Privacy Policy

1. Data controller

The controller of your personal data is „OPEN PLAY“ Ltd (OOD), UIC 208791351, with its seat in Varna, Bulgaria. For data-protection questions and to exercise your rights: [email protected].

2. What data we collect

• Profile: name, email, password (stored hashed) and, optionally, date of birth, gender, playing hand, playing style, level, equipment, preferences, language. • Bookings and payments: booking history, amounts, credits; payment references. Card data is processed by Stripe and not stored by us. • Access: the generated door PINs (stored securely). • Notifications: if you subscribe - your push subscription data. • Technical: IP address, device/browser type, system logs. • Analytics: site-usage events - only if you consent.

3. Purposes of processing

We process data to: provide the service (bookings, PIN access, payments, credits); manage your account and communicate with you; ensure security and prevent abuse; meet accounting and tax obligations; improve the service through analytics (with consent); and send marketing messages (with consent).

4. Legal basis for processing

• Performance of a contract - for bookings, access and payments. • Legal obligation - for accounting and tax purposes. • Legitimate interest - for security, fraud prevention and service maintenance. • Consent - for analytics cookies, marketing and push notifications. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

5. Retention period

We keep data only as long as necessary for the relevant purpose. Account data is kept while the account is active and for a reasonable period after closure. Accounting and payment documents are kept for the period required by tax and accounting law. System logs and analytics data are kept for shorter periods. Once the periods expire, data is deleted or anonymised.

6. Your rights (GDPR)

You have the right to: access your data; rectification; erasure (“the right to be forgotten”); restriction of processing; portability; object to processing based on legitimate interest; and withdraw any consent given. To exercise your rights, write to [email protected]. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), [email protected], cpdp.bg.

7. GDPR contact

For any questions about your personal data and this policy, contact us at [email protected]. We will respond within the statutory time limits.

8. Recipients and international transfers

We share data only with trusted processors who help us provide the service, under data-processing agreements: Stripe (payments), the TTLock/Sciener smart-access provider (generating door codes), our email-delivery provider, PostHog (analytics, with consent), Sentry (error monitoring), Cloudflare (security/delivery) and Hetzner (hosting, EU - Germany). Where a processor is outside the EU/EEA, the transfer is carried out with appropriate safeguards (e.g. Standard Contractual Clauses). We do not sell personal data to third parties.

9. Changes to this policy

We may update this policy from time to time. The current version with its effective date is always available here. We will notify you of material changes.

10. Public ranking

If you take part in tournaments or hold a rating, your position in the openplay.bg ranking is shown publicly - TTR rating and season points. By default your full name is shown and your public profile page is accessible. You can switch to a masked name (initial + surname) and hide your profile page at any time by turning off public visibility in your profile settings. Basis: legitimate interest in maintaining a community sports ranking. You have the right to object - email [email protected].

11. Marketing sources

When you reach the site through one of our campaign links - from an article, a social post or a QR code - we record which channel and campaign you came from. If you then create an account, we link that source to your account so we can tell which channels bring real people. It is not used to profile you or to show you ads. We store: the channel, the campaign, the type of placement and when the contact happened. Your IP address is not stored for this purpose - click counting uses a one-way hash with a key that rotates every day. Retention: up to 13 months from the last event, after which the data is deleted automatically. Click counts (which are not linked to an account) are kept longer as statistics. Basis: legitimate interest in measuring the effect of our own communication. You may object at any time - write to [email protected] and we will delete the link between your account and the marketing source, and will not create it again. Deleting your account does the same automatically.

Google Ads measurement

When this feature is enabled, we load Google Ads only after your separate consent to advertising measurement. We use it to understand which ads lead to confirmed online bookings. Refusing does not affect sign-in, bookings or payments. We do not use this category for personalized advertising.

Google may receive the visited page address, including the booking reference, IP address, browser and device information, and advertising identifiers. The confirmed-booking event contains a random identifier to prevent duplicate counting, not your name, email, phone number, access PIN or payment secret.

You can withdraw consent through “Manage cookies”. This stops future measurement and deletes advertising cookies accessible to this site, but does not automatically erase data already received by Google. Google’s policies explain its processing and retention of that data.

How Google uses information from sites that use its services