

Do Not Track. The Platform does not currently respond to Do Not Track signals. Rally will update this Privacy Policy if it adopts a Do Not Track standard in the future.

12.AMENDMENTS TO THE PRIVACY POLICY

The Data Controller may amend the Privacy Policy to adapt it to changes that may occur in the Application, legislative changes or any other. The Data Controller may publish such amendments in the Application, so we recommend that you review this Privacy Policy periodically.

Version 4 · Updated 5 October 2026