Privacy Notice

For the purposes of this Notice: (a) “Personal Data” means any information relating to a natural person which enables the identification of such person, whether directly or indirectly, excluding the information of deceased persons; (b) “Processing” means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transfer, combination, restriction, erasure or destruction; (c) “User” means any natural person who signs in to or otherwise uses the Service; (d) “Player Card” means the profile created by a User upon registration; (e) “Match Data” means all information relating to challenges, matches, scores and their outcome; and (f) “Processor” means any person who Processes Personal Data on behalf of, or under the instructions of, the Controller.

The Controller of the Personal Data Processed through the Service is Milica Labs. Any question, request or complaint relating to this Notice or to the Processing of your Personal Data shall be addressed in writing to contact@gamesetladder.com. Requests shall identify the name appearing on the requester's Player Card in order to permit verification of identity.

3.1 Data received from LINE upon authentication: the LINE user identifier, the LINE display name and the address of the LINE profile picture. The Controller does not receive the User's LINE password, contacts, friends list or messages.

3.2 Player Card data: first name or the nickname by which the User is commonly known, last name, gender, city, and, where provided, year of birth and nationality; the rating, ranking or self-assessed level declared upon registration together with the rating system concerned; the playing style, season and League preferences, the selected display style (“Epic” or “Classic”) and the selected avatar.

3.3 Activity data: challenges sent and received, availability periods, preferred courts, matches, scores and the manner in which a match was concluded (including the fact that a match was stopped by reason of rain, time, injury or retirement, without any medical detail), reactions, favourites, votes cast in elections of League administrators and fair play awards, assessments of the level of opponents, reports submitted, and messages addressed to administrators.

3.4 Contact data provided voluntarily: the LINE identifier or link which the User elects to exchange with other Users.

3.5 Referral data: the identity of the User whose invitation link was used, if any, which is not disclosed to other Users.

3.6 Derived data: the rating, level and its history, the reliability of the level, League placement, League Points, standings, eligibility for titles, goal progress and any alternative rankings computed for evaluation purposes.

3.7 Technical data: authentication cookies and session tokens; preferences stored on the User's device (including display size and style); the delivery status of LINE messages; and page performance measurements and error reports, which are recorded without identifying the User and deleted after thirty (30) days.

3.8 Old stats: the record of the User's matches on another tennis application used before the Service (the “Old stats”), namely the number of matches, wins and losses, the number of such matches finished or stopped (and whether the User was then ahead, level or behind on the score), and the dates of the first and last such match, as recorded by the Controller from match results visible within that application; and the dates and scores of matches between two Users there; matches also entered in the Service are counted once only, in the Service. Such data is never used to compute ratings, levels or League Points.

3.9 Sign-in and contact by email: where the User signs in with an email address or adds one to the account, that email address, used to send sign-in codes and, only where the User so elects, emails relating to the User's matches.

3.10 Photo: the photograph which the User elects to upload to the Player Card, displayed in accordance with the User's privacy settings.

3.11 Content shared with other Users: messages exchanged with other Users, comments and predictions relating to matches, and the address of a video of a match (a YouTube link, or a video edited by GameSetReplay) together with the progress of its editing.

3.12 Mobile applications: the version of the application and of the operating system of the device, used to provide support. The position of the device, where the User allows it, is used solely on the device to sort courts by distance; it is neither transmitted to nor recorded by the Controller.

4.1 The Controller Processes Personal Data where such Processing is necessary for the performance of the contract formed by the Terms of Use to which the User is a party (Section 24(3) of the PDPA), namely for the creation and administration of accounts, the operation of the ladder and of matchmaking, the computation of ratings, levels, League Points and standings, the organisation of seasons, Leagues and their final stages, and the sending of LINE messages relating to the User's matches and seasons.

4.2 The Controller Processes Personal Data where necessary for its legitimate interests or those of other Users (Section 24(5) of the PDPA), which are not overridden by the fundamental rights of the data subject, namely: ensuring the integrity of results and fair play, the handling of disputes, the prevention and detection of fraud, abuse and misuse, the security of the Service, the production of statistics, the evaluation of alternative ranking methods, and the improvement of the Service.

4.3 The Controller relies on the User's consent (Section 19 of the PDPA) for the exchange of the User's LINE contact with other Users, and for the display of the User's Old stats (Article 3.8) to other Users. Such consent may be withdrawn at any time through Profile › Settings › Privacy or on the User's card, or by written request, without affecting the lawfulness of Processing carried out prior to its withdrawal.

4.4 The Controller records the User's Old stats and displays them to the User on the basis of the legitimate interests referred to in Article 4.2, namely the production of statistics for the User. The User may delete his or her Old stats at any time through Profile › Account › My data, in which case they are immediately erased from the Service and are not recorded again unless the User so requests.

4.5 The Controller may further Process Personal Data where required to comply with a legal obligation to which it is subject (Section 24(6) of the PDPA).

4.6 The Controller does not sell Personal Data, does not use Personal Data for advertising, and does not disclose Personal Data to third parties for their own marketing purposes.

5.1 The following information is made available to other signed-in Users: first name or nickname, the initial of the last name, nationality, gender, avatar, level and its history, the reliability of the level, League, standings, preferred courts, the results of ranked matches, which are always shown so that every User can see the standings are fair, and upcoming challenges, save where the User has elected, through Profile › Settings › Privacy, to keep them private. The result of a Practice Match entered from 23 October 2026 is also shown, unless either player has made it private, the User has elected to keep practice results private, or the Service shows no practice results; earlier Practice Matches remain visible to the two Users concerned only.

5.2 The User's full last name and year of birth are not disclosed to other Users. Gender is shown on the User's Player Card and, together with an age band derived from the year of birth (and never the year of birth itself), is used to enable search filters in the matchmaking functions; a User applying such a filter may thereby infer the age band of the Users returned.

5.3 The User's profile picture, being the picture provided by LINE or a photo uploaded by the User, is displayed to other Users by default, so that Users may recognise one another before meeting on court, on the basis of the legitimate interests referred to in Article 4.2. The User may switch off such display at any time in Profile › Settings › Privacy, in which case the User's avatar is displayed instead. The User's Old stats (Article 3.8) are displayed to other Users only if the User has elected to show them; the head-to-head record of two Users in their Old stats, and their matches against each other, are displayed only to those two Users, and only where both have elected to show their Old stats.

5.4 The User's LINE contact is disclosed only to the Users whose request the User has accepted, and, where necessary for the settlement of a dispute relating to a match of the User, to the administrator concerned.

5.5 Administrators and League administrators may access Personal Data to the extent necessary for the performance of their functions under the Terms of Use.

5.6 Personal Data is disclosed to Processors acting on behalf of the Controller under contractual obligations of confidentiality and security, namely Supabase, Inc. (database, authentication and server functions), Vercel, Inc. (hosting of the Service) and LY Corporation (LINE authentication and messaging, Processed in accordance with LINE's own terms). Certain informational pages load typefaces from Google Fonts, whereupon Google may receive the User's IP address.

5.7 Personal Data may be disclosed to competent authorities where required by applicable law or by order of a court or authority.

Personal Data is stored on servers located in Sydney, Australia, and may be Processed by the Processors referred to in Article 5.6 in other jurisdictions. Such transfers are carried out in accordance with Sections 28 and 29 of the PDPA, on the basis that they are necessary for the performance of the contract to which the User is a party and, where applicable, subject to the safeguards offered by the Processors concerned.

7.1 Personal Data is retained for as long as the User's account remains active and for such further period as is necessary to fulfil the purposes set out in Article 4.

7.2 Upon deletion of the account through Profile › Settings › My data, or upon a written request for erasure, the Player Card, contact data and other Personal Data of the User are erased or anonymised without undue delay and in any event within thirty (30) days, save where retention is required by law. Match Data may be retained in de-identified form, without the User's name, in order to preserve the accuracy of the ratings of other Users.

7.3 Technical data referred to in Article 3.7 is retained for no longer than thirty (30) days. Back-up copies are overwritten in the ordinary course of operation.

The Controller implements appropriate technical and organisational measures designed to protect Personal Data against loss, unauthorised access, use, alteration or disclosure, including access controls at the level of each record, the restriction of administrative functions to authorised persons and the encryption of data in transit. No method of transmission or storage being entirely secure, the Controller cannot guarantee absolute security. In the event of a Personal Data breach, the Controller shall notify the Office of the Personal Data Protection Committee and, where required, the Users concerned, in accordance with Section 37(4) of the PDPA.

9.1 Subject to the conditions and exceptions provided by the PDPA, every User has the right: (a) to access and obtain a copy of his or her Personal Data, and to request disclosure of the source of Personal Data obtained without consent (Section 30); (b) to receive his or her Personal Data in a structured, commonly used and machine-readable format, and to request its transmission to another controller (Section 31); (c) to object to the Processing of his or her Personal Data (Section 32); (d) to request the erasure, destruction or anonymisation of his or her Personal Data (Section 33); (e) to request the restriction of the use of his or her Personal Data (Section 34); (f) to request the rectification of his or her Personal Data so that it remains accurate, up to date, complete and not misleading (Section 35); (g) to withdraw his or her consent at any time (Section 19); and (h) to lodge a complaint with the Office of the Personal Data Protection Committee (Section 73).

9.2 Requests shall be made in writing to the address set out in Article 2. The Controller may request information reasonably necessary to verify the identity of the requester, shall respond within thirty (30) days of receipt of a complete request, and may refuse a request to the extent permitted by the PDPA, in which case the reasons for refusal shall be communicated.

Where a User has not attained the age of majority under Thai law, the User represents that the consent of the holder of parental responsibility has been obtained where required by Section 20 of the PDPA. The Controller shall, upon becoming aware that such consent has not been obtained where required, suspend or delete the account concerned.

The Service uses only such cookies and local storage as are strictly necessary for authentication, security and the retention of the User's display preferences. The Service does not use advertising cookies or third-party tracking technologies.

The Controller may amend this Notice from time to time. The date of the latest version appears at the top of this page. Material amendments shall be notified to Users through the Service or by LINE message prior to taking effect. Continued use of the Service after the effective date of an amendment shall constitute acknowledgement of the amended Notice.

This Notice is drawn up in the English language. Any translation is provided for convenience only and, in the event of any inconsistency, the English version shall prevail. All communications shall be addressed to contact@gamesetladder.com.