Privacy Policy

Thank you for choosing to be part of our community at Fan League ("Company," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice or our practices with regard to your personal information, please contact us at privacy@fanleague.co.

This privacy notice applies to the Fan League platform (the "Platform"), which includes all of our websites and all of our apps, including Fan League Sports and Fan League Music.

This privacy notice describes how we might use your information if you:

• Visit any of our websites, including fanleague.co
• Download and use any of our apps, including Fan League Sports and Fan League Music

Engage with us in other related ways ― including any sales, marketing, or events In this privacy notice, if we refer to:"Website," we are referring to any website of ours that references or links to this policy"App," we are referring to any application of ours that references or links to this policy, including any listed above"Services," we are referring to our Website, App, and other related services, including any sales, marketing, or events The purpose of this privacy notice is to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it. If there are any terms in this privacy notice that you do not agree with, please discontinue use of our Services immediately.

Please read this privacy notice carefully, as it will help you understand what we do with the information that we collect.

Personal information you provide to us

In Short: We collect the information you give us when you create an account and use the App.

• Account and profile. Your name, preferred name, email address, mobile number, date of birth and profile photo. Your date of birth is used to confirm you meet the minimum age set out in our Terms of Service.
• Sign-in. If you sign in with Google or Apple, that provider returns a verified identity token containing your account identifier, and your name and email address where you allow it. If you sign in with email, we send a one-time passcode to your email address or mobile number. We do not create or store passwords.
• Content you add. Games, teams, players, rosters, scores, statistics, messages and images you create or upload. This can include information about other people, such as the names, positions and statistics of players you add.
• Notification channels. The email addresses, mobile numbers and web addresses you set up to receive updates, including any you add for a friend or family member, and the notifications you choose to receive.

Information collected automatically

In Short: Some information is collected automatically when you use the App, to deliver notifications, keep the App working and find problems.

• Location. With your permission, the App saves your device's precise location with each score you post, and uses it to suggest nearby venues when you enter a game location. Location is collected only while you are using the App, never in the background. You can decline or turn off location access in your device settings and still record scores.
• Push identifiers. A push notification token for your device, used to deliver the notifications you have subscribed to.
• Diagnostics. When the App crashes or encounters an error, we collect technical details including the error, device model, operating system and app version, a screenshot of the screen at the time of the error, and a recording of the session leading up to the error in which on-screen text and images are masked. We also collect performance measurements for a sample of sessions. Diagnostics are associated with your user identifier so we can investigate problems you report.
• Server logs. Our servers record requests made to our services, including your user identifier, IP address, and the time and type of each request, to operate and secure the service.

We do not track you across apps and websites owned by other companies, and we do not sell your personal information.

2. HOW DO WE USE YOUR INFORMATION?

In Short: We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our Services for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive:

• To facilitate account creation and logon process. If you choose to link your account with us to a third-party account (your Google or Apple account), we use the information you allowed us to collect from those third parties to facilitate account creation and logon process for the performance of the contract. See the section below headed "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" for further information.
• Request feedback. We may use your information to request feedback and to contact you about your use of our Services.
• To enable user-to-user communications. We may use your information in order to enable user-to-user communications with each user's consent.
• To manage user accounts. We may use your information for the purposes of managing our account and keeping it in working order.
• To send administrative information to you. We may use your personal information to send you product, service and new feature information and/or information about changes to our terms, conditions, and policies.
• To protect our Services. We may use your information as part of our efforts to keep our Services safe and secure (for example, for fraud monitoring and prevention).
• To enforce our terms, conditions and policies for business purposes, to comply with legal and regulatory requirements or in connection with our contract.
• To respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• To deliver and facilitate delivery of services to the user. We may use your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may use your information to respond to your inquiries and solve any potential issues you might have with the use of our Services.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

In Short: We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

We may process or share your data that we hold based on the following legal basis:

• Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose.
• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.
• Performance of a Contract: Where we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract.
• Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
• Vital Interests: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.

More specifically, we may need to process your data or share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Service providers we use

We use the following service providers to run the App and the Website. Each processes personal information only to provide its service to us.

Provider	What it does for us	Information it receives
Amazon Web Services	Hosts our servers, databases and file storage, and sends email notifications and passcodes	The information described in this notice, stored and processed on our behalf
Sentry	Crash reporting, error diagnostics and performance monitoring	Diagnostics as described above, associated with your user identifier and username
Google — Firebase Cloud Messaging	Delivers push notifications	Your device's push token and the content of the notification
Google — Google Sign-In	Lets you sign in with your Google account	Your sign-in request; Google returns your verified identity to us
Apple	Sign in with Apple, and delivery of push notifications to Apple devices	Your sign-in request, your device's push token and the content of the notification
Twilio	Sends text message notifications and passcodes	The mobile numbers you add and the content of the message
Toggly	Turns App features on and off	Technical information such as your IP address; no account information
Google Fonts	Provides the fonts used on the Website	Your IP address and browser details when you visit the Website

4. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you sign in with your Google or Apple account, that provider confirms who you are and shares a small amount of information with us.

You can sign in to the App with your Google or Apple account. When you do, the provider sends us a verified identity token containing your account identifier, and your name and email address where you allow it. If you sign in with Apple and choose to hide your email address, we receive a private relay address from Apple instead.

We do not receive your contacts, friends list or other information from your Google or Apple account, and we never post to your accounts. We use what we receive only for the purposes described in this privacy notice. Google and Apple handle your information under their own privacy policies, which we encourage you to review.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short:  We are not responsible for the safety of any information that you share with third-party providers who advertise, but are not affiliated with, our Website.

The Services may contain advertisements from third parties that are not affiliated with us and which may link to other websites, online services or mobile applications. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this privacy notice. We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services or applications that may be linked to or from the Services. You should review the policies of such third parties and contact them directly to respond to your questions.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your account information while your account is open, and delete it when you delete your account.

• Account and profile information is kept while your account is open and is deleted when you delete your account.
• Content you contributed — such as scores, statistics, games, teams and messages — forms part of shared records that other users rely on. When you delete your account it is kept, but it is disconnected from you and no longer identifies you. Location attached to scores you recorded is kept with those scores on the same basis.
• Diagnostics held by Sentry are kept for a limited period under Sentry's standard retention and are then deleted automatically.
• Server logs and security records are kept for as long as needed for security, fraud prevention and troubleshooting, and to meet our legal obligations. They are not used to rebuild a profile of you after you delete your account.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short:  We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. CHILDREN'S PRIVACY

The Services are not intended for use by children. We do not intentionally gather personal information about visitors who are under the age of 13. If a child has provided us with personal information, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age 13 in the applicable jurisdiction, please contact us at privacy@fanleague.co.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short:In some regions, such as the European Economic Area (EEA) and United Kingdom (UK), you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (like the EEA and UK), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, email us at privacy@fanleague.co. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

If you are a resident in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

If you are a resident in Switzerland, the contact details for the data protection authorities are available here: https://www.edoeb.admin.ch/edoeb/en/home.html.

If you have questions or comments about your privacy rights, you may email us at privacy@fanleague.co.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

You can delete your account yourself at any time in the App. See "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?" below for how, and for what deletion removes.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. If you live in California, the California Consumer Privacy Act gives you specific rights over your personal information, described below.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please email your request to privacy@fanleague.co.

If you are under 18 years of age, reside in California, and have a registered account with a Service, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please email us at privacy@fanleague.co, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g. backups, etc.).

California Consumer Privacy Act notice

This notice supplements the rest of this privacy notice and applies to residents of California. It describes how we handle personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA").

Personal information we collect. In the preceding 12 months we have collected the following categories of personal information:

Category	What we collect	Collected
A. Identifiers	Name, preferred name, email address, mobile number, user identifier, IP address and push notification token	YES
B. Personal information under the California Customer Records statute	Name, email address and mobile number	YES
C. Protected classification characteristics	Date of birth	YES
D. Commercial information	—	NO
E. Biometric information	—	NO
F. Internet or other electronic network activity	Records of requests to our services, and diagnostics including error screenshots and masked recordings of sessions that ended in an error	YES
G. Geolocation data	Precise device location saved with scores you post, and used to suggest nearby venues	YES
H. Audio, electronic or visual information	Profile photos and images you upload, and screenshots captured when an error occurs	YES
I. Professional or employment-related information	—	NO
J. Non-public education information	—	NO
K. Inferences drawn from other personal information	—	NO
L. Sensitive personal information	Precise geolocation	YES

Where it comes from. Directly from you; automatically from your device when you use the App; from Google or Apple when you sign in with them; and from other users, for example when another user adds you as a player or adds your email address or mobile number to receive updates.

Why we collect it. To provide and operate the App, including your account, games, scores, statistics and notifications; to keep the service secure and prevent fraud; to find and fix errors and measure performance; and to comply with the law. See "HOW DO WE USE YOUR INFORMATION?" above.

Who we disclose it to. We disclose each category above to the service providers listed in "WILL YOUR INFORMATION BE SHARED WITH ANYONE?", under written contracts that limit their use of it to providing their services to us. Content you post in the App is visible to other users. We may also disclose information where required by law.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the preceding 12 months. We do not sell or share the personal information of consumers we know to be under 16 years of age.

Sensitive personal information. We collect precise geolocation only to save a location with the scores you post and to suggest nearby venues when you enter a game location, both part of the service you ask us to provide. We do not use it to infer anything about you. Because we use sensitive personal information only for purposes the CCPA permits, we do not offer a separate right to limit its use.

How long we keep it. See "HOW LONG DO WE KEEP YOUR INFORMATION?" above.

Your rights. If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Delete personal information we have collected from you, subject to exceptions allowed by law. You can delete your account yourself in the App; see "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?" below.
• Correct inaccurate personal information. You can update most of your profile in the App.
• Opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of.
• Limit the use of your sensitive personal information. As described above, we use it only for permitted purposes.
• Not be discriminated against for exercising any of these rights. We will not deny you the App, charge you a different price, or give you a different quality of service because you made a request.

How to make a request. Email us at privacy@fanleague.co with "California privacy request" in the subject line, or delete your account in the App. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and may take up to a further 45 days.

Verifying your request. To protect your information, we verify that a request comes from you by matching it to information we already hold, for example by sending a one-time passcode to the email address or mobile number on your account. We use information provided for verification only for that purpose.

Authorized agents. You may use an authorized agent to make a request for you. We will ask the agent for your signed permission, and we may ask you to verify your identity with us directly. We may deny a request from an agent who cannot show they are authorized.

12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short:  Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@fanleague.co.

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Deleting your account. You can delete your account at any time from within the App: open Fans, tap Settings, then General, and choose Delete Account. Deletion takes effect immediately and cannot be undone.

When you delete your account, we remove your account and everything that identifies you, including your profile and profile photo, contact details, sign-in credentials, notification channels and preferences, the games, teams and players you follow, your rewards, and the player profile created for you when you signed up. Content you contributed to shared records, such as scores, statistics, games, teams and messages, is kept so those records stay complete for other users, but it is disconnected from you and no longer identifies you. If you own an account or organization that has other members, ownership passes to another member; otherwise it is removed.

Reviewing and updating your information. You can view and update your profile at any time in the App. Depending on where you live, you may also have the right to request access to the personal information we hold about you, to correct it, or to have it deleted. To make a request, contact us at privacy@fanleague.co.