Privacy Policy — TopSpin

TopSpin ("the Platform") is an online competitive tennis platform that allows users to create profiles, participate in rating ladders, challenge other players to matches, join tournaments and Americano events, and track their competitive activity.

This Privacy Policy describes how we collect, process, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR — Regulation EU 2016/679) and applicable Greek law.

When you create an account and use the Platform, we collect the following categories of data:

2.1 Data you provide

• Account information: username, real name, email, phone number (optional).
• Profile data: profile picture, bio, language preferences.
• Content you submit: match results, evidence (screenshots, files), challenge messages, reports.
• Payment data: transaction records (amount, method, date, status) and — for academy subscribers — a Stripe customer identifier. Full payment card numbers are processed and stored solely by Stripe and are never collected or stored by TopSpin.

2.2 Data collected automatically

• Activity data: matches, challenges, tournament and Americano entries, rating, statistics, rankings.
• Technical data: IP address, device type, browser, referrer pages.
• Cookies: see our Cookie Notice.

We process your data for the following purposes:

We use cookies and similar technologies to operate the Platform, store preferences, and collect usage statistics. For details, see our Cookie Notice.

We do not sell your personal data to third parties. We may share data in the following cases:

• Service providers: With third-party providers who help us operate the Platform (hosting, email delivery, data analytics), under strict contractual guarantees.
• Public profiles: Your username, rating, ranking, match record, and real name are displayed publicly on the Platform. Your phone number and email remain private.
• Legal obligations: If required by law or by a judicial authority.
• Payment processor (Stripe): Payment data is shared with Stripe Inc. solely for processing transactions. Stripe's use of your data is governed by its own privacy policy. We do not store full payment card numbers.

Your data is hosted on servers within the European Economic Area (EEA). If we use providers that transfer data outside the EEA, we ensure appropriate safeguards (e.g., EU Standard Contractual Clauses).

We retain your data for as long as your account remains active. After account deletion, data is deleted or anonymised within 30 days, unless retention is required for legal reasons (e.g., tax legislation).

We apply appropriate technical and organisational security measures:

• HTTPS encryption on all communications
• Password encryption (bcrypt/hash)
• Role-based access controls (RBAC)
• Regular backups
• Restricted staff access to user data

As a data subject, you have the following rights under GDPR:

• Right of access: Obtain a copy of your data.
• Right to rectification: Correct inaccurate data.
• Right to erasure: Request deletion of your data ("right to be forgotten").
• Right to restriction: Restrict processing.
• Right to portability: Receive your data in a structured, commonly used format.
• Right to object: Object to processing for direct marketing purposes.
• Withdrawal of consent: Where processing is based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of the above rights, contact us at topspingr@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

You may withdraw your consent for processing based on consent (e.g., analytics cookies) at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To withdraw your consent you can:

• Adjust cookie settings via the cookie banner
• Delete your account from your profile settings
• Contact us at topspingr@gmail.com

The Platform is intended for individuals aged 16 and over. If you are under 16, you may not create an account without parental or guardian consent. If we discover that we have collected data from a minor without consent, we will delete that data.

We may update this Privacy Policy periodically. Changes will be communicated via the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy.

For any questions regarding this Privacy Policy or the processing of your data, contact us at topspingr@gmail.com.