Privacy Policy — PADO (Mobile Application & Website)

Effective Date: 28 October 2026

This Privacy Policy explains how 7DESIGN Sp. z o.o. ("PADO", "we", "us") processes personal data when you use thePADO mobile application and the PADO website at pado.app(together, the "Services"). Where a rule applies to only one of them, this is stated explicitly.

1. Data We Process

We process personal data necessary to provide the Services, including:

• account data (name, email address, phone number);
• profile data (photo, preferences, skill level);
• booking and payment information (payment processing is handled by Stripe; PADO does not store full card details such as card numbers);
• device and usage information (device type, operating system, identifiers);
• location data (only with the User's explicit prior consent);
• health and fitness data(heart rate, active calories burned and exercise sessions) from Google Health Connect or Apple Health, only with the User's explicit prior consent (see Section 4D);
• website analytics and interaction data — when you use the website, and only after you have given consent, we and our analytics/marketing providers collect data such as pages viewed, clicks, scrolling, approximate location derived from IP, device and browser information, and identifiers stored in cookies or similar technologies (see Section 5).

2. Purposes of Processing

Personal data is processed for the following purposes:

• providing and maintaining the Services;
• processing bookings and facilitating payments via third-party payment providers;
• showing the User their own activity statistics for a tournament match, based on health and fitness data the User chooses to connect (see Section 4D);
• contacting Users regarding support and technical matters;
• ensuring security and preventing abuse or fraudulent activity;
• measuring and improving the website and app through analytics and, where you consent, session analysis (see Section 5);
• marketing and advertising measurement (e.g. understanding the performance of our campaigns),only where you have given consent;
• complying with legal obligations applicable to the Controller.

3. Legal Basis (GDPR)

Data processing is carried out under the EU General Data Protection Regulation (GDPR) based on:

• Art. 6(1)(a) — consent, for location data, for analytics, session-recording and advertising cookies and similar technologies used on the website (Section 5), and for marketing communications;
• Art. 9(2)(a) — explicit consent, for health and fitness data (Section 4D);
• Art. 6(1)(b) — performance of a contract (providing the Services and processing bookings);
• Art. 6(1)(c) — compliance with a legal obligation;
• Art. 6(1)(f) — legitimate interest of the Controller (security, fraud prevention, and service-related communication). We rely on legitimate interest only for strictly necessary processing and not for non-essential website cookies, which require your consent.

4. Data Sharing

Data may be shared only with:

• technical, hosting, and infrastructure providers (including our content delivery and tag-management provider, Cloudflare);
• payment service providers, including Stripe Inc. (see Section 4A);
• analytics and marketing technology providers used on the website, on the basis of your consent (see Section 4C and Section 5);
• authorities authorized under applicable law;
• entities involved in a potential merger, acquisition, or restructuring of the business.

The Controller does not sell personal data. Health and fitness data is never shared with third parties (see Section 4D). Some providers process data outside the European Economic Area (EEA); such transfers are governed by appropriate safeguards as described in Section 6.

4A. Stripe Payment Processing

Payments are processed by Stripe Inc., a third-party payment provider. When a User makes a payment, relevant data (such as payment amount, transaction details, and device identifiers) is shared with Stripe to complete the transaction. Stripe processes data under its own Privacy Policy athttps://stripe.com/privacy. PADO does not store full card numbers or sensitive payment credentials.

4B. Apple and Google (App Distribution)

The PADO app is distributed via the Apple App Store and Google Play Store. Apple Inc. and Google LLC may collect certain technical and usage data in connection with app distribution and operation, in accordance with their own privacy policies:

• https://www.apple.com/legal/privacy/
• https://policies.google.com/privacy

PADO is not responsible for data collected independently by Apple or Google.

4C. Analytics and Marketing Providers (Website)

Subject to your consent, the website shares interaction data with the providers listed in Section 5, including Microsoft (Clarity), Google (Google Analytics / Google Ads), and Meta Platforms (Meta Pixel). Each provider processes data under its own privacy policy. You can withdraw consent at any time (see Section 5).

4D. Health and Fitness Data (Google Health Connect and Apple Health)

If the User chooses to connect Google Health Connect (Android) or Apple Health (iOS), the PADO app reads the following data from it, only after the User's explicit consent given on the system permission screen: heart rate, active calories burned and exercise sessions (workouts).

Purpose. This data is used only to show the User their own statistics for the time range of a tournament match they played (such as active time, effort, calories burned, and heart rate averages, zones and recovery). The data is displayed once, for this purpose only.

No storage and no sharing.PADO does not store this data, does not transfer it to third parties, and does not otherwise process or use it. It is not sold, not used for advertising, marketing, profiling or analytics, not used to build user profiles, and not used for credit, insurance, employment or lending decisions. Health and fitness data obtained through Apple Health (HealthKit) is not used for advertising or data mining. PADO's use of information received from Health Connect adheres to the Google Play User Data Policy, including the Limited Use requirements.

User control.The User can stop PADO from reading this data at any time by revoking permission in Health Connect settings (Android) or in Settings → Health → Data Access & Devices (iOS). The app continues to work without this data.

Legal basis.Processing is based on the User's explicit consent (Art. 9(2)(a) GDPR). The User may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies and Tracking Technologies (Website)

The website at pado.app uses cookies and similar technologies. We group them as follows:

• Strictly necessary — required for the site to function (e.g. security, load balancing, saving your cookie choices). These do not require consent and are always active.
• Analytics, session-analysis and advertising — these are non-essential and are loadedonly after you give consent via our cookie banner. Until you consent, they are not activated.

We use the following non-essential tools on the website:

• Google Analytics 4 (Google Ireland / Google LLC) — aggregated traffic and usage statistics; category: Analytics.
• Microsoft Clarity (Microsoft Corporation) — session analysis (heatmaps, session replays) to improve usability; category: Analytics / session recording.
• Meta Pixel (Meta Platforms Ireland / Meta Platforms, Inc.) — measuring the performance of our advertising; category: Advertising.
• Cloudflare Zaraz (Cloudflare, Inc.) — loading and managing the above tools and your consent choices; category: Tag management / consent.

Consent and how to change it. When you first visit the website you are asked to accept or decline non-essential cookies. You can change or withdraw your choice at any time via the "Cookie settings" link in the website footer, or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Session recording. Microsoft Clarity may record interactions with pages (such as mouse movement, clicks and scrolling). We configure Clarity to mask text and form-input content so that information you type is not captured. We do not use these recordings to identify you personally.

Mobile app. The app may use analytics tools (such as Firebase) to collect usage data for the purpose of improving the app. Where such tools are not strictly necessary, they are used in line with the consent and permission choices available to you in the app and your device settings.

6. International Data Transfers

Some of our providers — in particular Google, Microsoft and Meta (Section 5) and certain infrastructure providers — are established in or process data in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under GDPR, primarily the European Commission's Standard Contractual Clauses (SCCs)and the providers' supplementary measures. You can request more information about these safeguards at [email protected].

7. Data Retention

Personal data is retained for as long as necessary to provide the Services and fulfil legal obligations, or for a maximum of 5 years after the User's last activity, whichever is sooner. Payment transaction records may be retained longer where required by tax or accounting law. Website analytics data is retained for the period configured with each provider. Health and fitness data is not stored by PADO (see Section 4D). Upon account deletion, personal data is removed or anonymized, except where retention is required by law.

8. Your Rights

Under GDPR, you have the right to:

• access your data;
• rectify or update inaccurate data;
• delete your data ("right to be forgotten");
• restrict processing of your data;
• object to processing based on legitimate interest;
• transfer your data to another controller (data portability);
• withdraw consent at any time (including for cookies and marketing), without affecting the lawfulness of prior processing;
• lodge a complaint with the President of the Personal Data Protection Office (UODO) athttps://uodo.gov.pl.

To exercise any of these rights, contact us at [email protected]. We respond within 30 days.

9. Data Security

We apply appropriate technical and organizational measures to protect personal data from unauthorized access, loss, or destruction, including encryption in transit, access controls, and secure infrastructure. No IT system can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected Users in accordance with GDPR.

10. Children's Privacy

PADO does not knowingly collect personal data from children. Minimum age requirements are set in the app's store listings. If we become aware that data has been collected from a child without appropriate consent, such data will be promptly deleted.

11. Changes to This Policy

This Policy may be updated due to legal, technical, or operational changes. We will notify Users of material changes via the Services or by email. The current version is always available in the app and on the website.

12. Contact

For data protection matters, questions, or to exercise your rights, contact:

7DESIGN Sp. z o.o., ul. Zygmunta Krasińskiego 15a-3, 50-449 Wrocław, Poland

Email: [email protected]