Courtesy translation: only the French version is legally binding.
GDPR compliance · Article 30
Record of processing activities
Last updated: 2 September 2026
In accordance with Article 30 of the GDPR and the EDPB guidelines WP 248 rev. 01, PickleDeck keeps a record of personal data processing activities. The table below presents its public version: 15 processing activities, each with a single legal basis, the categories of data subjects, the data collected, the recipients and the retention period.
The security measures associated with each processing activity are described on the /securite page. The list of subprocessors is published separately at /securite/sous-traitants.
Processing activity no. 1
User accounts (auth, profile)
- Legal basis
- Contract (T&Cs)
- Data subjects
- Adult players, Minors 15-17, Minors <15, Organisers, Co-organisers / Referees, Volunteers
- Data
- Email, surname, first name, hashed password (bcrypt), optional telephone, date of birth
- Recipients
- PickleDeck technical team, Supabase
- Retention
- Active account + 3 years inactive → anonymisation
Processing activity no. 2
Tournament entries
- Legal basis
- Contract
- Data subjects
- Adult players, Minors 15-17, Minors <15
- Data
- Identity, team, event, status
- Recipients
- Tournament organiser, co-organisers
- Retention
- 5 years (sports history)
Processing activity no. 3
Payments & invoicing
- Legal basis
- Legal obligation (Art. L123-22 French Commercial Code)
- Data subjects
- Paying players, Organisers
- Data
- Billing identity, amount, payment method (never card data)
- Recipients
- HelloAsso, Stripe Connect, PickleDeck accountant
- Retention
- 10 years
Processing activity no. 4
Transactional communications (Resend)
- Legal basis
- Performance of the contract
- Data subjects
- All accounts
- Data
- Email address, transactional content
- Recipients
- Resend (EU)
- Retention
- Resend logs 30 days, content on our side 1 year
Processing activity no. 5
Push notifications (mobile + web)
- Legal basis
- Consent (Art. 6.1.a GDPR)
- Data subjects
- Opted-in players
- Data
- Push token, notification preferences
- Recipients
- Apple APNs, Google FCM, browser Web Push API
- Retention
- Until unsubscribed
Processing activity no. 6
Player social network (privacy_settings, friendships)
- Legal basis
- Consent (Art. 6.1.a GDPR)
- Data subjects
- Opted-in players
- Data
- Public profile, friendship links, club membership
- Recipients
- Other players depending on privacy settings
- Retention
- Until withdrawn
Processing activity no. 7
Publication of sports results
- Legal basis
- Legitimate interest (with right to object, Art. 21 GDPR)
- Data subjects
- Players who have played a match
- Data
- Name, ranking, scores, performance
- Recipients
- Public visitors, FFT/DUPR if synchronised
- Retention
- For the lifetime of the account
Processing activity no. 8
DUPR synchronisation
- Legal basis
- Explicit consent (Art. 6.1.a GDPR)
- Data subjects
- Players who have connected DUPR
- Data
- Identity, confirmed scores, token encrypted in the database and never read back by the application
- Recipients
- DUPR (United States, covered by SCC)
- Retention
- Until the token is revoked
Processing activity no. 9
FFT synchronisation (sub_ranking, club_code)
- Legal basis
- Legitimate interest
- Data subjects
- FFT licence holders
- Data
- Licence number, sub_ranking, club code
- Recipients
- FFT
- Retention
- While the licence is active
Processing activity no. 10
Photos & media (avatars, club logos, sponsors, posters)
- Legal basis
- Contract
- Data subjects
- Uploaders (players, organisers)
- Data
- Uploaded images
- Recipients
- Cloudinary (United States, covered by SCC)
- Retention
- Until deleted
Processing activity no. 11
Security & audit logs
- Legal basis
- Legal obligation (LCEN law, CNIL deliberation no. 2013-378)
- Data subjects
- All access
- Data
- IP address, user agent, action, timestamp
- Recipients
- PickleDeck DPO, authorities on judicial request
- Retention
- 1 year
Processing activity no. 12
Moderation & banning
- Legal basis
- Legitimate interest
- Data subjects
- Reported accounts
- Data
- Reason, sanction, timestamp
- Recipients
- DPO + super administrator
- Retention
- 3 years after the sanction
Processing activity no. 13
Image rights (per tournament)
- Legal basis
- Consent (Art. 6.1.a GDPR + Art. 9 French Civil Code)
- Data subjects
- Players entered in a tournament
- Data
- 3 separate consents (PickleDeck publication, club social media, external press), timestamp, version, IP, user agent
- Recipients
- Organiser, media designated according to consent
- Retention
- 3 years (CNIL recommendation)
Processing activity no. 14
Tournament reviews & testimonials
- Legal basis
- Marketing consent
- Data subjects
- Players who have rated a tournament
- Data
- Name (depending on preference), comment, rating
- Recipients
- Public visitors of the tournament
- Retention
- 5 years
Processing activity no. 15
Audience measurement (Vercel Analytics)
- Legal basis
- Consent (cookies, tarteaucitron banner)
- Data subjects
- Anonymous visitors
- Data
- Aggregated metrics without PII
- Recipients
- Vercel
- Retention
- 13 months (cookie lifetime)
Processing activity no. 16
Partner ad slot management (impressions, clicks)
- Legal basis
- Legitimate interest for signed-in accounts (player area, organiser console); consent (cookies, tarteaucitron banner) for anonymous visitors to live pages
- Data subjects
- Signed-in players, Signed-in organisers, Anonymous visitors to live pages
- Data
- Account identifier or anonymous visitor key (pd_visiteur cookie, signed, no personal data), campaign shown, timestamp of the impression, click or dismissal
- Recipients
- PickleDeck only; advertisers only receive totals
- Retention
- 13 months (visitor cookie lifetime); counts kept for the duration of invoicing
References cited: GDPR Art. 30, EDPB guidelines WP 248 rev. 01.
For any question about the record, contact the DPO: dpo@pickledeck.com · +33 6 24 37 93 07.