Privacy Policy

Padler ("Padler", "we", "us") operates padler.co.za and its region subdomains, a challenge ladder for padel and pickleball players. Padler is operated by Bosman Data (Pty) Ltd, registration number 2020/584135/07, of 7 Langenhoven Street, Dan Pienaar, Bloemfontein, 9301.

This policy is issued under the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what personal information we process, why, and what rights you have over it.

Our Information Officer is Malan Bosman, reachable at hello@padler.co.za. Use this address for any question about your personal information, or to exercise any of the rights below.

Depending on how you use Padler:

• Team captains (the person with the account): email address (used to sign in), your name and surname, your self-reported Playtomic rating, your team's name and composition, your WhatsApp number, the times of day you prefer to play, and your team's match and challenge history — including any strikes or disputes.
• Team partners (the second player, who has no account): a first name and a self-reported Playtomic rating, and nothing else. No surname, no email address, no phone number. See "Your partner's details" below.
• Region admins (the player who runs a region’s ladder): nothing beyond the above. Being an admin adds a role to an ordinary account — it doesn’t give us extra information about you.
• Everyone: a session cookie that keeps you signed in — see "Cookies" below.

• Running the ladder itself (matching, challenges, standings) — contract necessity.
• Letting you sign in and identify your team — consent, given when you sign up.
• Holding your partner's first name and rating — our legitimate interest in running a doubles ladder, not consent. See "Your partner's details" below.
• Publishing standings on a public region's ladder — a separate basis from signing up, covered specifically in "Public ladder visibility" below.
• Sending you ladder notifications — challenges you’ve received, deadlines coming up, results to confirm — contract necessity. These go by email by default; they only go by WhatsApp if you ticked the box asking us to, which is consent and which you can withdraw at any time.
• Showing your WhatsApp number to other signed-in teams in your region, so an opponent can arrange a match with you — contract necessity. It is never shown to the public, and never to anyone outside your region.
• Taking payment for a team subscription, and keeping the records the tax and companies legislation requires us to keep — contract necessity and legal obligation.

Most regions are public, and we set that per region. On a public region, anyone who visits the site — including someone who has never signed up — can see: team names, player first names, ladder position, and win/loss record. Match ratings, full names and contact details stay visible only to signed-in members of that region.

If your region is private, this doesn't apply — your team is visible only to other members of the same region.

A padel team is two people, but only the captain has an account. That means the second player's details are entered by someone else, and they never got the chance to agree to it. We deal with that by asking for as little as the ladder can work with: a first name and a rating. We don't ask for a partner's surname, email address or phone number, and the app won't store a surname even if one is typed in.

The rating is there because a team's starting position on the ladder is the average of both players' ratings — without it we can't place the team at all.

We rely on our legitimate interest in running the ladder for this, rather than on consent, because consent has to come from the person themselves and a captain can't give it on their behalf. Captains are asked to tell their partner that their first name will appear on the ladder.

If you're someone's partner and you'd rather not appear, email hello@padler.co.za — you don't need an account to ask. We can show initials instead of your first name, or remove your details, and we'll tell the captain what changed so they aren't left confused.

We use the following processors to run Padler. None of them may use your information for their own purposes.

• Supabase (database and authentication), hosted in Ireland (EU).
• Cloudflare (hosting and email forwarding for our own inbox).
• Resend (sends our email: account emails such as confirming your signup or resetting your password, and ladder notifications about your challenges, deadlines and results).
• Payfast (processes subscription payments), in South Africa — see "Payments" below.

Some of these are located outside South Africa. Where that's the case, we rely on them being subject to data protection law that gives your information equivalent protection to POPIA, or on a written agreement that requires them to protect it to the same standard.

Team subscriptions are paid through Payfast, a South African payment gateway. Your card details never reach Padler. You enter them on Payfast's own secure payment page, and they handle the card data under the payment industry's security standards (PCI DSS).

Payfast receives your name, email address, the amount and our reference for your subscription, so it can take the payment and tell us it succeeded. What we store on our side is the status of your subscription, when the paid period ends, and Payfast's reference for it — never a card number.

We keep your account and ladder history for as long as your account is active. Match results are also kept as part of the ladder's historical record after a team leaves, since removing them would distort other players' win/loss records — contact us if you'd like to discuss this for your specific account.

Records of payments are kept for five years after the transaction, because South African tax and companies legislation requires it — that period isn't something we can shorten on request.

You can ask us, at any time, to:

• Tell you what personal information we hold about you.
• Correct information that's wrong or out of date.
• Delete your account and personal information.
• Stop processing your information for a specific purpose, including marketing.

Email hello@padler.co.za to exercise any of these. You also have the right to complain to South Africa's Information Regulator (inforegulator.org.za) if you believe we've mishandled your information.

Padler sets one kind of cookie: a session cookie that keeps you signed in across the site and its region subdomains. It's strictly necessary — the site doesn't work without it — and we don't use any advertising, analytics or tracking cookies.

Each region's data is isolated from every other region's at the database level, and access is scoped to what a given signed-in user is actually allowed to see. We keep the credentials that could bypass those protections out of anything that reaches your browser, and all traffic to Padler is encrypted (HTTPS).

You must be 18 or older to have a Padler account. You confirm this when you sign up, and it's a condition of our Terms. We don't ask for anyone's date of birth — we'd rather not hold it — so this rests on that confirmation. If we learn an account holder is under 18, we'll close the account and delete what we hold.

A player under 18 can still play as a captain's partner, since a partner needs no account. All we would hold about them is a first name and a rating. If you're a parent or guardian and you'd rather your child's first name didn't appear on a public ladder, email hello@padler.co.za and we'll show initials instead or remove the details — no account needed, and we won't ask you to prove anything.

We'll update the date at the top of this page whenever this policy changes, and post the new version here.

For how to request access to records we hold, see our PAIA manual.