TEKKA Platform - Privacy Policy

Last Updated: October 27, 2026

Welcome to TEKKA! This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile applications, or interact with our platform (collectively, the "Platform").

TEKKA is committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

TEKKA LLC
30 N Gould St Ste N, Sheridan, WY 82801, US
EIN: 36-5185910
Email: [email protected]

EU Representative (GDPR Art. 27): As TEKKA LLC is established outside the European Union and offers services to individuals in the EU, we have appointed David Szalai, Ballagi Mór utca 3, fsz. 4, 1115 Budapest, Hungary, as our representative in the Union. You may contact our EU representative at [email protected] regarding any matter related to the processing of your personal data.

2. Information We Collect

We collect information that you provide directly to us, information collected automatically when you use our Platform, and information from third parties.

2.1 Information You Provide to Us:

Account Information: Name, email address, phone number, password, and profile picture.
Business Information (for Clubs): Business name, address, tax ID, billing details, and verification documents you upload. We use three consolidated categories where possible: identity and tax (e.g. incorporation and VAT registration), financial proof (e.g. recent bank statements), and facility and operations (e.g. lease, insurance, operating permits), plus facility photos of your venue.
Verification and KYB Data: We process uploaded verification files to confirm your business, facility, and payment details. This includes a government-issued photo ID of the club owner or an authorized signatory (e.g., passport, national ID card, or driving licence), which you upload to TEKKA as part of the verification bundle. Uploaded verification documents are reviewed by trained TEKKA staff; we do not use automated (AI) analysis of your documents, and no document content is shared with AI providers. All uploaded verification documents, including photo ID, are stored encrypted with access restricted and logged. Where you complete hosted onboarding with a payment partner (for example Stripe Connect), that partner separately collects the identity data it requires for payouts (e.g., ultimate beneficial owners) under its own privacy terms, and a verified payment account may satisfy some of our verification requirements. We also screen business owners and signatories against applicable sanctions and politically-exposed-person (PEP) lists, on onboarding and periodically thereafter.
Tax Information (for Coaches Who Sell Through the Platform): If you sell lessons or coaching services through the Platform, EU tax rules (Council Directive (EU) 2021/514, "DAC7") require us to collect your legal name, date of birth, primary address, tax identification number and its issuing country (or, if your country issues none, your place of birth), and your VAT number if you have one. If you sell through your own company, we collect its legal name, registration number, address and tax number instead. Your tax identification number is stored encrypted. We do not ask for identity documents or bank details for this purpose. If you live outside the EU, we only record your name and address.
Booking Information: Details about the courts or services you book, including dates, times, and preferences.
Activity and Performance Data: If you use match-related features, we process the data you or authorized officials record: live match scores and match statistics, tournament results and standings, and self-reported or derived skill ratings (e.g., NTRP) used for matchmaking and seeding.
Media You Upload: Photos and videos you upload to the Platform (e.g., match recordings in the Match Vault, facility photos). Match recordings may show other identifiable individuals; by uploading, you confirm you have the right to do so, and we may remove media on a valid objection from a person shown in it.
Guest and Invitee Data: If a user, coach, or club invites someone to a booking, lesson, or event by name, email address, or phone number, we process that contact information to deliver the invitation and manage participation, even if the invitee does not hold a TEKKA account. Invitees may contact us at [email protected] to access or delete this data.
Investor Newsletter: If you sign up for our investor updates at /investors/newsletter (no TEKKA account is needed), we process your email address, your preferred language, and the record of your consent: when you signed up, when we sent you the confirmation email, when you confirmed and, if you unsubscribe, when you did. We also record which updates we sent you and whether they were delivered. To access or delete this data, contact [email protected].
Communications: Messages sent to us or other users (e.g., clubs or coaches) through the Platform.

2.2 Information Collected Automatically:

Usage Data: Information about how you interact with the Platform, including pages visited, features used, and time spent.
Device Data: IP address, browser type, operating system, and device identifiers.
Location Data: Approximate location based on your IP address, or precise location if you grant us permission.

3. How We Use Your Information (Legal Basis)

Under the GDPR, we must have a legal basis to process your personal data. We use your information for the following purposes:

To Provide Our Services (Contract Fulfillment): To create and manage your account, process bookings, facilitate payments, and send transactional notifications (e.g., booking confirmations).
To Improve Our Platform (Legitimate Interest): To analyze usage trends, troubleshoot issues, and enhance the user experience.
To Communicate with You (Legitimate Interest / Consent): To respond to your inquiries, provide customer support, and send administrative updates. We will only send marketing communications if you have provided explicit consent. Every marketing email contains an unsubscribe link; opting out stops marketing email (including club and coach campaigns) immediately, without affecting transactional messages such as booking confirmations.
To Send Investor Updates (Consent): To email you our investor update, about once every two months, after you have confirmed your sign-up through the link we send you. You can withdraw your consent at any time with the unsubscribe link in every update; doing so does not affect any TEKKA account you may have.
To Ensure Security and Compliance (Legal Obligation / Legitimate Interest): To detect and prevent fraud, enforce our Terms of Service, and comply with legal requirements.
To Verify Businesses and Screen for Sanctions/PEP Status (Legal Obligation / Legitimate Interest): To verify club identity and ownership, review verification documents (by our staff), and screen business owners and authorized signatories against applicable sanctions and politically-exposed-person lists at onboarding and on an ongoing basis.
To Meet Tax Reporting Obligations (Legal Obligation): To identify coaches who sell through the Platform and their country of residence, check that tax and VAT numbers are validly formed using the European Commission's free TIN-checking and VIES services, file the annual DAC7 platform report, and send the reminders the law requires. If the data is still missing 60 days after our first request and two reminders, DAC7 requires us to act: we pause your paid offerings and new orders until it is provided.
To Monitor and Improve Reliability (Legitimate Interest): To capture application errors and crash reports (which may include IP address, device data, and the actions leading up to an error) so we can diagnose and fix technical problems.

We do not sell your personal data. We may share your information in the following circumstances:

With Clubs and Coaches: When you make a booking, we share necessary details (e.g., name, contact info) with the respective club or coach to fulfill the service.
With Service Providers (Data Processors): We use third-party vendors to help operate our Platform, such as hosting providers (e.g., EU-based hosting and database providers), payment processors (e.g., Stripe), communication and email services (e.g., Twilio, Plunk), product analytics (e.g., PostHog), error and crash reporting (e.g., Sentry, hosted in the EU), and object storage for encrypted verification files. Verification documents are never shared with AI providers. These providers are bound by Data Processing Agreements (DPAs) or equivalent contractual safeguards and may only use your data as instructed by us.
With AI Service Providers (Data Processors): Some club and coach tools use AI language models operated by DeepInfra (DeepInfra, Inc., United States), our default provider, or by Google (the Gemini API of Google LLC, United States), which we may use in its place. Only one of the two is in use at a time. We send them text solely to produce the requested output, for these purposes:
- Feedback summaries for clubs: star ratings, written comments and selected issue tags from post-booking feedback and private reviews, with the date of the booking, so that the club receives a summary of recurring themes and a suggested reply. We send them without the author's name or account and without booking identifiers.
- Weekly briefings for clubs: figures we have already calculated for the club (such as bookings, revenue and court utilisation) and the themes of its recent feedback.
- Promotional copy: the club's name and the terms of an offer (such as the discount), to draft promotional messages; and, in the email composer, the instruction a club, its staff or a coach types and the draft being revised.
- Club assistant: questions a club owner or manager asks the in-app assistant, together with the club's own profile details (such as opening hours), the asker's role at the club, and excerpts from our help documentation.
- How we protect this data: Before feedback comments, assistant questions and email drafts are sent, we automatically remove email addresses, phone numbers, bank account and payment card numbers, IP addresses, social media handles and internal identifiers; from feedback we also remove the names of the club's own staff and coaches. For feedback summaries, weekly briefings and the assistant, a request in which our final check still finds such an identifier is not sent. The instruction typed into the email composer is sent as written, so please do not include other people's personal details in it. Verification documents are never shared with AI providers. For these transfers to the United States we rely on the safeguards described in Section 6.
With Tax Authorities: For coaches who live in the EU and sold lessons or services through the Platform, we report the tax information listed in section 2.1, together with the amounts and number of sales per quarter, once a year to the Estonian Tax and Customs Board, which passes it on to the tax authority of your EU country of residence under DAC7. To check that a tax or VAT number is validly formed, we send it (with its country) to the European Commission's TIN-checking service or to VIES.
For Legal Reasons: If required by law, subpoena, or other legal process, or to protect the rights, property, or safety of TEKKA, our users, or others.

5. Data Retention and Storage (Data Residency)

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Verification documents (including consolidated identity/tax, financial proof, and facility/operations uploads, plus facility photos) are stored encrypted, retained for the duration of your active business relationship plus a statutory period thereafter (typically five to seven years where tax or anti-money-laundering rules apply, as configured in our retention settings), then deleted or anonymized. Verification decisions are made by TEKKA staff; you may contact us if you disagree with a rejection. Access to verification files is restricted to authorized personnel and logged for audit purposes. DAC7 tax information is kept for as long as tax law requires us to keep reporting records — no longer than ten (10) years after the end of the year it was reported for — and then deleted. Match media uploaded to the Match Vault is retained for two (2) years from upload; we notify you before expiring files, after which they are permanently deleted. Investor newsletter data is kept while you are subscribed. If you never confirm your sign-up, we delete it 30 days after our last confirmation email. If you unsubscribe, we keep your email address and the record of your consent and its withdrawal for twelve (12) months, then delete them together with our delivery records. Other content you upload is deleted or anonymized when you delete it or your account, subject to legal retention obligations.

Imported member lists: When a club moves its existing records onto TEKKA with our data import tool, we keep the uploaded list (which may include members' names, contact details, dates of birth and notes) as a working copy while the club reviews and applies the import. A trial run that is never committed, or that the club discards, is deleted seven (7) days after it was created. For a committed import, we remove the names, contact details and other personal data from that working copy thirty (30) days after the import was committed or, if it is undone, after it was undone. The memberships, bookings and invitations the import creates are then kept like any other club data.

Data Residency: To ensure the highest level of data protection for our European users, our primary databases are hosted on servers located within the European Union (EU). Our product analytics (PostHog) and error/crash reporting (Sentry) are likewise configured to store data in the EU. Requests to our AI providers (Section 4) are processed in the United States.

6. Cross-Border Data Transfers

While our servers are located in the EU, our business entity is registered in the United States (Wyoming). Therefore, personal data may be accessed from or transferred to the United States for administrative and operational purposes.

Because the United States has not received a comprehensive "adequacy decision" from the European Commission, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs), to ensure your data remains protected to EU standards during such transfers.

Some of our service providers also process personal data in the United States, including our AI providers DeepInfra and Google (see Section 4). For these transfers, too, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs).

If you are a resident of the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can ask us to correct inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data, subject to certain legal exceptions.
Right to Restrict Processing: You can ask us to temporarily halt processing your data.
Right to Data Portability: You can request to receive your data in a structured, commonly used, and machine-readable format.
Right to Object: You can object to the processing of your data, particularly for direct marketing or, where applicable, to processing based on legitimate interests.
Right to Withdraw Consent: If we process your data based on consent, you can withdraw it at any time.
Rights related to automated decisions: Verification document decisions are made by our staff, not by automated means. If any outcome affecting you were produced solely by automated means with legal or similarly significant effects, you may request human review, express your point of view, or contest the decision by contacting [email protected].

To exercise any of these rights, please use the tools provided in your Account Settings (e.g., "Delete Account" or "Download My Data") or contact us at [email protected].

Right to Complain: You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work, or the place of an alleged infringement. We would appreciate the chance to address your concerns first, so please consider contacting us before doing so.

8. Children

Players under 18 may hold accounts on the Platform under the parental-involvement rules below (see also Section 1 of the User Terms of Service). We collect a date of birth at registration to apply the correct rules.

What we collect from minors: the same categories as for other players — name, email address, phone number, date of birth, and booking/lesson/event activity — plus the parent's or legal guardian's email address. We do not knowingly collect more data from a minor than is necessary to provide the service, and we do not use minors' data for marketing, profiling, or targeted advertising.
Parental consent (players between the digital-consent age and 17): where a player is under 18 but at or above the digital age of consent in their jurisdiction (e.g., 13 in the United States under COPPA; 13–16 in EU member states under GDPR Article 8), they may register themselves but must provide a parent or guardian email. We send that parent or guardian a consent request with a link where they can confirm or refuse consent. Until confirmation, the account operates in a restricted mode (no marketing, no public discoverability).
Children below the digital-consent age: these accounts may only be created and managed by the parent or legal guardian, who provides the consent at registration and remains the account contact.
Parental rights and withdrawal: the parent or guardian receives copies of the account's booking and lesson emails, may exercise all rights in Section 7 (access, correction, deletion, portability) on the minor's behalf, and may withdraw consent at any time via the link in the consent email or by contacting [email protected]. Withdrawal suspends the account; deletion requests are honored as described in Section 7.
No marketing or profiling of minors: minor accounts are excluded from marketing emails, promotional campaigns, and analytics profiling, and are not publicly discoverable on the Platform.

If you believe a child below the applicable digital-consent age has created an account without parental involvement, please contact [email protected] and we will investigate and delete the data where required.

9. US State Privacy Rights

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know, access, correct, and delete personal information we hold about you, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. You may exercise your rights through Account Settings or by contacting [email protected]; we will not discriminate against you for doing so.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Platform and hold certain information. For detailed information about the cookies we use and how to manage your preferences, please review our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Where required, we may request re-acceptance. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: