Privacy Policy

1. Data We Collect

1.1 Account and Profile Data

• Name, email address, and password (stored as a secure hash)
• Location (city and country — optional, provided during registration)
• Profile image URL (if you set one)
• User roles (player, coach, manager, admin)
• Account creation date and activity timestamps

1.2 Coach Profile Data

• Bio, specialties, and hourly rate
• LTA coach number (if provided)
• Coaching session schedule and availability
• Approval status

1.3 Booking and Transaction Data

• Court and coaching session bookings (dates, times, session type)
• Payment method used (credit, online, or pay-on-day)
• Stripe customer ID and subscription/checkout session identifiers
• Booking status (confirmed, cancelled, completed, etc.)
• Refund history

1.4 Subscription Data

• Subscription tier, billing interval, and status
• Billing period dates and renewal information
• Stripe subscription and price identifiers

1.5 Match and Competitive Data

• Match results, scores, and match type (singles/doubles)
• Elo-based ranking scores and ranking history
• League and tournament enrolments and outcomes

1.6 Communication Data

• In-platform messages sent between users
• Notifications (coaching booking alerts, system notifications)

1.7 Technical and Usage Data

• IP address and browser/device information
• Pages visited and features used (for platform improvement)
• Authentication tokens (access and refresh tokens, stored in your browser)

1.8 Third-Party Data

• Location suggestions via GeoNames (external service) — only search queries are sent; no personal data is transmitted to GeoNames.
• Payment data processed by Stripe — we receive confirmation of payments and Stripe-assigned identifiers. We do not store your full card number, CVV, or expiry date.

2. How We Use Your Data

3. Who We Share Your Data With

3.1 Other Users

Certain profile information is visible to other users of the platform to enable community features:

• Your first and last name and ranking are visible in league and ranking tables.
• Coach profiles (bio, specialties, rate, availability) are publicly visible to players searching for coaching.
• Match results are visible to participants and league/tournament members.
• In-platform messages are visible only to the sender and recipient.

3.2 Service Providers

• Stripe — payment processing. Stripe processes payments on our behalf and is subject to their own Privacy Policy.
• Cloud hosting provider — our application and database are hosted on Microsoft Azure within the UK/EEA region.

We require all service providers to maintain appropriate security standards and to process your data only on our instructions.

3.3 Legal Disclosure

We may disclose your data if required to do so by law, regulation, or court order, or to protect the rights, property, or safety of OneTennis, our users, or the public.

3.4 Business Transfers

If OneTennis is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change via email or a prominent notice on the Service.

4. International Data Transfers

We store and process your data primarily in the UK and EEA. Where data is transferred outside the UK or EEA (for example, to Stripe's global infrastructure), we ensure appropriate safeguards are in place, such as UK adequacy decisions or standard contractual clauses.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data — retained while your account is active and for up to 2 years after account deletion for legal and dispute resolution purposes.
• Transaction and booking records — retained for 7 years for financial and tax compliance.
• Messages and notifications — retained for 12 months, then deleted.
• Match results and rankings — retained indefinitely as part of the platform's historical competitive record, in anonymised or aggregated form where your account is deleted.

6. Your Rights

Under UK GDPR you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten"), subject to our legal obligations.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@onetennis.co.uk. We will respond within one calendar month. We may need to verify your identity before processing a request.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not complied with data protection law.

7. Cookies and Local Storage

We use browser local storage (not traditional cookies) to store your authentication tokens and session preferences. These are essential for the Service to function and are deleted when you log out. We do not use advertising or tracking cookies.

Third-party services embedded in the platform (such as Stripe) may set their own cookies in accordance with their respective privacy policies.

8. Security

We implement industry-standard security measures to protect your data, including:

• Encrypted HTTPS connections for all data in transit
• Bcrypt password hashing — we never store plain-text passwords
• JWT-based authentication with short-lived access tokens
• Role-based access controls to limit data exposure
• Payment data handled exclusively by Stripe — not stored on our servers

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13 without verified parental consent. Users aged 13–17 must have parental or guardian consent. If you believe we have inadvertently collected data from a child under 13, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised effective date, and where appropriate, by email. We encourage you to review this policy periodically.

11. Contact Us

For any privacy-related questions or to exercise your rights, please contact our data protection contact:

• Email: privacy@onetennis.co.uk
• Website: onetennis.co.uk