Privacy Notice

1. Controller

Gustoso Gruppe GmbH, Fürstenfelder Strasse 9, 80331 Munich, Germany.

Data protection contact is our external data protection officer: FX DATA UG (haftungsbeschränkt), Verhoevenstrasse 4, 81739 Munich, phone 089 21111890, email gustoso@fx-data.de.

2. What this application is for

This application exists to run the GUSTOSO Gruppe padel tournament on 15 October 2026. Participation is voluntary and carries no employment consequence.

3. What data we process

For registration and access

Email address (work)
Display name
Time of registration, times of access
When signing in by email link (for participants without a Gustoso Gruppe Microsoft account): the email address you enter, as the account identifier, plus a hash of that address with a timestamp, kept for at most 24 hours to limit sign-in attempts

To form teams and groups

Team name and the assignment of both players to the team
Brand, division and location within the GUSTOSO Gruppe, per player
Answers to the experience questionnaire: years of padel experience, how often you play padel, years of experience in another racket sport, how often you play that sport, your self-assessment of your playing strength, and your handedness
The team strength value calculated from these answers

During the tournament

Match results, reported and confirmed results, disputes
Standings, group, quartet and final placements
Predictions submitted and points scored in the prediction game

Technical

Session data (cookies technically required for sign-in)
In case of errors: technical log data without content
An anonymous count of pages open at the same time, for tournament management only: a random, device-scoped identifier with no link to a person, which expires automatically two minutes after the last check-in and is never stored beyond that

Spectators can also create an account in order to take part in the prediction game. For them we process only the access data listed in the first block, plus their predictions.

4. Purposes and legal bases

Purpose	Legal basis
Registration, access, running the tournament	Art. 6(1)(f) GDPR — legitimate interest in running a voluntary company event
Experience questionnaire, for balanced group seeding	Art. 6(1)(a) GDPR — consent, given by completing the questionnaire
Displaying team names, player names, brand, division, location, results and placements within the application	Art. 6(1)(f) GDPR — legitimate interest in a transparent tournament
Statistics page, including the comparison of self-assessment with actual placement	Art. 6(1)(a) GDPR — the same consent as for the questionnaire
Prediction game	Art. 6(1)(a) GDPR — consent, given by submitting a prediction

The questionnaire data is not analysed beyond the tournament; it is deleted afterwards (section 6).

5. Recipients

Within the GUSTOSO Gruppe, access is given to the people who organise the tournament and operate the application as administrators.

As processors under Art. 28 GDPR:

Supabase — database and authentication. Servers located in Frankfurt am Main, Germany.
Microsoft 365 (Microsoft Graph) — sends the confirmation email after team registration and the sign-in links for participants without a Microsoft account, from no-reply@gustoso-gruppe.de, via the Gustoso Gruppe's existing Microsoft 365 tenant.

The data is stored in Frankfurt am Main. Supabase is a US company; access from the United States for technical maintenance cannot be ruled out and is covered by the European Commission's standard contractual clauses.

6. Retention periods

Data	Period
Access data and sessions	deleted by 30 November 2026
Questionnaire answers and strength values	deleted by 30 November 2026
Predictions and prediction points	deleted by 30 November 2026
Match results, standings and placements	retained, including team and player names, as a record of the company event

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw it at any time; processing carried out before the withdrawal remains lawful.

To exercise these rights, contact office@gustoso-gruppe.de or the data protection officer named in section 1.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, phone 0981 180093-0, email poststelle@lda.bayern.de.

8. Voluntary nature of the questionnaire

Providing the questionnaire answers is voluntary. It serves only to seed the groups evenly. If you prefer not to answer, contact the tournament organisers; your team will then be seeded on their assessment instead. You can take part in the tournament without providing the answers.

You may withdraw your consent at any time, informally, either to the tournament organisers or to the contacts named in section 1.

9. Date of this notice

Last updated: September 2026.