Legal information
Privacy policy
How we use your data and how you can exercise your rights.
Last updated: 21 September 2026.
1. Who processes your data
The data controller is CLUB TENIS MAHON, tax identification number G07154297, with its registered address at Camí de Trepucó, 4, 07700 Maó (Illes Balears). For data protection enquiries or to exercise your rights, you can write to clubtenismahon@gmail.com.
This policy applies to the club's information website and its forms. Linked booking services and social media may provide their own additional privacy information.
2. What data we use and why
| Processing activity | Data and purpose | Legal basis |
|---|---|---|
| Enquiries | Contact details and the content of your message to answer enquiries received through the club's channels. | Pre-contractual steps when you enquire about a service; legitimate interest in answering other enquiries addressed to the club (Article 6(1)(b) and (f) GDPR). |
| Tennis school and membership applications | Identification, date of birth, contact details, family or student details, sporting preferences and, when direct debit is requested, bank details. These are used to process the application and manage your relationship with the club. | Pre-contractual steps and performance of the requested relationship; legal management and invoicing obligations where applicable (Article 6(1)(b) and (c) GDPR). |
| Newsletter | Email address, language, source of the request and evidence of consent. These are used to confirm your subscription and send news about tournaments, lessons, camps and activities. | Your consent, separate from school or membership applications (Article 6(1)(a) GDPR). |
| Images | The option you select on the form and, where you give consent, images of activities for the purpose stated in that consent. | Voluntary, revocable consent (Article 6(1)(a) GDPR). Refusing does not prevent you from applying for the service. |
| Website analytics | Browser identifiers, pages visited and technical information about the device and visit to compile statistics with Google Analytics. | Consent to analytics cookies (Article 6(1)(a) GDPR and Article 22(2) of the Spanish LSSI). |
| Security | IP address, technical logs and verification signals needed to protect the website and prevent automated submissions. | Legitimate interest in maintaining service security and preventing abuse (Article 6(1)(f) GDPR). |
Mandatory fields are needed to process your application. If you do not provide them, we may be unable to process it. We do not use these applications to subscribe you automatically to the newsletter, nor do we make decisions with legal effects based solely on automated processing.
4. Providers and recipients
Authorised club staff and its hosting, maintenance, email and management providers access the data they need to deliver the service. Data may also be shared with financial institutions to manage payments and with public authorities or other recipients where required by law.
- Brevo: manages the list, subscription confirmation and newsletter delivery. See its privacy policy.
- Google: email services are used and, when school management through Google Forms is enabled, a copy of the application is sent to that service. Google Analytics is used only if you accept analytics. See the Google privacy policy and the information about data from sites that use its services.
- Cloudflare Turnstile: when enabled on a form, it checks technical signals to distinguish people from automated submissions. This security measure is independent of analytics. See its specific privacy information.
Some of these providers may process data outside the European Economic Area, including in the United States. Their terms describe the applicable adequacy decisions and safeguards, such as the EU–US Data Privacy Framework for participating entities or standard contractual clauses. You can consult Google's transfer mechanisms and the terms of the other providers linked above, or request information and a copy of the applicable safeguards by emailing the data controller.
5. How long we keep data
- Enquiries and applications: while they are being processed and, if membership or enrolment is completed, for the duration of your relationship with the club. Afterwards, only the data needed to meet legal obligations and address liabilities will be kept for the relevant limitation periods.
- Newsletter: until you withdraw consent or unsubscribe. The minimum information needed to demonstrate the request, respect your unsubscription and address liabilities may be kept for the applicable periods.
- Images: while the authorised purpose continues and you have not withdrawn consent, without prejudice to the minimum retention needed to address liabilities.
- Cookies: your choice is remembered for 180 days and Google Analytics cookies are configured to last up to 180 days. The service's statistical data has its own retention period according to the account settings; you can ask the club for more information.
- Security logs: for as long as needed to prevent and investigate incidents and address any resulting liabilities.
Where data must be retained for legal liability purposes, its use will be restricted to that purpose. You may request information about the period applicable to your case.
6. Minors and other people's data
Applications for minors must be submitted by their parents or legal representatives. Consent to image use must be given by someone entitled to do so, cover the specific uses stated, and must not be a condition for providing the service.
If you provide data about your partner, relatives or other people, you must be authorised to do so and inform them of this policy. A family application does not amount to consent from all those people to receive advertising or have their images published.
7. Your rights
You may request access to, rectification and erasure of your data, as well as portability, restriction of processing and objection where applicable. You may also withdraw any consent you have given. Write to clubtenismahon@gmail.com or to the data controller's postal address, stating which right you wish to exercise. We will only request further identification information where necessary.
If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD). The usual response period is one month, subject to the extensions provided by law for complex requests.
8. Changes and preferences
We will update this information if processing activities or services change. If a new purpose requires consent, we will ask for it before using your data for that purpose.
You can consult the cookie policy.