This Privacy Policy informs you about how we process personal data,

• when you
  visit our website kraso-padelarena.de,
  contact us via our website,
• subscribe to our newsletter,
• submit an event inquiry,
• visit our Instagram, Facebook, or TikTok profiles or communicate with us there,
• use our WhatsApp channel, WhatsApp Business, broadcasts, groups, or communities,
• book a court, create a customer account, or make a payment via Playtomic,
• use our guest Wi-Fi, digital access or check-in systems, or electronic lockers
  or
• are in video-monitored areas of the KRASO Padel Arena.

Personal data refers to all information relating to an identified or identifiable person.

The Controller in the sense of the General Data Protection Regulation (GDPR) is:

Krasemann + Krasemann Invest GmbH
Baumannweg 1
46414 Rhede
Germany

Phone: +49 (0) 2872 9535-800
Email: info@kraso-padelarena.de

You can reach our Data Protection Officer at:

Fabian Demes
Baumannweg 1
46414 Rhede
Germany

Email: datenschutz@kraso-padelarena.de

We process personal data particularly on the following legal bases:

• Art. 6 para. 1 lit. a GDPR, if you have given us your consent;
• Art. 6 para. 1 lit. b GDPR, if processing is necessary for a contract or pre-contractual measures;
• Art. 6 para. 1 lit. c GDPR, if we are subject to a legal obligation;
• Art. 6 para. 1 lit. f GDPR, if processing is necessary for the protection of our legitimate interests or the interests of a third party and your interests or fundamental rights do not override them.

Insofar as information is stored or accessed on your end device, this is additionally governed by Section 25 of the Telecommunications-Digital Services Data Protection Act (TDDDG). We generally only use technically non-essential cookies and similar technologies with your consent in accordance with Section 25 para. 1 TDDDG. If access is absolutely necessary, it is governed by Section 25 para. 2 TDDDG.

Our website is hosted by the following provider:

mm-online GmbH
Blumenfeldstraße 55
44795 Bochum
Germany

Email: webservice@mmonline.de

According to the information available to us, the servers are located in Bochum, Germany.

When you access our website, the following data, in particular, may be processed in server log files:

• IP address,
• date and time of access,
• page or file accessed,
• amount of data transferred,
• referrer URL,
• browser type and version,
• operating system,
• hostname of the accessing device,
• access status or HTTP status code

Processing is carried out to technically provide the website, ensure stability and security, and detect misuse or attacks. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and uninterrupted operation of our online offering.

Server log data is generally deleted after 14 days, unless a security-relevant evaluation or longer retention is required to clarify a specific incident.

A processor agreement in accordance with Art. 28 GDPR must be concluded with the hosting provider, if necessary.

The website is technically supported by:

J&G Agency GmbH
Konrad-Zuse-Straße 6
46397 Bocholt
Germany

Email: info@jg-agency.de

Insofar as the agency gains access to personal data within the scope of maintenance, support, or further development, this is done on the basis of a processor agreement in accordance with Art. 28 GDPR.

We use a consent management system through which you can select, upon your first visit to the website, which technically non-essential services are permitted. Your selection will be saved so that it can be taken into account on subsequent visits.

Legal bases are Art. 6 para. 1 lit. c GDPR in conjunction with the obligation to be able to demonstrate given consents, and Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the legally compliant and user-friendly management of consents. Insofar as information is stored or accessed on the end device for this purpose, Section 25 para. 2 no. 2 TDDDG applies.

You can revoke or change a given consent at any time with future effect via the “Cookie Settings” function available on the website.

Our website uses technically necessary and – with your consent – optional cookies and similar technologies.

Technically necessary technologies serve, for example, the basic function of the website, security, and the storage of your privacy settings. Optional technologies can be used for audience measurement, advertising, integration of external media, and evaluation of campaigns.

A current overview of the technologies used, providers, purposes, and storage durations must be available in the consent management system.

If you contact us via email, phone, contact form, WhatsApp, or a direct message on a social network, we process the information you provide. This may include, in particular, your name, contact details, content of the message, time of contact, and any other voluntarily submitted information.

Processing is carried out to handle your inquiry. The legal basis is Art. 6 para. 1 lit. b GDPR if your inquiry serves to initiate or fulfill a contract. In other cases, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in appropriately responding to inquiries.

General contact inquiries are generally deleted no later than six months after final processing. Business or tax-relevant communication is retained in accordance with statutory retention periods. If a message is necessary for the assertion, exercise, or defense of legal claims, it may be stored until the expiry of the relevant limitation period.

We do not accept booking, event, or application inquiries via Instagram, Facebook, or TikTok. Please use the contact and booking options provided on our website for these purposes.

If you inquire about an event, company event, group booking, or similar service via our website, we process, in particular:

• name and contact details,
• company or organization, if specified,
• desired date and time,
• group size,
• type and content of the event,
• other information you voluntarily provide.

The legal basis is Art. 6 para. 1 lit. b GDPR. Event inquiries that do not result in a contract are generally deleted twelve months after the inquiry is concluded, unless consent for longer storage exists or there are statutory retention obligations or legitimate reasons for longer storage. If a contract is concluded, we store contract- and billing-relevant data in accordance with statutory retention periods.

If you subscribe to our newsletter, we process your email address and, if applicable, your name, as well as log data for registration. Registration takes place via a double opt-in procedure. You will receive an email in which you must confirm your registration.

The legal basis for sending is your consent in accordance with Art. 6 para. 1 lit. a GDPR. The logging of the registration is based on Art. 6 para. 1 lit. c and f GDPR, to be able to prove consent and prevent misuse.

You can revoke your consent at any time with future effect, particularly via the unsubscribe link in each newsletter email. The lawfulness of processing until revocation remains unaffected.

After unsubscribing, we delete your data from the active newsletter distribution list. The email address may then be stored for up to three years in a blocking or proof list, insofar as this is necessary to defend against possible claims and to prove the given consent. No further newsletters will be sent during this period.

We use Playtomic for court bookings, customer accounts, and payment processing. When you access or use the booking service, personal data is processed directly by or via Playtomic. This may include, in particular, master and contact data, account data, booking information, game and usage data, payment information, and technical usage data.

Insofar as we receive and process your booking data ourselves for the performance of the contract, organization of game operations, check-in, access control, customer communication, or billing, the legal basis is Art. 6 para. 1 lit. b GDPR. We process legally required booking and billing documents on the basis of Art. 6 para. 1 lit. c GDPR.

Playtomic manages customer accounts and payment processes according to its applicable terms and privacy policy. Therefore, please also note Playtomic’s privacy policy provided during registration or booking.

We plan to use Google Tag Manager, a service from Google. Google Tag Manager is used to manage and control other website tags. Which data processing operations are triggered depends on the services integrated via Tag Manager.

Google Tag Manager and all technically non-essential services controlled via it may only be loaded after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to use Google Analytics for audience measurement and analysis of our website usage. This may include, among other things, information on page views, interactions, approximate location, browser, device, referrer, and campaigns, and may be assigned to a pseudonymous user ID.

Google Analytics will only be activated after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to use Google Ads, including conversion measurement and, if applicable, remarketing. This allows us to measure whether users perform certain actions on our website after clicking an ad. Cookies or similar identifiers, device information, IP address, campaign information, and interactions may be processed.

Activation will only occur after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to use the Meta Pixel for measuring and optimizing advertising campaigns on Facebook and Instagram. This may involve processing data such as page views, interactions, booking or contact actions, technical device and browser data, IP addresses, and cookie or user identifiers.

The service will only be activated after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to use the TikTok Pixel for measuring and optimizing advertising campaigns. This may include, in particular, page views, interactions, conversions, technical device and browser data, IP address, and cookie or user identifiers.

The service will only be activated after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to use Microsoft Advertising, including conversion measurement. This can record whether users perform certain actions on our website after clicking an ad. In particular, cookie or user identifiers, IP address, device and browser data, campaign information, and interactions may be processed.

The service will only be activated after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time via the Cookie Settings.

We plan to integrate Google Maps to display our location and directions. When the map is loaded, IP address, device and browser information, location data, and interactions may be transmitted to Google.

Google Maps will only be loaded after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. Alternatively, a static preview or a button to reload should be displayed until consent is given.

We plan to embed videos via YouTube and Vimeo. When a video is played or – depending on the embedding type – already when an embedded video is loaded, the providers may process, in particular, IP address, device and browser data, referrer, usage data, and identifiers.

External videos will only be loaded after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. Until consent is given, only a data-saving placeholder should be displayed.

We plan to embed individual content from Instagram or TikTok. When such content is loaded, the platform operators may process, in particular, IP address, device and browser data, referrer, usage data, and identifiers. This can also occur if you are not logged in to the respective platform.

Embedded social media content will only be loaded after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. Until consent is given, a placeholder should be displayed.

Fonts from Google Fonts may be used for the display of our website.

Recommended variant – local provision: If the fonts are stored locally on our server, no connection to Google Fonts is established when the page is accessed. The processing of technically necessary connection data by our server is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in a uniform and appealing presentation of the website.

Not recommended variant – retrieval from Google: If fonts are loaded directly from Google, your IP address, in particular, may be transmitted to Google. Such integration may only take place after a data protection and technical review and – if necessary – after your consent.

We plan to display Google reviews on our website or link to our Google Business Profile.

With a simple link, data is generally only transmitted to Google when you click the link. With dynamic integration, a widget, or plugin, data such as IP address, device and browser information, and usage data may be transmitted to Google already when the page is loaded.

Dynamically embedded reviews will only be loaded after your consent. Legal bases are Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. From a data protection perspective, a purely server-side or static display without a direct connection to Google when the page is accessed is preferable.

We maintain profiles on Facebook and Instagram. The provider for users in the European Economic Area is generally:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

When you visit or interact with our profiles, Meta processes personal data under its own responsibility. This applies, for example, to profile data, device and usage data, interactions, messages, comments, and reactions. Meta may also process data for analysis and advertising purposes and combine it with other information.

We process data that you provide to us via our profiles for communication, processing general inquiries, conducting sweepstakes, and presenting our company. The legal basis is Art. 6 para. 1 lit. b GDPR, if it concerns pre-contractual or contractual matters, otherwise Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in public relations and communication with interested parties. For sweepstakes, the respective terms of participation and privacy policy apply additionally.

For certain statistical evaluations, particularly page or profile insights, we and Meta may be jointly responsible in the sense of Art. 26 GDPR. Meta only provides us with aggregated statistics. The essential provisions of joint responsibility are provided by Meta.

Direct messages are generally deleted no later than six months after final processing, unless statutory retention obligations or reasons for the assertion, exercise, or defense of legal claims prevent this. Comments and public interactions generally remain visible until they are deleted by you or us, or the profile or post is removed.

We do not accept booking, event, or application inquiries via Facebook and Instagram.

Further information on data processing by Meta can be found in Meta’s privacy policy.

We maintain a profile on TikTok. The provider for users in the European Economic Area is generally:

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

When you visit or interact with our profile, TikTok processes personal data under its own responsibility. This may include, in particular, profile, device, usage, interaction, and message data. TikTok may process data for analysis and advertising purposes and combine it with other information.

We process the data you provide to us via TikTok for communication, answering general inquiries, conducting sweepstakes, and presenting our company. The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as processing is pre-contractually or contractually necessary, otherwise Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in public relations and communication with interested parties.

Direct messages are generally deleted no later than six months after final processing, unless statutory retention obligations or reasons for the assertion, exercise, or defense of legal claims prevent this. Comments and public interactions generally remain visible until they are deleted by you or us, or the profile or post is removed.

We do not accept booking, event, or application inquiries via TikTok.

Further information on data processing by TikTok can be found in TikTok’s privacy policy.

We plan to use WhatsApp in the form of a public channel, WhatsApp Business for general customer communication, broadcasts, and groups or communities. The provider for users in the European Economic Area is:

WhatsApp Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

When using WhatsApp, WhatsApp processes personal data under its own responsibility. This may include, in particular, phone number, profile information, device and connection data, usage information, communication metadata, and – depending on the respective function – content or interactions.

If you contact us via WhatsApp, we process your phone number, your profile name, the content of your message, the time of communication, and other voluntarily submitted data. The legal basis is Art. 6 para. 1 lit. b GDPR if the communication serves to initiate or fulfill a contract. In other cases, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in fast and user-friendly communication.

The automatic synchronization of the smartphone address book with WhatsApp is deactivated. Contacts are only processed within the framework of data protection-compliant contact management.

We only send broadcast messages or similar direct information with your prior consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time with future effect.

In groups and communities, depending on the settings, profile name, profile picture, phone number, messages, or interactions may be visible to other members. Before joining, you must be informed about this separately and clearly. For public information, a WhatsApp channel should be used instead of a group, if possible.

WhatsApp messages are generally deleted no later than six months after final processing, unless statutory retention obligations, ongoing contractual relationships, or reasons for the assertion, exercise, or defense of legal claims prevent this.

Further information can be found in WhatsApp’s privacy policy.

If we conduct sweepstakes on the website or via social networks, we process the data necessary for participation, drawing, notification, and prize handling. This may include name, username, contact details, entry, and, if applicable, address.

The legal basis is Art. 6 para. 1 lit. b GDPR. Insofar as you have separately consented to promotional use or publication, Art. 6 para. 1 lit. a GDPR is the legal basis.

Data of unconsidered participants is generally deleted three months after the complete conclusion of the sweepstakes. Data of winners may be stored longer due to statutory proof and retention obligations. For each sweepstakes, additional terms of participation and, if applicable, special privacy policies are provided.

Inquiries from contact forms, WhatsApp, or social networks may be transferred to a CRM, email, or other administration system in the future to organize communication and processing.

We plan to offer guests Wi-Fi access. In particular, device identifiers, IP and MAC addresses, connection times, transferred data volumes, and technical log data may be processed.

Processing is carried out to provide and secure Wi-Fi access, troubleshoot, and prevent misuse. The legal basis is, depending on the specific design, Art. 6 para. 1 lit. b or f GDPR. Our legitimate interest lies in the secure operation of the guest Wi-Fi.

Certain areas of the KRASO Padel Arena may be video-monitored. Video surveillance may only take place insofar as it is necessary and proportionate for specifically defined purposes, for example, to protect property rights, to protect persons and property, and to clarify significant security incidents.

The legal basis may be Art. 6 para. 1 lit. f GDPR. Our legitimate interests must be documented before commissioning and weighed against the rights and freedoms of the data subjects.

Video recordings are generally to be deleted after 72 hours. Longer storage only occurs if a specific incident has been identified and the relevant recordings are required for its clarification, for securing evidence, or for the assertion, exercise, or defense of legal claims.

For digital access controls and automated check-in, in particular, name, customer or booking number, booking time, access time, authorization, access medium used, device identifier, and technical log data may be processed.

Processing is carried out for the performance of the booking, granting of booked access, securing the facility, and handling technical malfunctions. Legal bases are Art. 6 para. 1 lit. b and – for security logs – Art. 6 para. 1 lit. f GDPR.

Regular access logs are generally deleted after 30 days, unless they are required for billing, clarification of a security incident, or enforcement of claims.

License plate recognition is only planned if it is necessary for access or parking control and can be designed in a data protection-compliant manner. License plates, entry and exit times, and possibly an assignment to a booking could be processed.

When using electronic lockers, locker number, usage time, access ID, booking or customer number, and technical log data may be processed.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as processing is necessary for the provision of the locker. Security logs may be based on Art. 6 para. 1 lit. f GDPR.

We only transmit personal data if there is a legal basis for doing so. Recipients may include, in particular, hosting and IT service providers, website agencies, communication and newsletter service providers, booking and payment providers, analysis and advertising service providers, social media platforms, technical operators of the arena, as well as authorities or other bodies if legally obliged.

Service providers who process data on our behalf are contractually obliged on the basis of Art. 28 GDPR.

Some of the aforementioned providers may process personal data outside the European Union or the European Economic Area. A transfer only takes place if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as standard contractual clauses, or a legal exception.

Insofar as a provider is certified under the EU-US Data Privacy Framework, the transfer can be based on the corresponding adequacy decision. The specific certification and the actually involved companies must be regularly checked.

We store personal data only for as long as it is necessary for the respective purpose. Thereafter, we delete or anonymize the data, unless statutory retention obligations, ongoing contractual relationships, consents, or legitimate reasons for the assertion, exercise, or defense of legal claims prevent this.

For individual processing operations, the standard periods mentioned in this privacy policy apply. Legally required business and tax documents are stored according to the respective applicable periods.

You have the following rights, in particular, within the framework of legal requirements:

• Right to information according to Art. 15 GDPR,
• Right to rectification according to Art. 16 GDPR,
• Right to erasure according to Art. 17 GDPR,
• Right to restriction of processing according to Art. 18 GDPR,
• Right to data portability according to Art. 20 GDPR,
• Right to object according to Art. 21 GDPR,
• Right to withdraw given consents with future effect according to Art. 7 para. 3 GDPR,
• Right to lodge a complaint with a data protection supervisory authority according to Art. 77 GDPR.

To exercise your rights, you can contact datenschutz@kraso-padelarena.de.

Insofar as we process personal data on the basis of Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation.

If personal data is processed for direct marketing purposes, you can object to this processing at any time. After your objection, your data will no longer be used for these purposes.

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is generally:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

Website: https://www.ldi.nrw.de

You can also contact another competent supervisory authority according to Art. 77 GDPR.

Within the framework of contracts or bookings, you must provide the personal data that is necessary for conclusion, performance, and billing. Without this data, we may not be able to offer the respective service. For voluntary offers and consents, there is no legal obligation to provide data.

We generally do not make exclusively automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR.

We take appropriate technical and organizational measures to protect personal data from loss, manipulation, unauthorized access, and other risks. Our measures are reviewed and adapted in accordance with technical developments and the respective risk.

We will adapt this Privacy Policy if our data processing operations, services used, or legal requirements change. The version published on this website at the time of your visit applies.

Status: July 29, 2026