Privacy policy

Last updated August 23, 2026

Last updated: 23 August 2026

This Privacy Policy explains how PongSwap collects, uses, retains and protects the personal data of its Users and Visitors.

This Policy applies to the pongswap.com website, to the PongSwap mobile applications and to the remaining digital services made available under the PongSwap brand.

It should be read alongside the PongSwap Terms and Conditions and the PongSwap Cookie Policy.

1. Controller

The controller of the processing of personal data is:

KOI SYSTEMS, Unipessoal Lda. NIF: 515 385 425 Rua Bernardo Santareno, n.º 316, R/C 2870-024 Montijo Portugal

Website: pongswap.com Email: help@pongswap.com

For any question relating to privacy, data protection or the exercise of your rights, you may contact us at help@pongswap.com.

2. PongSwap

PongSwap is a classified listings platform specialising in table tennis equipment.

It allows private Users to publish listings, search for equipment and contact directly other Users interested in buying, selling or trading items.

PongSwap neither receives nor processes payments relating to the items advertised and does not intervene in the conclusion of transactions between Users.

3. Who may use PongSwap

PongSwap is intended exclusively for persons aged 18 or over.

We do not ask for the date of birth during registration.

By creating an Account, the User declares that he or she is at least 18 years old and has capacity to accept the PongSwap Terms and Conditions.

Should we become aware that an Account belongs to a person under 18 years of age, we may suspend or delete that Account and take appropriate measures in relation to the respective personal data.

4. Personal data we collect

The data collected depends on how the User interacts with PongSwap.

We may process, in particular:

4.1. Account data

• email address;
• password, stored by means of appropriate cryptographic mechanisms;
• telephone number;
• name or username;
• profile photograph;
• internal Account identifier;
• date of creation and status of the Account.

4.2. Location data

We collect only the location information necessary for the use of the marketplace, namely:

• city;
• municipality.

PongSwap does not require the public disclosure of a full home address.

4.3. Data relating to Listings

We may process:

• title;
• description;
• category;
• make;
• model;
• price;
• condition of the item;
• photographs;
• city and municipality;
• technical characteristics;
• date of publication;
• status of the listing;
• information about sale or trade;
• views and interactions relating to the listing.

4.4. Usage data

We may collect automatically:

• IP address;
• date and time of access;
• browser type;
• operating system;
• device type;
• technical identifiers;
• language;
• pages and functionalities used;
• technical events;
• errors;
• performance information.

4.5. Communications

When you use the PongSwap messaging system, we process:

• content of the messages;
• sender and recipient;
• date and time;
• attachments, where permitted;
• information necessary for the prevention of fraud and abuse.

4.6. Other interactions

We may also process information relating to:

• favourites;
• saved searches;
• reviews;
• reports;
• contacts with customer support;
• notifications;
• Account preferences.

5. Registration and validation of the Account

In order to create an Account on PongSwap, the User must provide:

• email address;
• password;
• telephone number.

The telephone number is used to validate the Account and to strengthen the security of the Platform.

Validation may be carried out by sending a code by SMS.

PongSwap uses Twilio as its technology provider for sending these validation messages.

The telephone number is not displayed publicly on the profile or in the Listings.

PongSwap does not currently offer authentication through Google, Apple, Facebook or other social login systems.

6. Profile photographs

The User may add a photograph to his or her profile.

The photograph may be shown to other Users together with the name or username, Listings and reviews.

The User must only use photographs that he or she is authorised to publish.

The profile photograph must not contain personal data of third parties without authorisation.

7. Purposes of the processing

We process personal data for the following purposes:

• to create and manage Accounts;
• to authenticate Users;
• to validate Accounts by means of the telephone number;
• to allow the publication and management of Listings;
• to allow searches and filters;
• to allow communication between Users;
• to make favourites available;
• to make saved searches available;
• to send notifications;
• to make reviews available;
• to provide support to Users;
• to prevent fraud;
• to protect the security of the Platform;
• to moderate content;
• to investigate reports;
• to prevent abusive use;
• to ensure the technical operation of the Service;
• to analyse and resolve errors;
• to improve PongSwap;
• to comply with legal obligations;
• to exercise or defend the rights of KOI Systems or of Users.

8. Legal bases for the processing

The processing of personal data is carried out on the legal bases applicable to each situation.

8.1. Performance of the contract

We process the data necessary to make PongSwap available to the User, including:

• creation and operation of the Account;
• publication of Listings;
• use of messaging;
• favourites;
• searches;
• notifications;
• reviews.

8.2. Legitimate interests

We may process certain data on the basis of the legitimate interests of KOI Systems or of Users, in particular for:

• the prevention and detection of fraud;
• security;
• the prevention of abuse;
• the protection of Accounts;
• the improvement of the Service;
• the resolution of technical problems;
• the defence of rights.

Before relying on this basis, we seek to ensure that our interests do not unjustifiably override the rights and freedoms of the data subjects.

8.3. Consent

The processing will be based on consent wherever this is legally required.

As at the date of this Policy, PongSwap carries out no processing based on consent: the cookies we use are exclusively those strictly necessary for the operation of the Service, for which the law does not require prior consent. See the Cookie Policy.

Should processing that depends on consent come to exist, it will be requested beforehand, freely given, specific and informed, and may be withdrawn at any time.

8.4. Legal obligations

Certain data may be processed or retained where necessary to comply with a legal obligation applicable to KOI Systems.

9. Publication of Listings and public data

PongSwap is, by its nature, a classified listings service.

Certain data associated with the Listings is therefore displayed publicly.

This may include:

• name or username;
• profile photograph;
• city and municipality;
• photographs of the item;
• description;
• price;
• condition of the item;
• reviews;
• information relating to the Listing.

The User should not include in the public fields personal information that is not necessary in order to advertise the item.

In particular, we recommend that you do not publish:

• your full address;
• identification documents;
• bank details;
• card numbers;
• passwords;
• confidential information.

10. Messages between Users

PongSwap makes available, or may make available, an internal messaging system.

Messages are processed in order to allow communication between potential buyers, sellers and users interested in trades.

Messages may also be processed where necessary to:

• prevent fraud;
• identify spam or phishing;
• investigate reports;
• respond to complaints;
• protect Users;
• ensure compliance with the Terms and Conditions;
• comply with legal obligations.

PongSwap may use automated or semi-automated mechanisms to identify patterns potentially associated with fraud, spam, phishing or abusive use.

Conversations should not, therefore, be regarded as private vis-à-vis the operator of the Platform in the sense of being technically inaccessible to KOI Systems.

Access to the content will be limited to situations in which there is a legitimate and legally valid purpose.

11. Retention of messages

Messages are retained, as a rule, for 12 months after the last activity in the conversation or after the deletion of the Account, whichever applies.

Certain messages or associated information may be retained for a longer period where this is necessary to:

• investigate fraud;
• respond to a report;
• resolve a dispute;
• comply with a legal obligation;
• exercise or defend rights.

Once the applicable period has ended, the data will be deleted or anonymised, unless there is a legal basis for its retention.

12. Listings sold, traded or deleted

When a Listing ceases to be active, its content may continue to be retained internally.

Listings that have been sold, traded or deleted will be retained for 24 months after they are closed.

This retention is intended, in particular, to:

• prevent fraud;
• allow the investigation of reports;
• maintain a relevant history of the Account;
• resolve conflicts;
• combat abusive re-publication;
• protect Users and the Platform.

After that period, the data will be deleted or anonymised, unless there is a legal basis for additional retention.

13. Security logs

Certain logs and technical records relating to security may be retained for 12 months.

These may include:

• IP address;
• authentication attempts;
• relevant Account activity;
• information about devices;
• security events;
• detection of anomalous behaviour.

In the event of an incident, fraud, investigation or dispute, the relevant data may be retained for the additional period strictly necessary.

14. Location

PongSwap collects only city and municipality for marketplace-related purposes.

This information may be used to:

• indicate the approximate location of an Item;
• allow searches by location;
• display geographically relevant equipment;
• facilitate contact between Users.

We do not collect precise GPS location for these purposes by default.

15. Favourites and saved searches

PongSwap may allow the User to:

• save Listings;
• save searches;
• follow categories;
• keep track of particular equipment.

In order to make these functionalities available, we may process information relating to the interests expressed by the User on the Platform.

This information may also be used to display more relevant content within PongSwap.

16. Push notifications

The PongSwap applications may send push notifications.

These may include:

• new messages;
• activity relating to a Listing;
• relevant changes;
• new Listings matching saved searches;
• Account or security alerts.

The sending of notifications depends on the permissions granted by the User on his or her device.

The User may disable these notifications through the device settings or the options made available in the application.

17. Emails

PongSwap sends service communications only.

These may include:

• Account confirmation;
• account recovery;
• notifications relating to the Account;
• messages or relevant activity;
• changes to Listings;
• security warnings;
• moderation decisions;
• important changes to the Terms and Conditions or Privacy Policy.

PongSwap does not currently use Users' data to send newsletters or email marketing.

For sending transactional emails we use the SparkPost infrastructure.

18. SMS

The telephone number is used mainly for validation and security of the Account.

PongSwap uses Twilio for the provision of the technology service for sending SMS.

The telephone number will not be used for SMS marketing.

19. Analytics and improvement of the Service

We may analyse the use of PongSwap in order to:

• measure performance;
• identify errors;
• understand how the functionalities are used;
• improve the experience;
• improve searches and navigation;
• develop new functionalities.

This analysis is carried out from data we already process for the operation of the Service and from technical server logs. PongSwap uses no third-party statistical analysis tools, no analytics cookies, and no mechanism that follows the User across websites.

Should cookies or similar technologies requiring consent come to be used, those mechanisms will only be activated once that consent has been obtained, and the Cookie Policy will be updated accordingly.

20. Recommendations and personalisation

PongSwap may use information relating to the use of the Platform in order to display more relevant Listings or content.

Elements such as the following may be taken into account:

• search terms;
• categories consulted;
• filters used;
• favourites;
• location indicated;
• Listings previously consulted.

These mechanisms are intended to improve the user experience.

We do not intend to use this data for decisions based solely on automated processing which produce legal effects or similarly significant effects in relation to the User.

21. Payments

PongSwap does not process payments between buyers and sellers.

In the current version of the Service, KOI Systems does not charge for Paid Services through PongSwap either.

Consequently, PongSwap does not currently need to collect:

• card numbers;
• bank accounts;
• payment method details for the purchase of Items.

Buyers and sellers agree directly between themselves any conditions and means of payment.

Should Paid Services provided directly by KOI Systems be introduced in the future, this Policy will be updated as necessary.

22. Infrastructure and hosting

For the technical operation of PongSwap we use infrastructure services made available, in particular, by:

• Amazon Web Services — AWS;
• DigitalOcean;
• Cloudflare.

These providers may technically process certain data necessary for the hosting, storage, processing, security, backups and operation of the Platform.

23. Service providers

In order to make PongSwap available we may use specialised providers.

These currently include, in particular:

• Amazon Web Services (AWS) — infrastructure and technology services;
• DigitalOcean — infrastructure and hosting;
• Cloudflare — content delivery network, security and protection against automated use (Turnstile);
• SparkPost — sending of transactional emails;
• Twilio — sending of SMS for validation and security of the Account;
• Rollbar — logging and diagnosis of technical errors.

These providers must process only the data necessary for the provision of their respective services and are subject to the applicable contractual and legal obligations.

The list of providers may be updated as the PongSwap infrastructure evolves.

24. Sharing of the data

KOI Systems does not sell Users' personal data.

Data may be disclosed to third parties only where necessary, in particular to:

• technology providers;
• hosting providers;
• email providers;
• SMS providers;
• security providers;
• professional advisers;
• judicial, police or administrative authorities where legally required.

The information shared will be limited to what is necessary for the relevant purpose.

25. Data visible to other Users

The use of a marketplace presupposes that some information is visible to third parties.

Depending on the functionalities, other Users may see:

• name or username;
• profile photograph;
• city and municipality;
• Listings;
• photographs of Items;
• reviews;
• public information relating to the activity of the Account.

The following are not displayed publicly by default:

• email address;
• password;
• telephone number;
• IP address;
• technical logs.

26. International transfers of data

Some of the technology providers used by PongSwap may process personal data outside Portugal or the European Economic Area.

Whenever international transfers take place, we will seek to ensure the use of legally recognised mechanisms, such as:

• adequacy decisions of the European Commission;
• standard contractual clauses approved by the European Commission;
• other safeguards provided for by the applicable legislation.

Where necessary, supplementary protection measures may be adopted.

27. Retention of the Account

The data necessary for the operation of the Account is retained for as long as the Account is active.

After the deletion of the Account, the data will be deleted or anonymised once it is no longer necessary, without prejudice to the specific periods provided for in this Policy.

Some information may continue to be retained where necessary to:

• prevent fraud;
• investigate abuse;
• resolve disputes;
• comply with legal obligations;
• exercise or defend rights.

28. Security of the data

KOI Systems implements technical and organisational measures intended to protect personal data against:

• unauthorised access;
• alteration;
• disclosure;
• loss;
• destruction;
• misuse.

These measures may include:

• encryption of communications;
• secure hashing of passwords;
• access control;
• authentication;
• validation of the Account;
• logs;
• backups;
• monitoring;
• abuse detection mechanisms.

Despite these measures, no system available over the Internet can guarantee absolute security.

29. Rights of data subjects

Under the General Data Protection Regulation (GDPR) and the remaining applicable legislation, the data subject may, where applicable, exercise the following rights:

Access: to find out whether we process your data and to obtain access to it.

Rectification: to correct inaccurate data or complete incomplete information.

Erasure: to request the deletion of the data where the legal requirements are met.

Restriction: to request the restriction of the processing in certain circumstances.

Objection: to object to certain processing carried out on the basis of legitimate interests.

Portability: to receive certain data in a structured, commonly used and machine-readable format, where applicable.

Withdrawal of consent: to withdraw at any time a consent previously given.

Rights relating to automated decisions: to exercise the legally applicable rights should there come to be decisions based solely on automated processing with legal or similarly significant effects.

30. How to exercise your rights

Requests relating to data protection may be sent to:

help@pongswap.com

or by post to:

KOI SYSTEMS, Unipessoal Lda. Rua Bernardo Santareno, n.º 316, R/C 2870-024 Montijo Portugal

We may request additional information strictly necessary in order to confirm the identity of the person making the request.

This measure is intended to prevent third parties from improperly obtaining, altering or deleting another User's data.

31. Deletion of the Account

The User may request the deletion of his or her Account through the functionalities made available or by contacting help@pongswap.com.

The deletion of the Account may result in:

• deactivation of the profile;
• removal of the public Listings;
• cessation of certain notifications;
• loss of access to the Account history.

The deletion of the Account does not necessarily entail the immediate deletion of all existing data.

Some information may continue to be retained for the periods provided for in this Policy, in particular:

• closed Listings: up to 24 months;
• messages: as a rule, up to 12 months;
• security logs: up to 12 months;

as well as for additional periods where legally necessary.

32. Data of minors

PongSwap is intended exclusively for persons aged 18 or over.

We do not intentionally collect personal data of minors for the creation of Accounts.

Should an Account belonging to a person aged under 18 be identified, PongSwap may suspend or delete the Account and proceed with the deletion of the respective data, save where retention is legally necessary.

33. Cookies and similar technologies

PongSwap may use cookies and similar technologies for:

• authentication;
• security;
• operation of the Account;
• retention of preferences.

As at the date of this Policy, PongSwap uses exclusively cookies that are strictly necessary for the operation of the Service, for which the law does not require prior consent. We use no advertising cookies, no tracking cookies, no social network cookies and no statistical analysis cookies.

Should cookies requiring consent come to be used, that consent will be requested beforehand and may be withdrawn at any time.

The complete list of cookies, with retention periods and purposes, is in the PongSwap Cookie Policy.

34. Links and external services

PongSwap may contain links to external websites or services.

KOI Systems does not control the privacy practices of those third parties.

When the User leaves PongSwap and uses another service, he or she should consult the Privacy Policy of the respective provider.

35. Legal obligations and authorities

We may retain or disclose data where this is necessary to:

• comply with the applicable legislation;
• respond to a court decision;
• respond to a competent authority;
• investigate fraud or unlawful activity;
• protect the rights of KOI Systems;
• protect Users or third parties;
• exercise or defend rights in legal proceedings.

Requests for access to data submitted by authorities will be assessed in accordance with the applicable legislation.

36. Changes to the Privacy Policy

This Policy may be updated as a result of:

• new functionalities;
• technical changes;
• legal changes;
• new providers;
• changes to the processing carried out.

The most recent version will be available at pongswap.com with the date it was last updated.

Where the changes are materially relevant, we may inform Users through the Platform, by email or by another appropriate means.

37. Complaints

If you consider that your personal data is not being processed correctly, we recommend that you contact us at:

help@pongswap.com

We will endeavour to examine and resolve the situation.

The User also has the right to lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD (the Portuguese data protection authority)

Contacting KOI Systems beforehand is not a requirement for the exercise of this right.

38. Contact

For questions relating to this Policy, the processing of personal data or the exercise of rights:

KOI SYSTEMS, Unipessoal Lda. NIF: 515 385 425 Rua Bernardo Santareno, n.º 316, R/C 2870-024 Montijo Portugal

Email: help@pongswap.com Website: pongswap.com