Privacy policy

1. Data controller

The PickleDeck platform is published by a micro-enterprise governed by French law. The data controller for personal data within the meaning of the General Data Protection Regulation (EU 2016/679) is:

2. Personal data collected

PickleDeck collects and processes the following categories of personal data, in strict compliance with the data minimisation principle:

2.1 Identity and contact details

2.2 Sports data

2.3 Payment data

Payments are processed entirely by our providers HelloAsso and Stripe. Your bank details and card numbers are never stored on our servers. Only transaction identifiers and amounts are kept for accounting purposes.

2.4 Technical data

IP address and user agent (security logs only). Anonymised browsing data if you consent to Vercel Analytics being enabled.

2 bis. Categories of data subjects

The processing activities documented in our Art. 30 record concern the following categories:

2 ter. Data visibility

Quick summary:

• Publicly visible: first name, surname, photo (depending on preference), rankings, city (depending on preference), sports results.
• Visible to signed-in players: friends, club, advanced statistics.
• Never publicly visible: email, telephone, exact date of birth, FFT licence number, DUPR ID.

Full details on /securite (Visibility section).

3. Purposes of processing

Each data processing activity is based on a GDPR-compliant legal basis:

4. Retention period

Your data is kept for no longer than is strictly necessary for the purposes described above:

5. Recipients of the data

Your data may be passed to the following recipients, for the purposes described above:

6. Transfers outside the European Union

Some of our providers (Vercel, Stripe, Resend, Cloudinary) may process data outside the European Union. These transfers are governed by Standard Contractual Clauses (SCC) approved by the European Commission, guaranteeing an adequate level of protection.

The main database is hosted by Supabase in the EU Dublin (eu-west-1) region, ensuring that your data remains within the European Union.

Tournament reviews

If you have taken part in a tournament organised on PickleDeck, you may receive an email invitation to leave a review. This invitation is optional and can be ignored.

If you decide to share your experience, your first name and the initial of your surname (for example: Marie D.), your rating (1 to 5 stars) and your comment will be displayed publicly on the tournament page. Your email remains strictly private and is never displayed.

You can ask at any time for your review to be deleted by contacting support@pickledeck.com.

7. Your rights

In accordance with the GDPR (articles 15 to 22), you have the following rights over your personal data:

How to exercise your rights

1. Request: send your request to dpo@pickledeck.com, stating the right you are exercising (access, rectification, erasure, portability, objection, restriction).
2. Proof of identity: where there is reasonable doubt about your identity (Art. 12.6 GDPR), you may be asked for a copy of an identity document. This security measure prevents the misuse of rights.
3. Response time: 1 month from receipt of your request. This period may be extended by 2 further months for complex or numerous requests (Art. 12.3 GDPR), with the reasons for the delay given within the month.
4. Appeal: if you are not satisfied with the response, you can lodge a complaint with the CNIL (cnil.fr).

8. Cookies

The detailed list of cookies set (purpose, duration, issuer) can be found on our dedicated /cookies page. You will also find a button there to change your preferences at any time.

Strictly necessary cookies

These cookies are essential for the platform to work and do not require your consent:

• Supabase Auth: authentication session and access tokens
• Referee access: session cookie for the score entry interface
• Tarteaucitron: remembers your cookie choices

Cookies subject to consent

Vercel Analytics: anonymised audience measurement, enabled only if you consent. You can change your choices at any time via the cookie manager available in the footer.

9. Security measures

PickleDeck implements the following technical and organisational measures to protect your data:

• Encryption of communications via HTTPS / TLS
• Encryption of integration tokens in the database, and no reading back of DUPR tokens by the application
• Access control through Row Level Security (RLS) at database level
• Masking of sensitive columns in public views
• HTTP security headers (CSP, HSTS, X-Frame-Options)
• Strict input validation with Zod
• Logging of sensitive actions and access attempts
• Password hashing with bcrypt

10. Data of minors

In accordance with the Informatique & Libertés Act (article 7-1) and article 8 of the GDPR, minors under 15 years of age may only sign up to PickleDeck with the consent of their legal representatives. Parental consent must be obtained before the account is created and before any processing of personal data.

Verification of parental consent will be implemented during 2026 for accounts of minors under 15, in consultation with the federation. Until then, tournament organisers are responsible for checking parental authorisation when a minor enters a tournament they organise.

Minors' data is minimised: no promotional email is sent and no profiling is carried out. At any time, a parent or guardian can request the deletion of a minor's account by writing to dpo@pickledeck.com.

11. Changes to this policy

This policy may be updated to reflect legal or technical developments. In the event of a substantial change affecting your rights or the purposes of processing, you will be informed by email at the address associated with your account, at least 30 days before the changes take effect.

12. Complaint to the CNIL

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

13. Commitments and compliance

Beyond its legal obligations, PickleDeck keeps complete, auditable internal documentation up to date, in line with the accountability approach required by the GDPR:

• Record of processing activities (Art. 30): 12 processing activities documented
• Impact assessment (DPIA) (Art. 35): on 3 high-risk processing activities (authentication, payments, FFT licence holder data)
• Breach procedure (Art. 33-34): CNIL notification within 72h
• Procedure for exercising rights (Art. 12-22): complete methodology, 1 month maximum
• Retention policy (Art. 5.1.e): periods by category, automatic purges
• Minors policy (Art. 8): French 15-year threshold, parental consent
• Architecture diagram (Art. 32): data location, measures by layer
• Secret rotation procedure: inventory and emergency procedure

These documents are available on request to the supervisory authorities (CNIL) or our partner, the Ligue Bourgogne-Franche-Comté de pickleball, at dpo@pickledeck.com.

Our infrastructure can also be audited publicly through recognised security tests (securityheaders.com, Mozilla Observatory, SSL Labs, Hardenize): see the security page.