Privacy & Cookies Policy – Fun Padel

SURPRESACENTUADA UNIPESSOAL LDA (“Fun Padel”)

VAT: 518 744 175 · Address: Rua Branca Edmée Marques nº 122, 2755-237 Alcabideche, Cascais, Portugal

Email: funpadel15@gmail.com · Phone: +351 963 781 168 · Website: www.funpadel.pt

We do not sell or rent your data. Processors act under our instructions via GDPR-compliant contracts.

Post-purchase review emails may be sent.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Unsubscribe via account or link in the email.

Data: identity, contact details, addresses, order history, preferences, authenticated browsing.

Retention: until deletion or 2 years after last login.

Legal basis: Contract + Legitimate interest.

Optional, consent-based.

Data: identity, contacts, purchase history, bonus balance/transactions.

Retention: until account closure or 2 years after last login.

Legal basis: Consent (join) + Contract (benefits).

Only with opt-in; withdraw anytime.

Data: contacts, purchase history, preferences/interactions (if consented).

Retention: up to 3 years after last contact or until withdrawn.

Legal basis: Consent.

Profiling/automated decisions: limited personalization; no legal effects or significant impact. Advanced profiling requires explicit consent.

Handled by Stripe and PayPal (Apple Pay/Google Pay via Stripe).

We do not see full card numbers (tokenized).

PSD2/anti-fraud checks may occur by providers.

Legal basis: Contract + Legal obligation (PSD2).

For cheque payments in physical stores we process data on the cheque to complete the transaction and prevent fraud.

Retention: time needed to process (~1 week).

Profiling/automated decisions: Contract.

Data: identity, contacts, addresses, order ID, items, payment method (metadata), anti-fraud logs.

Retention: data shared with carriers (e.g., DHL) — 1 year after delivery; orders/invoices — 10 years.

Legal basis: Contract + Legal obligation.

Data: email, personalization content (text/images), payment metadata, name, contact, addresses, order number, items.

Retention: 10 years.

Legal basis: Contract.

Data: email, customer ID, phone, addresses, tokenized payment info, order values/frequency, risk indicators.

Retention: 6–12 months (or while investigation remains open).

Legal basis: Legitimate interest (security/anti-fraud).

Data: name, VAT (if applicable), billing/shipping address, email, payment method (metadata), amount, product description, purchase date.

Retention: 10 years.

Legal basis: Legal obligation.

Small files on your browser/device enabling functionality, preferences and analytics. We use them for secure operation and, with consent, analytics and advertising.

Types (by duration)

• Session (deleted on close)
• Persistent (kept for a set period)

• Functional/Technical (necessary): operation, security, session, load balancing; no consent required (legitimate interest/technical necessity).
• Analytical (opt-in): audience and performance (GA4, Hotjar).
• Marketing (opt-in): advertising/attribution (Meta Pixel, Google Ads, TikTok Pixel).

Functional (necessary)

• Cloudflare: __cf_bm (~30 min), cf_clearance (up to 1 day), __cfruid (session).
• Site session: _session, play_session (session).
• Stripe: __stripe_mid, __stripe_sid (session / up to 12 months).
• Cookiebot (CMP): CookieConsent (12 months).
• PayPal (if enabled): ts, ts_c, x-pp-s, l7_az (session–24 months).

• Google Analytics 4: _ga, _ga_* (up to 14 months; IP truncated).
• Hotjar: typical set like _hjSessionUser_* (12 months), _hjFirstSeen (session), _hjIncludedInSessionSample (30 min), _hjSession_* (30 min), etc. for UX/diagnostics.

• Meta Pixel: _fbp (~3 months).
• Google Ads: _gcl_au (~3 months).
• TikTok Pixel: _ttp (up to 13 months) and, depending on setup, _tt_enable_cookie, ttwid, etc.

Note: We will update this list whenever services change (e.g., new analytics/ads partners).

Cookiebot banner: Accept all, Reject non-essential, Customize (per category).

Change/withdraw anytime via “Cookie Preferences” in the footer.

Manage cookies in your browser settings (Chrome, Firefox, Safari, Edge, Opera). Blocking necessary cookies may affect login/checkout.

• GA4 (opt-in): Client-ID, navigation data, truncated IP, browser/OS/resolution/language/time; transfers outside EEA may occur (SCC + safeguards).
• Hotjar (opt-in): UX/diagnostics; not intended to capture sensitive data; may transfer outside EEA (SCC).
• Meta/Google/TikTok (opt-in): advertising identifiers and events for measurement/attribution.

Stripe, PayPal, Google, Meta, TikTok, Cloudflare, Hotjar, Cookiebot may process data outside the EEA under SCCs and appropriate safeguards. More info: funpadel15@gmail.com.

Access, Rectification, Erasure, Objection, Restriction, Portability, Withdraw consent.

How to exercise: funpadel15@gmail.com (we may verify identity).

Complaints: CNPD (www.cnpd.pt).

Last updated: October 2025.