Privacy Policy
Last updated: 14-11-2026
This is a translation for convenience. If there is any difference, the Portuguese version prevails.
This policy explains what personal data we process, why, on what legal basis, for how long, and what your rights are. It applies to the tennislovers.pt website, our communications and Tennis Lovers tennis lessons. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese Law no. 58/2019.
1. Who is the controller
Associação Raquetes para Todos (ARPT), the association that runs Tennis Lovers lessons.
- Tax number (NIPC): 517824779
- Address: Rua Gonçalves Zarco, 1706, 4450-685 Matosinhos, Portugal
- Email for privacy matters: geral@arpt.pt
We have not appointed a data protection officer, as we are not required to. Any question can be sent to the email above.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Identification and contact | Name, email, phone, date of birth | The data subject or their legal representative |
| Invoicing and payments | Tax number (NIF), billing address, amounts paid, payment method | The data subject |
| Lessons | Pack hours, lessons booked and taken, lesson venue | Coach and ARPT records |
| Communications | Messages exchanged by email, phone or WhatsApp | The data subject |
| Image | Photos and videos of lessons | Taken by ARPT, with consent |
| Browsing | IP address and technical request data, logged by the website host | Collected automatically on the website |
We do not store card details: card payments are processed directly by the payment service provider. We do not buy data from third parties and we do not take solely automated decisions with legal effects on you.
3. Why we use the data, on what basis and for how long
| Purpose | Legal basis (art. 6 GDPR) | Retention period |
|---|---|---|
| Answering enquiries and booking lessons | Steps taken at the data subject’s request before a contract | 12 months if no lessons follow |
| Managing packs, bookings and lessons taken | Performance of a contract | Length of the contract and then 5 years to defend legal claims |
| Invoicing and meeting tax and accounting obligations | Legal obligation | 10 years |
| Service messages (bookings, changes, end of packs) | Performance of a contract | Length of the contract |
| Answering complaints | Legitimate interest; legal obligation (Complaints Book) | As long as needed to reply; Complaints Book: 3 years |
| Publishing photos and videos on the website and social media | Consent | Until consent is withdrawn |
| Keeping the website secure and preventing abuse | Legitimate interest | Up to 12 months |
Where the basis is a contract or a legal obligation, we cannot provide the service without the data. When the period ends, the data is deleted or anonymised.
4. Who we share data with
We do not sell personal data. We only share it with those who help us provide our services (processors, bound by contract and confidentiality) or when the law requires it.
| Entity | Purpose |
|---|---|
| Google (Workspace) | Email and document storage |
| Cloudflare | Website hosting |
| Supabase | Lesson management database (servers in the EU) |
| Vendus | Invoicing software |
| Teya | Card payments |
| Certified accountant | Accounting and tax obligations |
| Tax Authority and other authorities | When required by law |
When you contact us via WhatsApp, Instagram or Facebook, those platforms process the data as independent controllers, under their own privacy policies. The same applies to the clubs where lessons take place, regarding access to their facilities.
5. Transfers outside the European Union
Some providers (for example Google and Cloudflare) may process data outside the European Economic Area, mainly in the USA. These transfers only take place with appropriate safeguards: a European Commission adequacy decision (including the EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses approved by the Commission. You can ask us for a copy of these safeguards.
6. Cookies
The tennislovers.pt website does not use statistics or advertising cookies and does not set cookies on your device. If we start using them, we will ask for your consent first.
7. Your rights
Under articles 15 to 22 of the GDPR, you may at any time:
- access your data and get a copy;
- ask for inaccurate or incomplete data to be corrected;
- ask for your data to be erased, when it is no longer needed or there is no basis to keep it;
- ask for processing to be restricted;
- receive the data you gave us in a structured format (portability);
- object to processing based on legitimate interest;
- withdraw consent, without affecting the lawfulness of processing already carried out.
To exercise a right, write to geral@arpt.pt or to the address in section 1. It is free of charge and we reply within one month, extendable by two further months in complex cases (we will tell you if so). We may ask for information to confirm your identity.
8. Complaint to the CNPD
If you believe your data has been processed unlawfully, you can complain to the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) at www.cnpd.pt. We would appreciate it if you contacted us first, so we can try to solve the issue.
9. Minors
Lessons for minors are contracted by their parents or legal representatives, who provide and manage the minor’s data and give the necessary consents (for example, for photos).
10. Security
We apply appropriate technical and organisational measures: access limited to those who need the data, authentication on our platforms, encrypted communications (HTTPS) and providers with security guarantees. In the event of a data breach, we notify the CNPD within 72 hours when required by law and inform data subjects whenever there is a high risk to their rights.
11. Changes to this policy
We may update this policy. The date of the last update is at the top. If the changes are significant, we will tell you by email or on the website.