1. Who processes your data
| Operator | HILO STUDIO SL |
|---|---|
| Tax ID (NIF) | B05792932 |
| Address | Calle Barco de Avila, SOTO DEL REAL |
| Contact | hello@padelplannerapp.com |
For any data protection matter: privacy@padelplannerapp.com.
2. Purposes and legal bases
| What for | Data | Legal basis | How long |
|---|---|---|---|
| Producing your dimensioned plan and keeping it with your details | Name, company, email, phone, country and region, your answers about the project, the layout you drew and the PDF dossier | Performance of the service you request (Art. 6(1)(b) GDPR) | 12 months |
| If you tick “I would like to receive quotes”, choosing up to 3 manufacturers or installers in your area and sharing your details, your plan and your answers with them so they can quote | The same | Your consent, with a separate box (Art. 6(1)(a) GDPR). Before sharing them we tell you by email which companies they are | Until you withdraw it or, at most, 24 months |
| Handling your quote request and sharing it with member companies | Name, company, email, phone, country and region, the layout, the PDF dossier and your answers about the project | Your express consent, with a separate box (Art. 6(1)(a) GDPR) | Until you withdraw consent or, at most, 24 months |
| Sending you news from PadelPlanner | Consent (Art. 6(1)(a) GDPR and Art. 21 LSSI) | Until you unsubscribe | |
| Prioritising requests (timing and status of the building) and aggregate statistics by city | Project data | Legitimate interest (Art. 6(1)(f) GDPR); you can object | Anonymised after 12 months |
| Replying to companies that want to join or license the tool | Business contact details | Pre-contractual steps (Art. 6(1)(b) GDPR) | 24 months |
Seeing and downloading the plan never requires you to authorise us to share your data with companies: it is a separate, optional box.
3. Who your data is shared with
Only if you tick the quote request box are your contact details, your project and its plan shared with no more than 3 member manufacturers or installers that cover the area of your building. Before sharing anything, we tell you by email which companies they are. Each request keeps the version of the list of companies in force when you authorised it.
- PadelPlanner receives a fee from each company for each request shared.
- Each company becomes a controller of the data it receives, for the sole purpose of sending you its quote, and must inform you in its first communication (Art. 14 GDPR). It undertakes by contract not to pass the data on, to delete it if there is no contract within 12 months and to respond to your rights.
- If there are no member companies in your area, the request is kept and not shared with anyone without asking your permission again.
- Technical providers that process data on the operator's behalf: hosting (Vercel Inc.), database (Neon Inc.) and email delivery (Resend), with standard contractual clauses for transfers outside the European Economic Area.
4. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to privacy@padelplannerapp.com. Withdrawing is as easy as giving consent and does not affect processing carried out before. When you request erasure or withdraw consent, the companies that received your request are also notified (Art. 19 GDPR). If you think your rights have not been respected, you can complain to the Spanish Data Protection Agency (aepd.es) or, if you are in the United Kingdom, to the Information Commissioner's Office (ico.org.uk).
5. Security and retention
Data travels encrypted (HTTPS) and is stored in a database encrypted at rest, with access restricted to the operator. Internal notifications of each request do not include name, email or phone. When the periods in the table in section 2 expire, the data is deleted automatically; if you withdraw consent, it is deleted without waiting for the period to end.
6. Proof of consent
For each form we keep the date, the version and the exact text you saw, the boxes you ticked, the list of companies in force, your IP address and your browser. It is used to show what you authorised (Art. 7(1) GDPR) and for nothing else.