Data for Tennis Privacy Policy

Applies from: Publication of this version.
Last updated: 5 October 2026

1. Who is responsible and how to contact us

ACYCLIC LABS LIMITED, a private limited company registered in England and Wales, United Kingdom, company number 16816653, operates Data for Tennis (we, us or our). Our registered office is 11 11 Ampton Road, Birmingham, United Kingdom, B15 2UH.

For privacy requests, complaints, support and legal enquiries, contact [email protected] or write to our registered office. You do not need an account, subscription or purchase to exercise a privacy right.

We are the controller where we determine the purposes and means of the processing described in this Policy. This Policy covers our website at datafortennis.com, accounts, developer console, API, data exports and related services we provide (the Service).

Our Terms of Service govern purchases and the data licence. Our Cookie Policy explains browser-storage and access technologies. Accepting the Terms does not constitute blanket consent to personal-data processing or waive any privacy right.

2. The people and processing covered

We distinguish two groups of information.

Service-operation information concerns visitors, account holders, API users, purchasers, people making business enquiries, representatives of customers, and people contacting us or exercising rights.

Tennis-product information concerns identifiable players and, where included in a particular record, other people participating in tennis competitions. Player names, results, biographical details and player-linked statistics can be personal data even when publicly available. An aggregate is not anonymous merely because it is statistical.

A player may have privacy rights without ever having used our website. A customer buying through a personal account, or a person representing a company, retains the privacy rights that apply to them.

Customers using tennis records in their own applications, publications, analyses or models determine their own purposes and responsibilities. Ordinarily, we and those customers act as independent controllers for our respective uses. A customer is not automatically our processor because it pays for API access. Where an activity genuinely involves processing solely on a customer's instructions, the actual arrangement and any required processing agreement determine the roles.

Regional rights apply when the relevant law's territorial, substantive and threshold conditions are met. This Policy does not extend every regional law to every person or claim that the mere worldwide availability of the website settles legal applicability.

3. Information and sources

3.1. Account, usage and transaction information

We process the following information for the interactions and features you use. A feature-specific entry does not mean that every visitor supplies every field.

Some information is necessary to provide an interaction: for example, an email-based account requires an email address and sufficient authentication information. A purchase may require billing information to fulfil the Order or meet tax requirements. Where provision is required, failure to provide the necessary information may prevent the relevant feature or transaction.

Please do not submit wallet seed phrases, private keys, complete payment-card security credentials, health records or unrelated third-party personal data in support messages or API parameters. If extra verification is legally necessary, we or the relevant provider will explain the request and the appropriate channel.

Google sign-in is an identity feature, not consent to Google Analytics or advertising. An identity provider also processes information for its own service under its applicable privacy notice and the permissions shown during sign-in.

3.2. Tennis records

Tennis-product information includes player names and identifiers, participation in competitions and matches, results, available point-by-point records and player-linked statistics. A supplied player profile can also include sporting biographical information, such as nationality, age or date of birth, playing characteristics and rankings, to the extent present in the relevant profile. We distinguish source records from statistics or other values calculated from them.

These records are obtained indirectly from sports-data suppliers and rights holders, competition and governing-body publications, and public sporting records where used for the relevant dataset. A record can combine information from more than one source and may subsequently be corrected or supplemented. Those sporting sources are distinct from the providers operating our website or payment systems.

The coverage information and documentation explain the product's available record families and limitations. You may contact [email protected] about the source of information concerning you; we will provide source information in accordance with your applicable rights and any lawful limits protecting others.

3.3. Optional purposes

Optional marketing, analytics or advertising is not authorized simply by creating an account or accepting the Terms. Where an optional feature involves such processing, the relevant purpose and choice must be presented before that processing, with consent or another valid legal basis as required. This Policy is not permission to collect unrelated information for unspecified future uses.

Transactional messages about authentication, security, an Order, a service change or a rights request are separate from promotional subscriptions. Withdrawing marketing consent does not prevent communications necessary to provide an existing service or comply with law.

4. Purposes, legal grounds, recipients and retention criteria

The table identifies the grounds relevant under the UK GDPR and, where applicable, the EU GDPR. Other applicable privacy laws may use different classifications. When we refer to legitimate interests, we mean the specified interest only to the extent it is necessary, proportionate and not overridden by the individual's rights and interests. A paid data licence is not itself a legal basis for processing every person's information.

A contractual basis is used only for processing objectively necessary for the relevant contract with that individual. It is not our basis for information about an athlete merely because somebody else buys access. Consent, where used for a separately described optional purpose, can be withdrawn as explained in Section 9.

5. Athlete information, transparency and rights

5.1. Sporting-information purposes

Our sporting-information purpose is to organize, verify and make tennis records useful for history, statistics, research, analysis and applications. Relevant interests include those of researchers, developers and other users of sporting information. The fact that a source is public, or a supplier has licensed it to us, does not automatically resolve the necessity and balancing required by data-protection law.

The extent of identification, the nature of the field, reasonable expectations in the sporting context, accuracy, potential harm, and the involvement of a younger athlete affect that assessment. Processing special-category information or other specially protected information requires the additional conditions imposed by law; the general sporting-information purpose does not override them.

5.2. Indirect collection

This Policy provides information to people whose records we receive from other sources. Where law requires additional direct information about indirect collection, that obligation applies within the relevant time and disclosure rules. An exception from individual notice must have a valid legal basis; publication of this Policy does not itself create such an exception.

You can request information about records concerning you and their available sources at [email protected]. Include enough detail to distinguish the relevant person or match without sending unnecessary identity documents.

5.3. Corrections, objections and deletion

Players and authorized representatives can request access, correction, deletion or restriction and can object to processing where the applicable law provides those rights. You do not need to purchase the Service. We may seek proportionate evidence of identity or authority and information that distinguishes people with similar names.

An accurate historical sporting record is not automatically erased on request; equally, its public origin does not automatically defeat a valid request. We assess the legal basis, applicable exceptions and the particular circumstances, explain a refusal where required, and identify the available complaint route.

Where we must correct, restrict or erase information, we address our own records and notify recipients as required by law. Customers remain responsible for their own processing and any lawful retention exception. A contractual right to store downloaded records does not override an applicable privacy right.

6. Recipients and commercial disclosures

6.1. Operating the Service

Information relevant to an interaction may be made available to providers performing the corresponding hosting, database, network protection, authentication, transactional email, support, payment or accounting function. Access is limited by the purpose and the relevant role. A provider processing on our instructions is different from a provider independently deciding how to operate its own identity, payment, compliance or other service.

Where you choose an external sign-in, checkout or payment service, that service is identified in the interaction and its own privacy notice applies to its independent processing. A merchant of record or reseller may maintain purchase, billing, fraud-prevention and tax records in its own capacity. A cryptocurrency provider may perform transaction screening or legally required checks. Those practices do not mean that all information held by the provider is copied to us.

Public blockchain transactions can be visible to network participants, explorers and others independently of our systems. We cannot unilaterally remove a transaction from an independently maintained public blockchain. That limitation does not exempt our account, support or other off-chain records from applicable privacy obligations.

6.2. Tennis-data customers

Providing identifiable tennis records to customers is part of our commercial data service. Customers may use the records for the purposes allowed by our licence, including applications, terminals, research, statistical analysis and lawful trading or model development. Account credentials, customer correspondence and payment details are not supplied as part of the tennis dataset.

A commercial licence of identifiable athlete records can constitute a sale or other regulated disclosure under a law that covers the information and transaction. Exclusions for particular publicly available information and other statutory exceptions must be considered on their actual terms. We do not describe every tennis record as anonymous or make a blanket claim that commercial provision of those records can never be a sale of personal information. Section 10 explains applicable US choices.

6.3. Legal and business events

We may disclose information to professional advisers, insurers, courts, regulators, law-enforcement bodies or other parties where reasonably necessary and lawfully justified to comply with a binding requirement, establish or defend a legal claim, investigate fraud or protect rights and safety.

Information relevant to a genuine reorganization, financing or transfer of the business may be reviewed by parties to that transaction under appropriate confidentiality and purpose restrictions. A business transfer does not independently authorize incompatible new purposes or remove required notices, safeguards or consent.

7. International processing

We are established in the United Kingdom. Providers, independent payment or identity services and customers receiving tennis records can be located in other countries. Our registered office is not a representation that every server, recipient or support activity is in the United Kingdom.

A transfer subject to UK or EU international-transfer restrictions requires an applicable lawful route. Depending on the recipient and circumstances, this can be an applicable adequacy decision, appropriate contractual or other safeguards with the required assessments and supplementary measures, or a narrowly applicable statutory exception. A recipient's name, acceptance of these Terms or the mere existence of standard contractual templates is not itself a transfer safeguard.

To request information about a transfer involving your personal data and, where applicable, a copy of or access to the relevant safeguards, contact [email protected]. Information may be redacted where necessary to protect another person's rights or confidential material without withholding the substance of the protection that must be disclosed.

8. Retention, deletion and restricted records

We retain personal data only for as long as needed for the purposes in Section 4 or another compatible, lawful purpose, including a binding retention obligation or a genuine legal claim. The applicable criteria differ by category; closing an account does not require immediate erasure of a tax record, and retaining a tax record does not justify retaining every authentication or technical record for the same period.

We consider the duration of the relationship, the need to complete the transaction or resolve the issue, legal record-keeping requirements, applicable limitation periods, the sensitivity of the information, and whether the purpose can be met with less information or genuinely anonymous records. Information kept solely for legal or evidential reasons is restricted to that purpose.

A historical sporting archive can remain relevant after a match or career ends. That does not establish an automatic entitlement to retain every personal field indefinitely. Continuing need, accuracy, legitimate objections, rights decisions and applicable legal requirements remain relevant.

Residual copies may remain in backups until the relevant replacement or deletion process completes, subject to applicable law. Information held only in such copies is not to be used for ordinary operations in a way that defeats a valid deletion or restriction, and any necessary restoration must reapply the applicable restriction. Backup retention does not justify postponing a legally required response or making the data freely available again.

Deleting browser cookies does not delete an account, payment record or tennis record. Conversely, a closed account does not erase information maintained independently by a payment provider or public blockchain. We will explain the scope of action on an applicable request.

9. UK and EU/EEA privacy rights and complaints

9.1. Your rights

Where the UK GDPR or EU GDPR applies, and subject to its conditions and exceptions, you may request access and a copy, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. Where the law requires it, that processing must stop unless compelling overriding grounds or the establishment, exercise or defence of legal claims justify continuing.

You may object to direct marketing at any time. Where processing is based on consent, you can withdraw that consent without affecting the lawfulness of earlier processing. You also have applicable protections concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Send a request to [email protected] or our registered office. We do not require a particular form or deny a request merely because it is made through another legally valid channel. Verification and clarification requests must be proportionate; we do not require unnecessary sensitive information or account creation to exercise a right. Requests are normally free. A fee or refusal is used only where the applicable law permits it, with the required explanation.

9.2. Response periods

We respond without undue delay and ordinarily within one calendar month of receiving a valid request. Where the applicable law permits because of complexity or the number of requests, that period may be extended by up to two further months. We will inform you within the initial month of an extension and its reasons. These are outer limits, not a general policy of delaying all responses.

Any legally permitted adjustment while obtaining necessary identity or clarification information is applied only under the rules governing that request, not as an automatic restart whenever we ask a question. Where we refuse to act, we explain the reasons and the available complaint or judicial remedy within the period required by law.

9.3. Data-protection complaints

You may send a complaint about our handling of personal data to [email protected]. Describe the matter and the outcome you seek; a special form is not required. Under the applicable UK complaints requirements, we acknowledge receipt within 30 days, investigate without undue delay, keep you appropriately informed and communicate the outcome without undue delay. A related statutory rights request keeps its own applicable response period.

You may complain to the UK Information Commissioner's Office or another competent supervisory authority. Where EU/EEA law applies, this includes the authority in your habitual residence, place of work or place of the alleged infringement. The European Data Protection Board's list of authorities provides contact information. You need not exhaust an informal support process before exercising a right to approach an authority or court.

10. US state privacy information and choices

10.1. Scope and categories

This section applies where a US state privacy law covers our activity and your information. Depending on the law, rights can include confirming processing, access, correction, deletion, a portable copy, opting out of sale, certain sharing or targeted advertising, and certain profiling or uses of sensitive information. Applicable non-discrimination protections also remain available.

The information categories and sources are described in Section 3. They can include identifiers and contact information, commercial or transaction information, internet or network activity, account-access information and identifiable sporting records or statistical inferences about performance. Account credentials can be treated as sensitive information under a relevant statute. Processing such information for a requested account does not itself authorize unrelated sensitive-data uses.

Sections 4, 6 and 8 explain purposes, recipient categories and retention criteria. Commercial disclosure of tennis records is distinguished from service-operation disclosures. Where additional notice at collection, an opt-out link or a particular consent is required for a covered practice, those requirements apply before that practice; this Policy does not replace a required collection-time choice.

10.2. Requests and representation

Submit a request or an applicable sale, sharing or targeted-advertising opt-out to [email protected]. Identify the right and the relevant account, transaction or tennis record sufficiently for us to act. Where applicable, an authorized agent may submit a request with proportionate evidence of authority. We will not apply access-request identity checks to an opt-out where the law does not permit them or require you to create an account unnecessarily.

Where a covered law requires recognition of a valid universal opt-out signal, including Global Privacy Control, that right is additional to direct contact and cannot be waived by these Terms. A browser signal and a request about an athlete record are not necessarily equivalent: the record must be reasonably associated with the person or device for a signal to identify it. This does not justify asking for unnecessary information or disregarding a signal where the law requires it to be acted upon.

10.3. Applicable response times and appeals

For a request governed by the California Consumer Privacy Act, we confirm receipt of a request to know, delete or correct within 10 business days and respond substantively within 45 calendar days. Where legally necessary and permitted, we may extend the substantive period by a further 45 calendar days, informing you of the extension and its reason during the initial period.

A covered request to opt out of sale or sharing, or to limit a covered use of sensitive personal information, is implemented as soon as feasibly possible and no later than 15 business days, where those California rules apply. The longer response period for access requests is not applied to those opt-outs.

Other state laws can require a different or shorter period, distinct verification rules or an appeal. Those requirements prevail for a request governed by them. Where you have a statutory right to appeal a refusal, reply to the decision or contact [email protected] stating that you wish to appeal. We explain the outcome and any available route to the relevant regulator within the applicable statutory period, using an extension only where that law permits it.

11. Automated processing, younger people and security

11.1. Automated operations

The Service uses automated operations to authenticate access, apply entitlements, count usage, operate security controls and calculate sporting statistics. These operations can affect whether a request is accepted or an account requires review. A player-linked statistic does not by itself establish that we make a legally significant decision about that player.

Where the applicable law gives a right to human intervention, an explanation, an objection or a challenge concerning a qualifying automated decision, you may exercise it through [email protected]. Neither acceptance of the Terms nor purchase of data removes those protections.

11.2. Children and younger athletes

Self-service accounts and purchases are intended for adults aged 18 or over with the necessary legal capacity. Contact us if you believe a child has supplied account information inappropriately so that we can assess and address it.

That account rule does not mean sporting records contain information only about adults. A younger athlete can appear in a competition record or historical profile. Processing such information requires consideration of the person's age, interests and applicable additional protections; a general account age restriction does not substitute for those obligations.

11.3. Security and incidents

We apply organizational and technical safeguards appropriate to the information and risks involved. No internet service, device or transmission method can be guaranteed completely secure. Keep your credentials confidential and tell us promptly about suspected misuse without sending unnecessary secrets.

Where an incident requires notification to an individual or authority, we act within the applicable legal requirements and time limits. A contractual limit on service liability does not remove those obligations or an individual's protected privacy rights.

12. Updates and related information

We may update this Policy to reflect changes to the Service, relevant practices or legal requirements. The date above identifies this version. Where a material change requires direct notice, new consent or another legal step, updating this page or continued use of the Service does not replace it. New processing must have a valid legal basis before it begins.

The Terms of Service address access, purchases and licensing; the Cookie Policy addresses device technologies. Pricing, coverage and documentation describe the relevant product and do not override this Policy's information about personal data.

For all privacy requests and complaints: [email protected].