Privacy Policy

1Who we are and what this policy covers

Cuchilla Connect B.V. ("Cuchilla Connect", "we", "us") provides a CRM, marketing automation and club intelligence platform (the "Platform") for padel clubs, racket sports clubs and sports facility operators. This policy explains what personal data we process, why, on what legal basis, with whom we share it, how long we keep it and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (UAVG) and the Dutch Telecommunications Act (Telecommunicatiewet).

It applies to: visitors of www.cuchillaconnect.com; prospective customers we contact or who contact us; customers and their staff who use the Platform; players and members whose data clubs manage in the Platform; and our job applicants and business contacts. It does not cover third-party websites or services.

2Our role

Controller. We decide why and how personal data is processed for: our website; sales and marketing to clubs; customer accounts, billing and support; security, fraud prevention and audit logging; product analytics on aggregated data; recruitment.

Processor. When a club uses the Platform to manage its players and members, the club is the controller and we act as its processor. We then process player data only on the club's documented instructions. Players should send privacy requests to their club first; we help the club respond.

Data protection officer. We are not required to appoint a DPO under Article 37 GDPR. Our management board is responsible for data protection. Contact: privacy@cuchilla.nl.

3Summary

• We never sell personal data and never use one club's player data for another club.
• Player data stays inside the club's own account, encrypted in transit and at rest, hosted in the EU.
• We do not use player data to train AI models.
• You can always ask us what we hold about you, and ask us to correct or delete it.

4Personal data we process

4.1 Customers and their staff (controller)

• Organisation details: legal and trading name, address, KvK and VAT number.
• Contact persons: name, job title, business email, phone number.
• Account data: username, hashed password, multi-factor authentication settings, role and permissions.
• Billing: invoice address, payment method reference (tokenised by our payment provider), invoices and payment history. We never store full card numbers.
• Usage and security data: login times, feature usage, IP address, browser and device data, audit logs.
• Support and communication: emails, tickets, chat and call notes.

4.2 Players and members (processor, on behalf of clubs)

• Identity and contact: name, display name, email, phone and WhatsApp number, postal address where provided.
• Profile: date of birth, gender, skill level or rating, photo where provided.
• Activity: bookings and match history imported from the club's booking system, tournament participation, check-ins.
• Segmentation: club-defined tags and groups, activity status and churn-risk scores generated by the Platform.
• Communication: messages sent by the club, delivery, open and click events, opt-in and opt-out records per channel.

4.3 Technical data

IP address and approximate location (country or city), server, access and error logs, API metadata (not full payloads) and security audit trails.

4.4 Website visitors

Pages visited, referrer, device and browser data, and cookie consent choices. Analytics and marketing cookies are only placed after consent (see section 16).

4.5 Prospective customers (business contacts)

To find clubs that may benefit from our Platform, we collect business contact details of club owners, directors and managers from public sources: club websites, business registers, news articles and professional networks such as LinkedIn. We process: name, job title, club, business email or phone number, public professional profile URL, and notes of our contact with you. We contact you by email, phone or LinkedIn about our services. Every email contains a simple way to opt out, and we stop contacting you as soon as you object.

4.6 Calls and meetings

With your knowledge, we may record sales, demo and onboarding calls and have them transcribed and summarised by a meeting assistant, to prepare follow-up and improve our service. We announce this at the start of the call; you can ask us not to record. Recordings are kept for 12 months.

4.7 Applicants

CV, cover letter, contact details and interview notes.

5Purposes and legal bases (as controller)

Where we rely on legitimate interests, we have documented a balancing test. You can request a copy at privacy@cuchilla.nl. You can always object (section 13).

6Special categories and sensitive data

We do not ask for special categories of data (Art. 9 GDPR), such as health data. Clubs must not enter such data (for example injuries or medical notes in free-text fields) unless they have a valid legal basis and need it. We do not process criminal data.

7Children

The Platform is meant for businesses and adults. Where a club registers minors, for example in a youth academy, the club is responsible for parental consent where required (Art. 8 GDPR; in the Netherlands for children under 16). Clubs can exclude minors from automated campaigns, and we recommend they do so by default.

8Integrations and data sources

• Booking systems (such as Playtomic, Bookaball, Padel Mates, MATCHi, Meet&Play, FOYS/Peakz): we import player and booking data only after the club connects its account. Credentials and tokens are stored encrypted. The club must make sure the export is allowed under its agreement with that provider.
• WhatsApp Business API (Meta): used only for contacts who have opted in to WhatsApp messages from their club.
• Email and SMS delivery: through providers bound by data processing terms.

9Who we share data with

• Sub-processors that help us run the Platform, each bound by a DPA. The full, named list with locations and transfer mechanisms is published at www.cuchillaconnect.com/legal/subprocessors. We inform customers at least 30 days before adding or replacing a sub-processor.
• The club (for player data), as controller.
• Professional advisers (accountant, auditor, lawyer, insurer) under confidentiality.
• Authorities where the law requires it.
• A buyer or investor in a merger or acquisition, under confidentiality and with notice to you.

10International transfers

We store Platform data in the European Economic Area. Some sub-processors are based in, or give support from, countries outside the EEA, such as the United States. We then use an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses, plus extra measures where a transfer impact assessment requires them. The mechanism per sub-processor is listed on our sub-processor page.

11Retention

12Security

We protect personal data with technical and organisational measures that fit the risk. Details are on our Security & Trust page (www.cuchillaconnect.com/security). In short: TLS encryption in transit and encryption at rest; logical separation of customer accounts; role-based, least-privilege access; multi-factor authentication for all staff and production access; audit logging; regular patching and dependency updates; encrypted backups; confidentiality agreements and privacy training for staff.

Data breaches. As controller, we notify the Autoriteit Persoonsgegevens within 72 hours where required (Art. 33) and the people affected if the risk is high (Art. 34). As processor, we notify the club without undue delay and in any case within 48 hours, so it can meet its own obligations.

13Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object, and to withdraw consent at any time (Articles 15 to 22 GDPR). You can always object to direct marketing, and we will stop. You can also object to profiling based on legitimate interests.

Send your request to privacy@cuchilla.nl. We reply within one month; for complex requests we may extend by two months and will tell you why. We may ask you to confirm your identity. Requests are free unless clearly unfounded or excessive. If your data is in the Platform through a club, contact the club; we will pass on requests we receive.

You may lodge a complaint with the Autoriteit Persoonsgegevens or the supervisory authority where you live.

14Marketing communications

You can unsubscribe through the link in every email, by replying "stop", or at privacy@cuchilla.nl. We process opt-outs within 2 business days and keep a suppression record so we do not contact you again.

Clubs that send messages through the Platform are responsible for consent and opt-outs for their players. The Platform records consent per channel and handles unsubscribe links automatically.

15AI features and profiling

The Platform offers AI-assisted features: churn-risk scores, segment and send-time suggestions, campaign text suggestions and an assistant that flags data issues. Churn-risk scores are a form of profiling: the Platform estimates, based on booking activity, how likely a player is to stop playing. The club uses this to send relevant invitations.

• No decision with legal or similarly significant effects is taken automatically (Art. 22 GDPR); club staff decide who receives what.
• Players can object to this profiling through their club; the club can exclude a player from scoring and automated campaigns.
• AI features use third-party model providers listed on our sub-processor page, under terms that forbid training on customer data. We send only the data needed for the feature.
• We do not use player data to train AI models. We may use aggregated, anonymised statistics to improve the Platform.

16Cookies

Non-essential tags load only after you accept. You can change your choice at any time via "Cookie settings" in the website footer.

17Changes

We may update this policy. For material changes we notify customers by email or in the Platform at least 30 days in advance. The version and date are always at the top.

18Contact

Cuchilla Connect B.V., Tweede Anjeliersdwarsstraat 8-C, 1015 NT Amsterdam, the Netherlands · KvK 42030628 · privacy@cuchilla.nl · www.cuchillaconnect.com