Privacy policy.

Summary (basic data-protection information)

• Controller: Goudplevier Ltd ("Haypartido").

• Purposes: providing the service (account, bookings, payments, chats and notifications), telling you about the launch if you joined the list, community safety, and legal obligations.

• Legal bases: performance of the contract, consent (communications), legitimate interest (safety) and legal obligation (invoicing).

• Recipients: the processors essential to operate (payments, hosting, SMS and email delivery). We never sell data or share it for advertising.

• Retention: while you hold an account and, afterwards, only for the periods the law requires.

• Rights: access, rectification, erasure, objection, restriction and portability by writing to hola@haypartido.es; you may also complain to the Spanish supervisory authority (AEPD).

The full detail of each point is in the sections below.

1. Data controller

Data controller: Goudplevier Ltd, a company registered in England and Wales, company number 15788470 (Companies House), registered office at Bartle House, 9 Oxford Court, Manchester M2 3WQ, United Kingdom, trading as “Haypartido”.

Privacy contact: hola@haypartido.es

2. What we collect

• Player account data: mobile phone number (your access key), name, date of birth (to verify you are 16 or older), email, preferred position and, if you add them, profile photo and bio.

• Organiser account data: email, password (stored only as a cryptographic hash — never in plain text), name and venue details.

• Usage data: bookings, waitlists, attendance, game-chat messages and direct messages.

• Payment data: processed by Stripe. Haypartido never sees or stores your full card number. If you choose to save a card for future bookings, Stripe stores it in its secure systems; we keep only a reference (brand and last 4 digits), and you can remove it any time from your account.

• Organiser payout data: handled by Stripe Connect (identity and bank-account verification is performed by Stripe).

3. Why, and on what legal basis

• Providing the service (creating your account, managing bookings, payments, refunds, chats and game alerts): performance of a contract (art. 6.1.b GDPR).

• Sending you marketing emails (news and games near you): only with your express consent (art. 6.1.a GDPR), via a checkbox that is never pre-ticked. We record when and where you gave or withdrew that consent, and you can withdraw it at any time from your account or by writing to us.

• Launch list: if you leave us your email (and, optionally, your city and profile) before launch, we use it solely to tell you when the service opens in your area (art. 6.1.a GDPR). We do not use it for other communications or share it, and you can request its deletion at any time by writing to hola@haypartido.es.

• Security, fraud prevention and enforcement of community rules (including account suspensions): legitimate interest (art. 6.1.f GDPR).

• Invoicing and tax obligations: legal obligation (art. 6.1.c GDPR).

4. Minors

Haypartido is for ages 16 and up. We ask for your date of birth at signup and block registration under 16. The service is not directed at minors.

5. Who we share data with (processors)

• Amazon Web Services EMEA SARL: hosting and transactional email (Amazon SES). Data is hosted in the Paris region (European Union).

• Twilio: delivery of the SMS carrying your access code. It receives only your phone number and the message. Twilio may process data outside the EEA with GDPR safeguards (standard contractual clauses).

• Google and Apple: only if you choose to sign in with your Google or Apple account. The provider you pick confirms your identity and returns your name and email. If you sign in with your phone, neither is involved.

• Stripe Payments Europe, Ltd. (Ireland): payment processing, refunds and organiser payouts. Stripe may transfer data outside the EEA with GDPR safeguards (standard contractual clauses).

The data controller is established in the United Kingdom. Transfers of data from the EEA to the UK are covered by the European Commission’s adequacy decision (art. 45 GDPR). Primary data processing and hosting take place within the European Union (AWS Paris region).

We do not sell your data or share it with third parties for advertising.

6. International transfers

Your data is hosted in Amazon Web Services data centres located in the European Union (Paris region, France).

The data controller is established in the United Kingdom. Any access to the data from the United Kingdom is covered by the European Commission’s adequacy decision for the United Kingdom, which recognises that country as providing a level of data protection equivalent to the European Union’s.

Some processors (such as Stripe) may process data outside the European Economic Area; where they do, they rely on the safeguards provided for by the GDPR (adequacy decisions or standard contractual clauses).

7. How long we keep data

• Account data: while your account is active. If you close it, we delete or anonymise it, except what we must keep by law.

• Invoicing and payment data: for the periods required by commercial and tax law (up to 6 years).

• Marketing consent: we keep the consent record while it remains in force and as proof after withdrawal.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@haypartido.es from the email or phone linked to your account. We reply within one month.

To delete your account you do not need to write to us: you can do it in the app, instantly. How, and which data is deleted and which is kept: haypartido.es/eliminar-cuenta.

If you believe we have mishandled your data, you can complain to the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply appropriate technical and organisational measures: encryption in transit (HTTPS), salted password hashing, short-lived session tokens, restricted infrastructure access and administrative audit logging.

10. Changes to this policy

If we materially change this policy, we will tell you inside the Platform before the change takes effect.