Privacy Notice

Privacy Policy

Notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of Italian Legislative Decree 196/2003 as amended by Italian Legislative Decree 101/2018.

Last updated · 9 October 2026 Controller · Morpheos S.r.l. Court of Catania

Informal translation. This English version is provided for information only. In the event of any discrepancy, the Italian version prevails and is the sole legally binding text. Read the Italian version.

01Data controller

The Data Controller is Morpheos S.r.l., with registered office at Via Madonna delle Lacrime 12/B — 95037 San Giovanni La Punta (CT), Italy, operating in the sports sector under the HiPadel brand through its HiSport Lab division.

To exercise the rights provided for by the GDPR, or for any request concerning the processing of data, you may write to privacy@hipadel.tv or to the PEC certified email address indicated in the Companies Register.

Morpheos S.r.l. has not appointed a Data Protection Officer (DPO), as the mandatory conditions set out in Article 37 GDPR do not apply. Should such an appointment be made, the relevant contact details will be published on this page.

02Categories of data processed

Depending on how you interact with HiPadel, the Data Controller may process the following categories of data:

Contact and identification data — first name, last name, company name, email address, telephone number, name of the club, provided by filling in the forms on the site or by requesting a demo or the free trial.
Account data — login credentials for the platform and the apps, role (club manager, staff, player), preferences and settings.
Images and video footage — match recordings, highlights clips and live streams produced by the systems installed at the clubs or by the mobile devices used through the Virtual Box function.
Service usage data — recordings made, credits consumed, access logs, technical events generated by the HiBox and by the platform.
Browsing data — IP address, browser and device type, pages visited, time of access, collected automatically by the IT systems of the site.
Payment data — card and payment instrument data are processed directly by the payment service providers. The Data Controller does not store full card numbers.

03Purposes and legal bases

Each processing activity has a specific and explicit purpose and a legal basis among those provided for by Art. 6 GDPR:

Purpose	Legal basis	Retention
Responding to requests for information, demos or quotations	Pre-contractual measures at the data subject's request — Art. 6.1.b	24 months from the last contact
Activation and management of the free trial	Performance of the contract — Art. 6.1.b	Duration of the trial + 12 months
Provision of the service, account management and invoicing	Performance of the contract — Art. 6.1.b	Duration of the relationship + 10 years for tax obligations
Production, storage and distribution of footage and clips	Consent of the data subject filmed — Art. 6.1.a (see Image Release)	According to the active plan, in any case not beyond withdrawal of consent
Video surveillance of the facilities	Legitimate interest of the club operating the facility — Art. 6.1.f	Maximum 7 days, unless otherwise prescribed by the authorities
IT security, abuse prevention and diagnostics	Legitimate interest — Art. 6.1.f	12 months
Accounting, tax and statutory obligations	Legal obligation — Art. 6.1.c	10 years
Sending commercial communications and newsletters	Consent — Art. 6.1.a, withdrawable at any time	Until consent is withdrawn
Statistical measurement of site usage through Google Analytics 4	Consent — Art. 6.1.a GDPR and Art. 122 of Italian Legislative Decree 196/2003, revocable at any time	14 months
Measurement of advertising campaigns and creation of audience segments through Meta Pixel	Consent — Art. 6.1.a GDPR and Art. 122 of Italian Legislative Decree 196/2003, revocable at any time	Up to 13 months

04Video footage: roles and responsibilities

When a club installs HiPadel or activates the Virtual Box, the relationship between the parties is as follows:

The club is the independent Data Controller for the processing of the images filmed on its own courts. It is for the club to inform players and guests, collect the image releases, display the required privacy notice and signage, and verify the lawfulness of filming on its own premises.
Morpheos S.r.l. acts as Data Processor pursuant to Art. 28 GDPR, limited to the technical operations of capturing, processing, storing and distributing the images, in accordance with the documented instructions of the club, formalised in a specific appointment deed.
The player is the data subject. They retain at all times the rights provided for by the GDPR and, in particular, the right to withdraw consent to the publication and dissemination of their own image.

The specific conditions governing filming and the use of a person's image are set out in the Image release page, which forms an integral part of this policy.

05Recipients and data processors

Data may be disclosed, to the extent strictly necessary, to:

providers of hosting, cloud computing and video content distribution services, appointed as Data Processors pursuant to Art. 28 GDPR;
payment service providers and banking institutions, for the management of collections and payments;
professionals and companies providing accounting, tax and legal advisory services;
third-party platforms to which the user voluntarily chooses to share content (for example YouTube or Facebook), to which their respective privacy notices apply;
providers of measurement and advertising tools activated only subject to consent
public authorities, in the cases provided for by law.

The up-to-date list of Data Processors is available on request by writing to privacy@hipadel.tv. The data is not subject to indiscriminate dissemination or transfer to third parties for marketing purposes, with the exception of the measurement and advertising tools indicated above, which operate solely subject to the user's consent and can be disabled at any time from the cookie preferences panel.

06Transfers outside the European Union

Data is processed as a rule on infrastructure located within the European Economic Area. Should a supplier entail a transfer to a third country, the transfer takes place solely where there is an adequacy decision of the European Commission or on the basis of the Standard Contractual Clauses adopted pursuant to Art. 46 GDPR, supplemented by the necessary additional measures.

In particular, should the user give consent to the measurement and advertising tools, Google Ireland Limited and Meta Platforms Ireland Limited may transfer data to the United States of America. The transfer takes place on the basis of the European Commission adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework, to which both providers are certified. Without consent, no data is transmitted to those providers.

07Nature of data provision

The provision of contact data is necessary in order to respond to requests and to perform the contract: refusal makes it impossible to provide the service. The provision of data for marketing purposes is optional and refusal does not in any way affect the delivery of the service.

The Data Controller does not carry out solely automated decision-making processes producing legal effects on the data subject pursuant to Art. 22 GDPR. The selection of clips through the GiveMe5 sensor is triggered by a voluntary gesture of the player and does not involve profiling.

08Data subject rights

At any time you may exercise the rights provided for by Arts. 15-22 GDPR:

Access — to obtain confirmation of the existence of processing and a copy of the data;
Rectification — to correct inaccurate data or complete incomplete data;
Erasure — to obtain the removal of the data, including recordings portraying the data subject;
Restriction — to request the suspension of processing where the conditions laid down by law are met;
Portability — to receive the data in a structured, commonly used format;
Objection — to object to processing based on legitimate interest;
Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests are to be sent to privacy@hipadel.tv and receive a reply within one month, extendable by two months in cases of particular complexity.

It is also always possible to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome — garante@gpdp.it) or to bring an action before the courts.

09Security and amendments

The Data Controller adopts appropriate technical and organisational measures pursuant to Art. 32 GDPR, including encryption of data in transit, role-based access control, segregation of environments, access logging and backup procedures.

This privacy notice may be updated for regulatory adjustments or for changes to the service. The version in force is always published on this page. Last updated: 9 October 2026.