Privacy policy
Last updated: 11 November 2026
At Haslap we take your data seriously. Here we explain, plainly, what data we process when you use the Haslap app or website, why, who we share it with, how long we keep it and how you can exercise your rights.
1. Who is responsible
- Controller: NJOY APP DEPORTE SL
- Tax ID (CIF): B44667665
- Address: Carrer Josep Anselm Clavé, 6, 1º, 07002 Palma (Illes Balears), España
- Privacy contact email: hello.njoyapp@gmail.com
2. What data we process
- Account data: phone number, first and last name, email, password (stored encrypted, never in plain text), date of birth, profile type (runner or run club) and profile photo.
- Runner profile: goal, pace and favourite distance, if you add them.
- Activity on Haslap: events and clubs you join or create, people you follow, answers to an event's sign-up questions, tickets and their check-in at the door, HasPoints, badges and rewards.
- Messages you write in event and club chats.
- Purchases: orders, tickets, amounts, discount codes and billing address. Your card details are handled directly by Stripe; we never see or store them.
- Location: with your permission, your phone's location, or an approximate one from your IP address, to show you events and clubs nearby. We only keep the latest location, which is replaced each time.
- Device and technical data: an identifier to send you notifications, phone model and system, app version, IP address and sign-in security logs.
- App usage: usage statistics (for example, screens visited or events shared) through Google Analytics for Firebase, to improve the app.
- If you are a gym or sports centre and leave your details on the page for gyms: centre name and type, city and contact email.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and keep your account, sign you in and show your profile | Performance of the contract (the terms of use) |
| Sign you up for events, join clubs, create events and use the chat | Performance of the contract |
| Sell tickets, take payment and send you your ticket with the QR | Performance of the contract |
| Keep invoices and purchase records | Legal obligation (tax and commercial law) |
| Show you events nearby using your location | Your consent (location permission), which you can withdraw in your phone settings |
| Send you notifications | Your consent (notification permission), which you can withdraw in your phone settings |
| HasPoints, badges, levels and rewards | Performance of the contract |
| Usage statistics to improve the app | Legitimate interest in improving the service |
| Security and prevention of fraud and abuse | Legitimate interest in protecting users and the service |
| Send the guide to gyms that ask for it and contact them about organising events | Your consent when sending the form |
We do not make automated decisions with legal effects on you, and we do not sell your data.
4. Who can see your data
- Other Haslap users: your name, photo and runner profile are visible to other users, as is your participation in events and clubs.
- Organisers of the events you join: they see your name and your answers to their sign-up questions, and check your ticket at the door.
- People in the chats you write in: they see your messages.
- Service providers that process data only on our instructions: Google (Firebase for sign-in, chat, notifications and statistics; Google Cloud for photos; Google Maps for places), Stripe (payments), Vercel (website hosting) and our server's hosting provider.
- Authorities and courts, when the law requires it.
5. Transfers outside the European Economic Area
Some providers (Google, Stripe and Vercel) may process data in the United States. They do so with the safeguards the law requires: the EU-US Data Privacy Framework and, where applicable, the standard contractual clauses approved by the European Commission.
6. How long we keep your data
| Data | Period |
|---|---|
| Account, profile and activity | While you have an account. When you delete it, it is erased within 30 days |
| Purchases and invoices | 6 years, as required by tax and commercial law |
| Chat messages | While the event or club exists, or until you delete your account |
| Location | Only the latest, while you have an account |
| Security logs | 12 months |
| Details of interested gyms | 2 years from the last contact, or until you ask us to delete them |
7. Your rights
You can ask us to access, correct or erase your data, to object to or restrict its processing, and to take it to another service (portability). You can also withdraw any consent you have given at any time.
- To delete your account: in the app, under Settings > Delete account.
- For anything else: email us at hello.njoyapp@gmail.com saying which right you want to exercise. We will reply within one month at the latest.
- If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
8. Minors
Haslap is meant for people aged 14 and over. If you are under 14, you cannot create an account without the consent of your parents or guardians. If we find an account of someone under 14 without that consent, we will delete it.
9. Security
We apply technical and organisational measures to protect your data: encrypted connections, passwords and sessions stored encrypted, restricted access to data, and providers that comply with data protection law.
10. Website cookies
The Haslap website only uses technical cookies it needs to work: keeping you signed in and remembering your language. We use no advertising or tracking cookies.
11. Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change is significant, we will let you know in the app or by email.