This document explains what personal data Keep Calm collects, how we use it, and your rights. We aim to be transparent and collect only what's necessary to run the community.
Who Controls Your Data
The data controller for the purposes of this policy is Keep Calm Barcelona, the registered association behind this community.
Our Approach
Keep Calm is a volunteer-run community, not a commercial business. We:
- Collect minimal data needed to organise activities
- Don't sell or share your data with third parties
- Don't use your data for marketing beyond Keep Calm activities
- Try to be transparent about what we collect and why
What Data We Collect
When You Join WhatsApp Groups
Automatically visible:
- Phone number (visible to group members)
- WhatsApp display name
- Profile photo (if public)
Note: This is controlled by WhatsApp, not Keep Calm. Adjust your WhatsApp privacy settings to control what others see.
When You Participate
We may record:
- Your name
- Which sessions you attend
- Your skill level (self-reported or observed)
- Strike/violation history
- Payment status for paid activities
Organisers may note:
- Reliability (for booker assignments)
- Preferences (times, venues)
- Any issues or feedback
When You Use Playtomic (Padel/Tennis)
Playtomic collects (their platform, their privacy policy):
- Email address
- Phone number
- Payment details
- Playing history and skill score
- Profile information
We may access:
- Your Playtomic username/profile
- Booking confirmations you share
- Your skill score (public on Playtomic)
When You Fill Out Forms
Google Forms or similar may collect:
- Name
- Email address
- Phone number
- Skill level
- Availability preferences
- Any other fields on the form
Photos and Videos
At events:
- Photos may be taken at sessions
- You may appear in group photos
- Photos may be shared on social media
See the Photography section below.
How We Use Your Data
Organising Activities
- Assigning you to games/sessions
- Contacting you about bookings
- Matching skill levels
- Tracking attendance
Community Management
- Applying the strike system
- Identifying reliable members for roles
- Following up on issues
- Welcoming new members
Communication
- WhatsApp group announcements
- Direct messages about bookings
- Event invitations
- Community updates
We Don't
- Sell your data
- Share with third parties for marketing
- Use for purposes unrelated to Keep Calm
- Keep data longer than necessary
Legal Basis for Processing
Under GDPR, we rely on one of these for each purpose above:
| Purpose | Legal Basis |
|---|---|
| Organising activities, tracking attendance, applying the strike system | Legitimate interest - running the community fairly |
| WhatsApp group communication | Legitimate interest / your own choice to join the group |
| Website login and onboarding verification (SMS/email codes) | Legitimate interest - keeping accounts secure |
| Routine event/group photos and social media | Legitimate interest - promoting the community, balanced against your right to object (see Photography below) |
| Individual feature photos, testimonials, or other non-routine use of your image | Consent - explicitly requested, separate from routine event photography |
| Payment records for paid activities | Legal obligation (accounting/tax) and contract |
| Sharing data with authorities when required | Legal obligation |
Where Data Is Stored
WhatsApp (Meta Platforms Ireland Ltd)
- Group messages and member lists
- Controlled by Meta's privacy policy
- We can't export or fully control this data
Google (Google Ireland Limited)
- Form responses (Google Forms)
- Organiser spreadsheets (Sheets)
- Shared documents (Drive)
- Email sent to our @keepcalm.fit addresses, including privacy@keepcalm.fit, forwards through Google Workspace to Gmail
- Subject to Google's privacy policy
Playtomic
- Booking and payment data
- Player profiles and scores
- Controlled by Playtomic's privacy policy
Website & Server Hosting
- The keepcalm.fit website and its underlying data run on servers provided by Hetzner Online GmbH (Germany)
- Governed by Hetzner's privacy policy
AI Assistant (WhatsApp Bot)
- Our WhatsApp bot uses a large language model to help draft and send replies
- Message content it processes is sent to Anthropic PBC or OpenAI, L.L.C. (both USA-based), depending on which model handles the request
- These providers process the message content only to generate a response
- Governed by Anthropic's privacy policy and OpenAI's privacy policy
Website Login / Onboarding Verification
- When you sign in or complete the /onboard form on keepcalm.fit, we send a one-time verification code by SMS or email
- SMS codes are sent via Twilio Inc. (USA)
- Email codes are sent via Resend, Inc. (USA)
- These providers only see your phone number or email address and the code itself, to deliver the message
- Governed by Twilio's privacy policy and Resend's privacy policy
- Your /onboard form answers themselves (name, contact details, and the other questions on the form) are stored separately - see Supabase below
Supabase (Onboarding Form Answers)
- Your answers on the /onboard form (name, contact details, and the other questions it asks) are stored in a dedicated database run by Supabase, hosted in the EU (Ireland)
- The contracting entity, Supabase Pte. Ltd. (Singapore, a subsidiary of Supabase, Inc., USA), applies Standard Contractual Clauses as its data transfer safeguard, even though the data itself stays on an EU server
- Governed by Supabase's privacy policy and data processing addendum
Organisers' Devices
- Some notes/records may be on personal phones
- Not ideal, but reality of volunteer organisation
- We're working toward centralised, secure storage
Data Retention
How Long We Keep Data
| Data Type | Retention |
|---|---|
| WhatsApp messages | Kept indefinitely in our bot's message log (used for moderation lookback and chat history) - not automatically deleted when you leave a group |
| Attendance records | Duration of your membership + 1 year |
| Strike records | Duration of your membership |
| Form responses | Until no longer needed (typically 1 year) |
| Payment records | As required for financial records |
| Photos | Indefinitely unless you request removal |
When You Leave
If you leave Keep Calm:
- Leaving a WhatsApp group removes you from the current member list, but your past messages stay in our bot's message log (see retention table above) - contact us if you'd like them deleted
- We'll delete organiser records within reasonable time
- Some records may be kept for community continuity
- Photos on social media remain unless you request removal
Photography
At Events
General approach:
- Group photos are common and expected
- We try to capture the community positively
- Photos may be used for social media
Your rights:
- You can ask not to be photographed
- You can step out of group photos
- You can ask to be excluded from specific photos
- Tell the photographer or organiser
If you're taking photos:
- Be respectful of others
- Ask before taking close-up/individual shots
- Don't photograph people who've asked not to be
- See Community-Conduct.md
Social Media Use
Photos may be posted on:
- Keep Calm Instagram
- Keep Calm Facebook
- Other Keep Calm channels
Before posting:
- We aim to select flattering, positive images
- We won't deliberately post embarrassing photos
- We may tag individuals (you can untag yourself)
Requesting removal:
- Contact the Social Media Coordinator or an organiser
- We'll remove photos within reasonable time
- Be specific about which photos
Legal Basis for Photography
Routine event and group photography is based on our legitimate interest in promoting the community, not on consent - being in a group photo at a public community event isn't something we ask you to individually opt into each time, in the same way a sports match or festival wouldn't.
When you join via keepcalm.fit's onboarding, this is called out as its own specific item on the rules checklist (not bundled with anything else), so it's something you're explicitly told about, not something we infer from you simply turning up.
Because it's legitimate interest, not consent, your recourse is the right to object, at any time and without needing a reason:
- Tell the organiser at the start of the event, or position yourself away from cameras
- Ask not to be in a specific photo, or ask for one to be removed afterwards (see Requesting Removal above)
For anything beyond routine event photography - an individual feature photo, a testimonial, or any other non-routine use of your image - we'll ask for your explicit consent separately, typically via a sign-up form.
Your Rights (GDPR)
As we operate in the EU, you have rights under GDPR:
Right to Access
You can ask what data we hold about you.
How to request:
- Contact an organiser or core team member
- We'll respond within 30 days
- We'll provide what we can access
Right to Rectification
If data about you is incorrect, you can ask us to fix it.
Examples:
- Wrong skill level recorded
- Incorrect contact details
- Mistaken strike record
Right to Erasure ("Right to be Forgotten")
You can ask us to delete your data.
What we can delete:
- Organiser records and notes
- Form responses
- Spreadsheet entries
- Your message history in our own WhatsApp bot database (contact us to request this)
What we can't delete:
- Copies of messages held on WhatsApp/Meta's own systems, or on other members' devices - that's outside our control, governed by Meta's privacy policy
- Playtomic data (contact Playtomic)
- Publicly posted photos (but we'll try to remove)
Right to Object
You can object to certain uses of your data.
Examples:
- Don't include me in social media posts
- Don't share my number with bookers
Right to Restrict Processing
Instead of deleting your data outright, you can ask us to pause using it while we sort out a concern (for example, while we check an incorrect skill level or investigate a disputed strike).
Right to Data Portability
Where we hold data you gave us directly (for example, a form response), you can ask for a copy in a common format to take elsewhere.
Right to Withdraw Consent
Where we rely on your consent (for example, a non-routine use of your photo, or an explicit sign-up form) rather than legitimate interest, you can withdraw it at any time. This doesn't affect anything we did before you withdrew it. Routine event photography is based on legitimate interest, not consent - see the Right to Object above and Legal Basis for Photography below for how to opt out of that.
Right to Lodge a Complaint
If you're unhappy with how we've handled your data, you can complain to Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es. We'd appreciate the chance to sort it out directly first.
Automated Decision-Making
We don't use automated decision-making or profiling that has a legal or similarly significant effect on you. Our WhatsApp bot uses an AI assistant to help draft messages, but it doesn't make decisions about your membership, standing, or access to activities.
How to Exercise Rights
Contact any organiser or core team member, or email privacy@keepcalm.fit. We're volunteers, so:
- Be patient-we'll respond within 30 days
- Be specific about what you're requesting
- Understand we may have technical limitations
Third-Party Services
We use services with their own privacy policies:
Meta Platforms Ireland Ltd (WhatsApp, Instagram, Facebook)
- Privacy policy: whatsapp.com/legal/privacy-policy (also covers Instagram/Facebook via Meta's main policy)
- WhatsApp controls our group messaging - we can't export or fully control that data
- Instagram and Facebook are used for public posting only - public posts are visible to everyone
- We can't control any of their data practices
Playtomic
- Privacy policy: playtomic.io/privacy
- Handles court bookings and payments
- Your account is between you and Playtomic
Google Ireland Limited (Forms, Sheets, Drive, Gmail)
- Privacy policy: policies.google.com/privacy
- We use it for forms, organiser documents, and receiving email sent to our @keepcalm.fit addresses (forwarded via Google Workspace to Gmail)
- Data stored on Google's servers
Hetzner Online GmbH
- Privacy policy: hetzner.com/legal/privacy-policy
- Hosts the keepcalm.fit website and its data (Germany)
Anthropic PBC / OpenAI, L.L.C.
- Privacy policies: anthropic.com/legal/privacy · openai.com/policies/privacy-policy
- Process WhatsApp bot message content (USA) to generate replies
Twilio Inc. / Resend, Inc.
- Privacy policies: twilio.com/en-us/legal/privacy · resend.com/legal/privacy-policy
- Send one-time SMS/email verification codes (USA) when you sign in or complete the /onboard form
Supabase
- Privacy policy: supabase.com/privacy · data processing addendum
- Stores your /onboard form answers (name, contact details, and the other questions it asks) on a server in the EU (Ireland)
- Contracted through Supabase Pte. Ltd. (Singapore, a subsidiary of Supabase, Inc., USA)
Administrations, Courts and Police
- We only share data with public authorities when legally required to (e.g. a court order or a legal obligation)
- We don't proactively share member data with any government body
International Data Transfers
Some of the services above (Meta/WhatsApp, Anthropic, OpenAI, Twilio, Resend) are based in or transfer data to the USA, outside the European Economic Area. Supabase is a related case: our onboarding data is stored on a server in the EU (Ireland), but the contracting entity is Supabase Pte. Ltd. (Singapore), a subsidiary of the US-based Supabase, Inc. Where any of this happens, the provider's own safeguards apply (typically Standard Contractual Clauses). We don't control this directly, but we choose providers that publish their transfer safeguards.
Data Security
What We Do
- Limit access to organiser records
- Use platform security features where available
- Don't share data unnecessarily
- Delete data when no longer needed
Limitations
As a volunteer organisation:
- We don't have enterprise security systems
- Some data is on personal devices
- We rely on platform security (WhatsApp, Google, etc.)
- Human error is possible
If There's a Breach
If we become aware of unauthorised data access:
- We'll assess the scope and risk to affected individuals
- Where the law requires it, we'll notify the AEPD within 72 hours of becoming aware
- We'll notify affected individuals directly if the breach poses a real risk to them
- We'll take steps to prevent recurrence and be transparent about what happened
Organisers and Data Access
Who Has Access
- Sport Leads: Data for their sport
- Core Team: Community-wide data
- Bookers: Names of players on their court
- Session Hosts: Attendance for their session
- Event Organisers: Attendance for the event they're running
Organiser Responsibilities
Organisers should:
- Only access data needed for their role
- Not share data outside Keep Calm
- Delete data when no longer an organiser
- Report any concerns about data security
Changes to This Policy
We may update this policy as:
- We adopt new tools or platforms
- Regulations change
- We improve our practices
Significant changes will be announced in community groups.
Questions or Concerns
If you have questions about data or privacy:
- Ask any organiser
- Contact a core team member
- Email privacy@keepcalm.fit
- Raise in a community meeting
We're open to feedback on improving our data practices.
Summary
| What We Collect | Why |
|---|---|
| Name, contact | Organise sessions, communicate |
| Skill level | Match games appropriately |
| Attendance | Track reliability, apply rules |
| Photos | Social media, community memories |
| Your Rights | How to Exercise |
|---|---|
| Access your data | Ask an organiser |
| Correct errors | Tell an organiser |
| Delete data | Request from organiser |
| Opt out of photos | Tell organiser/photographer |
This is a quick reference - see Your Rights (GDPR) above for the full list, including restriction, portability, withdrawing consent, and lodging a complaint.
Related Documents
- Community-Conduct.md - Photography guidelines in conduct section
- Rules.md - Community rules overview
- Safety-Liability.md - Related to incident reporting