California Privacy Rights (CCPA / CPRA)

This notice supplements the main Pistaclub Privacy Policy and applies only to California residents. It sets out the additional rights and disclosures required by the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq., "CCPA") as amended by the California Privacy Rights Act ("CPRA").

1. Notice at collection

At or before we collect personal information about you, we disclose the categories of information we collect and the purposes of collection. The full disclosures for each category live in the main Privacy Policy §"What data we collect" — this section maps them to the CCPA taxonomy.

CCPA category (§1798.140(v))	Do we collect?	Purpose
Identifiers (name, email, IP, account IDs)	Yes	Account, security, communication
Customer records (§1798.80 personal information)	Yes	Bookings, payments, marketplace listings
Protected classifications (age)	Yes (age gate ≥16)	Regulatory compliance
Commercial information	Yes	Purchase history, subscription status
Biometric information	No	—
Internet or network activity	Yes	Security, analytics (with consent)
Geolocation (precise)	Yes, if you enable it	Nearby events / listings ranking
Sensory data (photos)	Yes — user-uploaded	Event galleries, auto-tagging
Professional / employment	No	—
Education	No	—
Inferences drawn from the above	Limited (event / listing ranking)	Personalisation
Sensitive Personal Information (health / medical fields, precise geolocation)	Yes — with per-event consent for medical	Emergency care at events (organizer)

Retention: we keep each category only as long as needed for the stated purpose — see the retention schedule in the main Privacy Policy §"How long we keep data".

2. We do not sell or share personal information

Pistaclub does not sell personal information, and does not share personal information for cross-context behavioural advertising, as those terms are defined in the CCPA. We do not receive money or other valuable consideration in exchange for personal information, and we do not engage in targeted advertising based on personal information collected from your activity across other businesses' sites or apps.

Even so, California law requires us to publish a mechanism labeled "Do Not Sell or Share My Personal Information." Because we do not sell or share, exercising this right will confirm that your data is not sold or shared and record your preference:

Do Not Sell or Share My Personal Information → (opens the request form; you can also email privacy@pistaclub.app with the same subject line).

We also honor Global Privacy Control (GPC) browser signals as an opt-out under Cal. Civ. Code §1798.135(b).

3. Your California rights

Right to know — you can request a copy of the personal information we hold about you, the categories, the sources, the purposes of processing, and the third parties with whom we share it.
Right to delete — you can request deletion of your personal information (subject to statutory exceptions such as fraud prevention, financial-records retention, legal-compliance recordkeeping).
Right to correct — you can request that inaccurate personal information be corrected.
Right to opt out of sale / sharing — see §2 above.
Right to limit use of Sensitive Personal Information — you can request that we limit our use of your health / medical fields and precise geolocation to the purposes strictly necessary to provide the service. Our per-event medical-consent model (see the main Privacy Policy §"Special-category data") already implements this.
Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised any of your California rights.

4. How to submit a request

Most requests can be handled in-app:

Right to know / delete / correct: use the Data-subject rights panel at Profile → Support. This produces a machine-verified request tied to your logged-in account.
Email: if you cannot use the in-app tools, email privacy@pistaclub.app with the subject line "California CCPA request — [type of request]". Include enough information for us to verify your identity (see §5).

We will confirm receipt within 10 business days and respond substantively within 45 calendar days (extendable by another 45 days with notice, per CCPA §1798.130).

5. Identity verification

To protect your privacy and security, we take reasonable steps to verify your identity before providing personal information. For logged-in requests we rely on your account authentication. For email requests we may ask you to confirm from the email address on file or provide additional information matching our records (e.g. recent booking IDs, payment reference).

6. Authorized agents

You may authorise an agent to submit a request on your behalf. The agent must provide written proof of authorisation signed by you (or a valid power of attorney under California Probate Code §4000 et seq.) and we may separately contact you to verify your identity and the agent's authority.

7. Metrics (Cal. Civ. Code §1798.130(a)(5))

For platforms that collect the personal information of 10 million or more California consumers per calendar year, the CCPA requires annual disclosure of request metrics (number received, complied with, denied, median response time). Pistaclub is well below this threshold; we will publish annual metrics if we cross it, and in any event include summary metrics in our public transparency reports.

8. Contact

Privacy requests: privacy@pistaclub.app
Data Protection Officer: dpo@pistaclub.app

For general questions and to lodge a complaint with the California Attorney General: oag.ca.gov/privacy. You may also contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.