Privacy Policy

1. Introduction

This privacy policy explains which personal data we process when you use the booking platform booking.patoclub.de, the PATO app and our locations, and which rights you have under the General Data Protection Regulation (GDPR).

2. Controllers

The operator of the Platform and controller for your customer account, the app and the website is:

For handling your bookings (provision on site, payment, invoice, record keeping) the operator of the booked location is also responsible: PicklePoint GmbH, Königinstraße 34, 80802 Munich, for the Reitschule location and PATO Sport GmbH for the Werksviertel-Mitte location. To this extent PATO Sport GmbH and the operators are joint controllers under Art. 26 GDPR and have agreed who fulfils which obligations. You can exercise your rights against any of the controllers – most easily via booking@patoclub.de.

We have not appointed a data protection officer as there is no legal obligation to do so.

3. Data we process

• Account data: name, email address, phone number (optional), date of birth (optional), profile picture (optional), skill level and ranking data
• Booking data: booked courts, events, extras, participations, check-ins and billing address
• Payment data: payments, reservations, refunds and the payment method saved with Stripe (we only see card type, last four digits and expiry date)
• Fitness memberships: provider and check-in status when you redeem a membership
• Communication: support requests, newsletter consent
• App data: push token and device information if you allow notifications
• Technical data: IP address, browser, device, operating system, cookies and usage data

4. Purposes and legal bases

• Customer account, bookings, shared games, rankings and customer service – performance of contract (Art. 6 (1) (b) GDPR)
• Payment processing, saving your payment method and subsequent charges under our terms – performance of contract (Art. 6 (1) (b) GDPR)
• Invoices and record keeping under tax and commercial law – legal obligation (Art. 6 (1) (c) GDPR)
• Security, protection against fraud and bots, error analysis – legitimate interest (Art. 6 (1) (f) GDPR)
• Web analytics and measuring advertising campaigns (Google Analytics, Google Ads, Meta) – only with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG)
• Newsletter and push notifications – with your consent (Art. 6 (1) (a) GDPR), revocable at any time

5. What other users see

Your name and, where applicable, your profile picture and skill level are visible to other users in rankings, event participant lists and shared games. In split bookings, the host sees which fellow players have paid their share.

6. Saved payment method

Payments are processed by Stripe. Your payment method is saved with Stripe so that you can pay faster for later bookings and so that the subsequent charges listed in our terms are possible. Neither we nor the operators receive full card details. You can remove saved payment methods at any time in the payment form or have them deleted via booking@patoclub.de.

7. Recipients and service providers

We use the following service providers. Where they act on our behalf, we have concluded data processing agreements with them.

We also share data with tax advisors, authorities or courts where we are legally obliged to do so.

8. Transfers to third countries

Some providers (e.g. Google, Meta, Microsoft, Apple, Stripe, Supabase, Vercel, Mapbox) also process data in the USA. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

9. Retention

• Account data: until your account is deleted
• Booking and invoice data: up to 10 years under statutory retention periods (Section 147 AO, Section 257 HGB)
• Payment methods: with Stripe, until you remove them or your account is deleted
• Newsletter and push: until you withdraw your consent
• Analytics data: according to the retention set in Google Analytics, at most 14 months

10. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless retention obligations apply
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests and to direct marketing (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7 (3) GDPR)

To do so, write to booking@patoclub.de; we respond within one month. You can also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA).

11. Cookies and consent

We only set analytics and marketing cookies if you agree in the cookie banner. You can change your choice at any time.

For details, see our Cookie Policy

12. Data security

• TLS encryption of all data transfers
• Access restrictions and roles for our staff
• Regular updates and encrypted backups

13. Changes

We update this privacy policy when our services or the law change. We will inform you of material changes by email or on the Platform.