Privacy Policy for Users

The confidentiality and privacy of our users are essential to us.

1. Glossary

Netatoo: refers to the company Netatoo S.A.S., SIRET 48782045800031; also referred to as "we", "us", "our".
Application: refers to the BalleJaune and OpenResa online booking platform, accessible from ballejaune.com and openresa.com.
Club(s): refers to an entity represented by one or more administrators.
User(s): refers to the persons who have an account in a club's database.
Administrator(s): refers to the club managers who have access to the Administration section of the application.

2. Introduction

Netatoo SAS (SIRET 48782045800031) provides an online booking platform (ballejaune.com and openresa.com), also referred to as "we", "us" and "our" in this document.

We place great importance on the trust you show us by choosing our solution for your online bookings. We therefore diligently protect the privacy and confidentiality of your personal data.

This privacy policy applies to all our services, whether accessed online or through any other platform or device (hereinafter collectively referred to as "the application").

This document concerns the processing of data relating to the users of clubs registered on our application. A club user is also referred to as "you" and "your" throughout this document.

By accepting this privacy policy, you consent to the processing of your personal data by Netatoo for the purposes specified below.

3. Processing of personal data

Netatoo processes your personal data for the following purposes:

Creating your user account in the club in which you are registered.
Verifying your identity using authentication mechanisms.
Sharing your personal data with the administrators and users of the clubs with which you are associated (i.e. the clubs that include you in their list of users).
Managing your bookings in the club where you make bookings.
Informing club administrators about your booking interactions (creation of a booking, cancellation of a booking, modification of a booking).
Recording audit information about your booking interactions (for audit purposes by the club).
Handling your enquiries and providing technical support by e-mail or telephone.
Contacting you about relevant matters associated with your personal user account or your club account.
Monitoring unauthorised use or abuse of our services, or detecting, investigating or preventing activities that may violate our policies or be fraudulent/illegal.
Preventing fraudulent, illegal or malicious activities targeting the application and Netatoo's servers.
Processing payments you may make in clubs (purchase of booking tickets, payment of a membership fee, etc.).
Analysing trends, administering or optimising our offerings, and monitoring usage or traffic patterns.

4. Personal data collected

Netatoo collects the following personal data:

First name and last name (mandatory)
Title (mandatory)
Login username (mandatory)
Password, hashed using industry-standard hashing algorithms (BCRYPT).
E-mail address (optional)
Full postal address and, in the case of online payment, a delivery address and/or a billing address (optional)
Telephone number(s) (optional, depending on the context)
Date of birth (optional)
Federation licence number (optional)
Ranking / playing level (optional)
Date of medical certificate (optional)
Find a Partner listing (optional)
Supporting document / proof of address (optional)
Medical certificate (optional)
File to upload at the club's request (optional)
Technical information about the device and web browser used (collected solely for the purpose of providing efficient customer support, preventing malicious attacks on our services and providing anonymous statistics to club managers and to Netatoo).
IP address (this information is kept for 6 months and then destroyed).

If the club requires it, Netatoo also provides interfaces that control the collection of credit card information (including billing address information). The collection of this payment information is, however, hosted directly by the relevant payment gateway, and Netatoo never sees or stores this data. Netatoo therefore never processes raw credit card or payment information - it is handled exclusively by the payment gateway account of the club with which you have entered into a booking agreement.

We undertake that no data will be exchanged or sold, in any form whatsoever, to third parties.

5. Club control over data

Club administrators are able to add new user accounts to their database; these users can then log in to the application from the club's dedicated page in order to make bookings.

A club administrator who manually adds or modifies the details of another natural person in the application, for example by manually adding that person as a club member, must have obtained unambiguous consent to this privacy policy from the person concerned in order to do so. This consent must be able to be presented upon request to Netatoo and to any competent supervisory authority.

6. Rectification, modification and deletion of your data

6.1. Rectification of data

You can view and modify the personal data you store with us in the "My account > Account details" section of your account.

For security reasons, the last name and first name entered on your account cannot be rectified directly by the user. Should you wish to correct this information, you must contact the club and, if the club does not respond to your rectification request within 7 days, we invite you to contact us at support@openresa.com. Our team will then contact the club and we will take appropriate action based on the club's response.

6.2. Partial deletion

Certain personal information can be erased without completely deleting your account, such as your postal address, your e-mail address or your telephone numbers. Please note, however, that depending on the configuration of the club's account, this information may be required in order to confirm a booking.

6.3. Complete account deletion

Netatoo stores your data as an intermediary between you and the club. Each club is responsible for its own database and, consequently, if for any reason you wish to delete your account entirely, you may do so by contacting the club in which you hold this account. The club administrators, after ensuring that this is permitted from a legal and compliance standpoint, will then be able to permanently delete your account and all its associated data. To contact the club, go to its login page and click on the "Contact" menu.

If the club does not respond to your account deletion request within 7 days, we invite you to contact us at support@ballejaune.com. Our team will contact the club and we will take appropriate action based on the response provided.

You accept the possibility that all or part of your account information may not be deleted if Netatoo or the club demonstrates that it is legally necessary to retain it (e.g. for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller).

You accept that your account information will continue to exist in our backup files for a maximum period of 90 days after your account has been erased.

Please note that certain data, such as your bookings, will not be deleted from the club's database; this data will be "anonymised" so that it is no longer possible to link you to the bookings. This may be useful to the club so as not to alter its statistical data.

7. Data processors

From time to time, we may use third-party service providers as data processors for the purposes specified above. Processing by these third parties takes place according to our instructions. These parties are bound by data processing agreements and confidentiality agreements.

You can consult the exhaustive list of third-party entities we engage to provide services on our behalf by visiting the "Our subcontractors and third-party providers" page.

8. Security

In accordance with data protection laws, strict security procedures are observed within Netatoo in order to prevent the misuse of personal data and unauthorised access.

In order to protect and safeguard the personal data and club data provided to us, we have implemented and use appropriate professional systems and procedures. In addition, we have implemented and use security procedures as well as technical and physical restrictions for accessing and using the club's personal information. Only authorised employees may access personal information in the course of their duties in connection with our services.

For more details on the measures in place to secure and protect your data, please refer to the data security section.

9. Personal data breaches

If we become aware that a personal data breach has occurred, we will notify the persons concerned and the competent supervisory authorities no later than 72 hours after becoming aware of it.

10. Cookies and other trackers

When you use the application, cookies (small files saved by your browser) and similar technologies are used. Some are necessary for the service to function; the others are only used with your consent.

10.1. Necessary cookies (always active)

These do not require your consent, as they are essential to the service you are using:

Login and account security: keeping you logged in, device recognition, protection against fraudulent requests, server session.
Protection against bots and attacks: Cloudflare, including the anti-bot verification on login, sign-up and contact forms.
Preferences: language, clubs already visited, display of lists and tabs, a club's kiosk mode.
Ongoing processes: online registration, reminders already displayed (app installation, notifications, what's new).
Remembering your cookie choices: "bjconsent" cookie, kept for 6 months.
Payment: when you pay online, you are redirected to the payment provider chosen by the club (Stripe, PayPal, SumUp, HelloAsso, Verifone, PayFiP), which may use its own cookies to secure the transaction.

10.2. Cookies subject to your consent

Two purposes, disabled until you have accepted them:

Audience measurement. Google Analytics compiles traffic statistics for the application on behalf of Netatoo and, on the pages of a club that has enabled it, on behalf of that club. Your consent applies to all clubs on the site. Google Ireland Limited then acts as a separate data controller; data may be transferred to the United States under the EU–US Data Privacy Framework (Google privacy policy). The "_ga" cookies are kept for a maximum of 13 months and deleted as soon as you withdraw your consent.

Third-party content and social networks. Your consent covers the exhaustive list of the following services, embedded by clubs in their pages: Google Maps, YouTube, Vimeo, Dailymotion, Facebook, X, Google Calendar, Google Docs and Forms, Microsoft Forms and OneDrive, Jotform. These services use their own cookies and may track your browsing in accordance with their policies: Google, Meta, X, Vimeo, Dailymotion, Microsoft, Jotform. Without your consent, each piece of content is replaced by a placeholder indicating the service concerned; the "Show" button constitutes consent for this purpose. Content provided by a service not on this list always remains hidden: its "Show" button displays it only once, without saving anything.

10.3. Your choice and its duration

On your first visit, a "Cookies" card appears on the page, without blocking it, with three buttons: "Accept", "Reject" and "Customise". "Customise" opens the "Manage cookies" window, where you choose purpose by purpose and then save your choice. Rejecting is as easy as accepting. The card has no close button: it remains displayed until you have made a choice. If you display third-party content without having yet responded regarding audience measurement, the card remains displayed until you respond. Your choice is kept for 6 months from your last choice on the browser used (it is specific to each device and each browser), after which you will be asked again. You will also be asked again if a purpose or service is added to this list.

10.4. Changing or withdrawing your consent

You can change your choice at any time via the "Manage cookies" link at the bottom of the pages, from My account > Privacy, or here: Manage cookies. Withdrawal takes effect immediately: audience measurement cookies are deleted and no third-party content is loaded any longer.

Please refer to the "Data processors" section of this document for more information about our subcontractors and third-party providers.

11. Credit card information

Raw credit card information never comes into contact with the servers on which our application is hosted. All credit card information is handled by online payment gateways such as PayPal or Paybox, via a connection secured by the TLS protocol. Netatoo and the clubs are not able to access unmasked credit card data.

12. Competent authorities

We may share and disclose details and information about you to a government or investigating authority if required by law (or any regulation having the force of law), legal proceedings, a criminal investigation, a court order or a subpoena. We may also disclose your personal data if this is strictly necessary for the prevention and detection of crime.

13. Changes to this statement

Our application is constantly evolving and, as such, we may change the way in which we collect, transmit and process personal data and any other information we deem necessary. This statement may therefore be amended from time to time to reflect the latest changes.

Contact us

Postal address:
Netatoo SAS - BP 43606 - 54016 NANCY CEDEX FRANCE

E-mail:
support@openresa.com

Updated on Tuesday, 27 October 2026