LEGAL
Privacy Policy
1. Data we collect
Required at sign-up: name, ID, password (stored hashed), residency, an email address, and a DUPR ID. Optional: date of birth, mobile number (without it you cannot receive KakaoTalk notices about entries and draws), gender, region, and an optional profile photo and short bio (added on My Page). At tournament entry (optional): DUPR account email, romanized name, depositor name. When you send a lesson or education inquiry (including non-members): Inquiry type, Name, Phone, Email, Organization (school, club, institution), Region, Approx. participants, Preferred dates / days / times, Your message. Automatically: access logs and browser information for session management. When you list a coach, club, court, or vendor (including non-members): the details you submit — name or business name, photos, contact details, areas, description — and a 6-digit edit code (stored hashed).
2. Purpose
Member management, tournament registration and operations, minimal identity disambiguation in partner search (name plus last 4 digits of mobile or birth year), submission of match results to DUPR (only with separate consent), and responding to lesson and education inquiries. We also operate the coach, club, court, vendor and mate directories — only the contact fields you tick as public are published. We also publish player records — name (or nickname), gender, region, profile photo and short bio (if provided), tournament history and results, and KPR ranking points — as part of the official record service; contact details are never published, and members may request name masking via My Page or the privacy officer.
3. Retention
Member data is deleted without delay upon account deletion. Data from lesson and education inquiries is deleted one year after the inquiry is received. Korean law may require longer retention in specific cases (e-commerce records up to 5 years, consumer dispute records 3 years, access logs 3 months). Coach, club, court, vendor and mate listings are kept until the owner takes them down or asks us to delete them; rejected listings are deleted 30 days after rejection.
4. Cross-border transfer
(1) DUPR ratings — only for members who separately consent. Recipient: DUPR (USA). Items: name (Korean and romanized), DUPR ID, DUPR account email, birth year, gender, match records. When and how: in bulk after each tournament, by file upload or API. Purpose: rating calculation. Retention: per DUPR policy. Declining does not affect participation, and consent can be withdrawn at any time. (2) Storage and processing abroad for service operation — carried out without separate consent, as necessary to perform our service and disclosed in this policy (PIPA Art. 28-8(1)3). Vercel Inc. (USA), hosting; Neon Inc. (USA), database storage; Resend (USA), email delivery. Items: information submitted while using the service (member data, tournament entries, inquiries) — for Resend, recipient name, email address and message body. When and how: continuously while the service is used, transmitted over the network. Retention: until the processing agreement ends, or per the retention periods in section 3. You may stop this processing by deleting your account or withdrawing your inquiry, which will limit use of the related service.
5. Sharing with third parties
We do not share personal data with third parties, except where you have separately consented (see cross-border transfer above) or where required by law. Data from lesson and education inquiries is used only to respond to the inquiry — never for marketing, and never shared.
6. Processors
Vercel Inc. (USA) — hosting; Neon Inc. (USA) — database; Resend (USA) — email delivery; Solapi (Korea) — KakaoTalk and SMS delivery.
7. Your rights
You may request access, correction, deletion, or suspension of processing at any time via your profile or the contact below. If you sent an inquiry without an account, you can exercise the same rights through the privacy officer listed below.
8. Deletion
Data whose retention period has passed or whose purpose has been fulfilled is destroyed without delay by irreversible means.
9. Security
Passwords are one-way hashed (bcrypt); stored data is encrypted at rest (AES-256, by our processor Neon Inc.); transport is encrypted (HTTPS, TLS 1.2+); access is limited to the minimum necessary; administrator accounts require two-factor authentication by SMS; administrator actions are logged; and data past its retention period is purged automatically.
10. Privacy officer
Seokjae Lee · 02-6332-2017 · pickleballkorea@pickleballkorea.com
Effective date
This policy applies from September 5, 2026 (previous version effective August 24, 2026).