Privacy Policy

Effective: 1 January 2025  ·  Sportalade  ·  Version 1.0

1. Controller and Processor

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and explains how your personal data is processed when you use the Sportalade free sports equipment rental service.

Data Controller (determines the purposes and means of processing):

• Sportalade
• Address: Krasta iela 86 – 33, Rīga, LV-1019
• Email: info@sportalade.lv

Data Processor (provides the technical platform on behalf of the Controller):

• Allockate (owner and operator of the Sportalade brand)
• Address: Krasta iela 86 – 33, Rīga, LV-1019
• Email: info@sportalade.lv

Sportalade is a brand managed by Allockate. Allockate assumes all data controller responsibilities for the processing of personal data under this policy.

2. Personal Data Collected

The following personal data is collected during registration and use of the service:

Data Category	Specific Data	When Collected
Identification data	First name, last name	At the time of registration
Electronic address	Email address	At the time of registration
Contact information	Phone number	At the time of registration
Location data	GPS coordinates / to locate the nearest rental point	During use of the service (only with user permission)
Service usage data	Rental times, returned equipment, access history	During use of the service

3. Processing of Minors' Personal Data

The Sportalade service is available to persons aged 16 and over. Persons under 16 may not register or use the service without the consent of a parent or guardian.

In accordance with GDPR Art. 8, if we become aware that personal data has been provided by a child under 16 without parental consent, we will delete that data without delay.

4. Purposes and Legal Basis for Processing

Each processing activity has a specific purpose and a legal basis defined in Article 6 of the GDPR:

Purpose of Processing	Data Used	Legal Basis (GDPR Art. 6)
User identification and registration	First name, last name, email, phone	Art. 6(1)(b) — performance of a contract
Sending SMS verification code	Phone number	Art. 6(1)(b) — performance of a contract
Providing rental access (locker opening)	Phone number	Art. 6(1)(b) — performance of a contract
Locating the nearest rental point	Location data	Art. 6(1)(b) — performance of a contract
Rental status notifications and reminders	Email, phone number	Art. 6(1)(b) — performance of a contract
Ensuring service security and incident investigation	Service usage data	Art. 6(1)(f) — legitimate interests
Compliance with regulatory requirements	First name, last name, service data	Art. 6(1)(c) — legal obligation

5. Recipients of Personal Data

Your personal data is not sold or transferred to third parties for commercial purposes. Data is shared only in the following cases:

• Allockate — as data controller operating under the Sportalade brand, providing the rental platform technology.
• SMS service provider — the phone number is passed to the SMS service provider solely for delivery of verification codes and access links.
• Competent public authorities — where required by applicable law or court order.

6. Transfers Outside the EU/EEA

Your personal data is processed and stored within the European Union or the European Economic Area (EU/EEA). Data is not transferred to countries outside the EU/EEA.

If the SMS service provider processes data outside the EU/EEA, this occurs only where the European Commission has adopted an adequacy decision or where safeguards under GDPR Art. 46 are in place.

7. Retention Periods

Personal data is retained for as long as necessary for the stated processing purposes or to fulfil regulatory requirements:

• Account data (first name, last name, email, phone) — retained while the user actively uses the service or until an account deletion request is made.
• Location data — not stored permanently; used only to locate the nearest locker during the session.
• Service usage logs — up to 12 months after the last use of the service.
• Accounting records — in accordance with the retention periods prescribed by applicable law (generally 5 years).
• After the retention period, data is permanently deleted or anonymised.

8. Your Rights Under the GDPR

You have the following rights regarding your personal data. To exercise them, contact us at info@sportalade.lv — we will respond within 30 days free of charge.

If you believe your rights have been violated, you have the right to lodge a complaint with the Data State Inspectorate (Latvia):

• Website: www.dvi.gov.lv
• Email: pasts@dvi.gov.lv
• Address: Elijas iela 17, Riga, LV-1050

9. Automated Decision-Making and Profiling

We do not carry out automated decision-making or profiling within the meaning of GDPR Art. 22. All decisions relating to the service are made with human involvement.

10. Data Security

Allockate (Sportalade) applies appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encrypted data transmission (HTTPS/TLS);
• Access control — data accessible only to authorised personnel;
• Location data is not retained after the service session ends.

In the event of a personal data breach that poses a risk to your rights and freedoms, the Data State Inspectorate will be notified within 72 hours and, where necessary, you will also be notified personally — in accordance with GDPR Art. 33 and 34.

11. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy from time to time. We will notify you of material changes by publishing the new version on this page with an updated date and sending a notification to your registered email address. We recommend reviewing this policy periodically.

12. Contact Information

For questions about the processing of personal data, please contact us:

• Company: Allockate (Sportalade brand)
• Email: info@sportalade.lv
• Address: Krasta iela 86 – 33, Rīga, LV-1019