Effective Date: September 27, 2024

Last Updated: May 01, 2024

Thank you for visiting Athlete One, LLC’s Online and Mobile Resources (defined below), and for viewing this Privacy Policy. This Policy applies to any Online and Mobile Resource that links to this Policy, including www.athleteone.com; www.totalglobalsports.com; and www.scoutingzone.com (collectively referred to as “websites” herein). Our full Privacy Policy, contained in the pages that follow, serves to give notice to data subjects, about the types of Personal Data (defined below) we collect as a controller, how we use it, who we disclose it to and why, your rights with respect to your Personal Data, and what we do to try to protect it. This Policy does not apply to our current or former workforce members or job applicants.

By interacting with our Online and Mobile Resources, you agree that your Personal Data will be handled as described in this Policy. Further, by using our Online and Mobile Resources, you are signifying to us that you have read and understand this Privacy Policy.

This Policy does not apply to websites, products and services of third parties which are subject to their own privacy policies. Please read this Policy carefully to understand our procedures and practices regarding your information and how we will treat it. If you do not agree with our Policy, procedures and practices, your choice is not to use our Online and Mobile Resources. This Policy may change from time to time. Your continued use of our Online and Mobile Resources after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

This Privacy Policy is an important document that explains how we address some of our legal obligations, and your related legal rights, involving Personal Data. The section immediately below will let you know how we use certain words in this Policy:

When we reference "this Policy", "this Privacy Policy", “the Policy”, and "our Policy", we mean the Privacy Policy you are reading now.

Wherever we say "we", "us", "our", or "Athlete One", we mean Athlete One, LLC or its affiliates, as applicable.

When we talk about our "Online and Mobile Resources", we mean all websites, applications, portals, or other features Athlete One operates, that link to this Policy.

When we refer to "Personal Data" we mean information that identifies or can be used to reasonably identify you, or that is otherwise treated as personal information or Personal Data under applicable laws (for

example, IP address, cookie IDs, device IDs). Where information does not qualify as Personal Data under applicable law (e.g., information that has been anonymized, sufficiently de-identified or aggregated), we will not treat it as such.

This Policy describes our Personal Data practices regarding the following groups of data subjects:

• athletes or other individuals associated with the athletes that visit, use, access, or interact with our Online and Mobile Resources, including youth players and their parents ("Players and Parents");
• contact persons and representatives of sporting clubs and organizations putting on events, for

example to manage and operate youth soccer leagues or tournaments ("Clubs and Organizations"); and

athletes from universities and colleges (“Coaches”)

The categories of data we collect from each of these groups, and the ways in which we use it, differs.

This Privacy Policy applies to Players and Parents using our Online and Mobile Resources, including any interactions within our Online and Mobile Resources Players and Parents may have with Clubs and Organizations and Coaches and any marketing content we may send out.

Clubs and Organizations enter into contracts with us. That contract is separate from this Policy and may have its own terms and conditions for processing of Personal Data on their behalf and governing our overall confidentiality, data privacy and data security obligations. As such, those terms, as opposed to this Policy, may apply to the Personal Data that we process on behalf of Clubs and Organizations. However, we may independently collect and process for ourselves Personal Data of Players and Parents, and Coaches, and this Policy covers that.

We collect and retain information about Coaches that interact with our Online and Mobile Resources, including to connect with Players and Parents for recruiting or coaching services.

Like all corporate enterprises, we buy goods and services, lease equipment and office space, enter into strategic collaborations, and participate industry events. In doing so, we interact with personnel of existing and potential Vendors from whom we necessarily collect certain Personal Data. We describe our use of Vendor and Business Partner Personnel Personal Data that we control generally in this Policy; provided, however, that our confidential contracts with those parties may address other Personal Data processing relating to those parties.

We collect the Personal Data we control in three ways: (i) Personal Data you voluntarily provide to us; (ii) Personal Data we collect through automated/technical means; and (iii) Personal Data that we collect from publicly available sources or obtain from third parties. We may also infer other Personal Data from the Personal Data that we collect and control. We describe our Personal Data processing practices regarding each of those collection methods in the tables below. Additional detail is provided in the Your Rights and Our Obligations Under U.S. Privacy Lawssection that provide notices to residents of certain U.S. states.

We provide more detailed descriptions of our Personal Data practices by source in the charts below. However, regardless of source, Athlete One may use your Personal Data for any purposes not inconsistent with our statements under this Privacy Policy, or otherwise made by us in writing at the point of collection, and not prohibited by applicable law, including, without limitation, to:

• allow you to participate in the features we offer on our Online and Mobile Resources;
• facilitate, manage, personalize, and improve your user experience;
• process your registration in tournaments or club events with Clubs and Organizations;
• manage and personalize your account;
• when you allow it, upload user-generated content, including content related to athlete training sessions, exercise data, daily moods, or overall physical fitness to track athletic progress;
• facilitate or manage connections with college recruiters, scouts, or coaches;
• transact with you, provide services or information you request, respond to your comments, questions and requests, serve you content and/or advertising, and send you notices;
• market to you and other promotional purposes;
• improve our products and service and for other internal business purposes;
• tailor our content, advertisements, and offers;
• fulfill other purposes disclosed at the time you provide your Personal Data or otherwise where we are legally permitted or required to do so;
• determine your location and manage digital content (e.g., territory restrictions or customization); and
• prevent and address fraud, breach of policies or terms, and threats of harm, enforce rights and/or comply with law and legal process.

Without limiting the generality of the forgoing, please see the following sections below regarding distinctions between Voluntarily Submitted Data, Automatically Collected Data, and Data Collected from Other Sources.

If you choose to participate in or make use of certain activities and features available via our Online and Mobile Resources, you will need to provide us with data about yourself. The types of Personal Data you will be submitting to us in those situations will include basic identifiers such as your name, email address, mailing address, and phone number. It may also include more sensitive information, such as your height, weight, exercise data, daily mood reporting, birth certificates or passports for age verification to ensure eligibility to participate in certain competitions. Below are some of the ways you voluntarily give us your Personal Data and information on how and why we use it:

Categories of Personal Data we collect voluntarily from you include:

When you visit or use our Online and Mobile Resources, basic data about your internet/electronic activity is automatically collected through your browser via tracking technologies, such as “cookies.” Cookies are small text files downloaded onto your computer or mobile device. Cookies allow us to collect your IP address and other usage data, recognize your computer or mobile device, and store some data about your preferences for using our Online and Mobile Resources or past actions, such as described in the table below:

We collect Personal Data from publicly available sources and from third parties (such as Clubs and Organizations), which we may combine with Personal Data you have provided to us or that we have collected automatically.

Additional data about cookies and tracking technologies is available:https://s3.amazonaws.com/images.totalglobalsports.com/privacy/DRAFT+-+Athlete+One+-+Cookie+policy+-+6-17-24(8304035.1).pdf

If you access our Online and Mobile Resources from a phone or other mobile device, the mobile provider may transmit certain data to us such as uniquely identifiable mobile device data. We may be able to collect additional information through your mobile phone that allows us to identify you, including by collecting your mobile phone number. You can control some of the information disclosed to us through your device settings.

When you use our Online and Mobile Resources, we may allow third party providers, including third party advertising partners, to place their own cookies or similar technologies to engage in the same types of collection we describe above.

We maintain a presence on one or more external social media platforms, including but not limited to X, Facebook, Instagram, and LinkedIn. We may further allow the community features of our Online and Mobile Resources to connect with, or be viewable from, that external social media presence. Similarly, our Online and Mobile Resources may contain links to other websites or apps controlled by third parties. If you interact with our Online and Mobile Resources using plug-ins for any social networks, including Facebook, X, or YouTube, your activity may be available for review by those network operators and other users of such social networks.

We are not responsible for the content on, or the privacy practices of, social media platforms, or any third- party sites or apps to which we link. Those apps, sites and platforms are not controlled by us and therefore have their own privacy policies and terms of use. To be clear: neither this Policy nor the terms of

use appearing on or in any of our Online and Mobile Resources apply to our social

media presence or any third-party sites or apps to which we may link. That means even if you take an action related to our specific social media profile, and identifiers about you are automatically

collected and given to us as a result, that collection and transfer is governed by the privacy policies and other terms of the applicable social media platform. If you have questions about how those apps, sites and platforms collect, use and disclose Personal Data, you should carefully read their privacy policies and contact them using the contact information they provide.

We retain your Personal Data for a period of time consistent with the purpose of collection and processing, fulfilling our legal obligations and enforcing our agreements and defending our legitimate interests. The retention period for Personal Data is determined by us based on the amount, nature, and sensitivity of the Personal Data being processed, the potential risk of harm from unauthorized use or disclosure of the Personal Data, whether we can achieve the purposes of the processing through other means, and any applicable legal requirements. For example, we will retain certain identifiers for as long as it is necessary to continue maintaining your account and providing you our products and services, to comply with our tax, accounting, and recordkeeping obligations, and for research, development, and safety purposes, as well as an additional period as necessary to protect, defend, or establish our rights, defend against potential claims, and to comply with our legal obligations.

We may disclose your Personal Data as described below, subject to the requirements of the U.S. Privacy Laws, such as opt outs under U.S. Privacy Laws.

Subject to applicable law, we may disclose Personal Data to Clubs and Organizations who will use data according to their own policies. Certain types of Personal Data, e.g., sensitive data like your daily moods, will only be shared with your permission. Please check with the Clubs and Organizations for more information on their data privacy practices.

Subject to applicable law, we may disclose Personal Data to Coaches, recruiters and scouts who will use data according to their own policies.  Certain types of Personal Data, e.g., sensitive data like your daily

moods, will only be shared with your permission. Please check with the Coaches and their affiliated organizations for more information on their data privacy practices.

Subject to applicable law, we may disclose Personal Data to other corporate affiliates who will use such data in the same way as we can under this Policy.

We may disclose Personal Data to government authorities, and to other third parties, as required or permitted by law, including responding to court orders and subpoenas.

We also may disclose Personal Data when we have reason to believe that someone is causing injury to or interference with our rights or property or harming or potentially harming other persons or property.

If we, or any of our affiliates, sell or transfer all or substantially all of our assets, equity interests or securities, or are acquired by one or more third parties as a result of an acquisition, merger, sale, reorganization, divestiture, consolidation, or liquidation, Personal Data may be one of the transferred assets. Such disclosures may include pre-transaction disclosures such as during due diligence.

We also disclose Personal Data to service providers, contractors, or processors, and business partners

(our "Vendors") who need it to perform services for us under the contracts we have with them, including third party advertising partners (e.g., operators of cookies and tracking technologies associated with our

Online and Mobile Resources).

We have adopted, implemented, and maintain an enterprise-wide corporate data security and privacy program that includes technical, organizational, administrative, and other security measures designed to protect, as required by applicable law, against reasonably anticipated or actual threats to the security of your

Personal Data (the "Security Program"). We have reason to believe our Security Program is reasonable and appropriate for our business and the nature of foreseeable risks to the Personal Data we collect and

process. Nonetheless, we cannot guarantee that your Personal Data, whether during transmission or while stored on our systems, otherwise in our care, or the care of our Vendors, will be free from unauthorized access or that loss or accidental destruction will never occur. Except for our duty underf applicable law to maintain the Security Program, we disclaim, to the maximum extent the law allows, any liability for any theft or loss of, unauthorized access or damage to, or interception of any data or communications including Personal Data.

If we are using your Personal Data to send you marketing materials, such as newsletters or product alerts via email, you may opt out / withdraw your consent by following the instructions linked or otherwise provided in the applicable email or other communication. In addition, residents of certain jurisdictions have additional rights as set forth in the U.S. State Privacy Rights section below. When we receive your request, we will take reasonable steps to remove your name from our distribution lists, but it may take time to do so. You may still receive materials for a period of time after you opt out.

Some information about your use of our Online and Mobile Resources and certain third-party services may be collected using tracking technologies across time and services and used by Athlete One and third parties for purposes such as to understand you better as an athlete, to associate different devices you use, and deliver relevant and retargeted ads and/or other content to you on the service and certain third-party services.

Some browsers have a do not track (“DNT”) feature that lets you tell websites that you do not want to have your online activities tracked. We do not support DNT because there is no industry consensus on how they should be treated. We do, however, support Global Privacy Control (“GPC”) where we are required to do so. The GPC signal communicates a Do Not Sell / Share / Target request from a global privacy control if enabled for that browser or device, or the data subject, if they can be identified. For more information regarding GPC, see the U.S. Privacy Laws section below.

U.S. Federal law imposes special restrictions and obligations on commercial website operators who direct their operations toward and collect and use Personal Data from children under the age of 13. Certain Comprehensive Privacy Laws also regulate Personal Data processing practices involving children and other minors. We take those age-related requirements very seriously, and, consistent with them, our information practices comply with the Children’s Online Privacy Protection Act (“COPPA”). COPPA requires that we inform you of our practices with regards to our collection, use, or disclosure of Personal Data from children under the age of 13, and to obtain verifiable parental consent prior to collecting, using, or disclosing any such information.

If we discover we have collected information from a child in a manner inconsistent with COPPA’s requirements, we will either seek the parent’s consent for that collection or delete the information. We will not require a child to disclose more information than is reasonably necessary to participate in the Online and Mobile Resources.

a. Verifiable Parental Consent

In order for a minor, including a child under the age of 13 to access our Online and Mobile Resources, either

(a) a parent or legal guardian (“Parent”) must provide verifiable parental consent; or (b) a coach or other authorized team administrator must provide consent on behalf of the Parent.

Athlete One generally obtains verifiable parental consent prior to collecting, using, or disclosing any Personal Data from children. There are limited instances where we may collect information without parental consent in compliance with COPPA, including: (a) to protect the security or integrity of our Online and Mobile Resources; or (b) we may collect contact information in order to respond to a specific request from a Club or Organization on a one-time basis.

We collected and processed the following categories of Personal Data within the 12 months prior to the effective date of this Privacy Policy:

• identifiers such as name, address, email address, IP address, and other similar identifiers
  1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data analytics providers, data processors, payment processors, and marketing companies), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: Third party advertising partners.
• Personal Data under the Customer Records provision of the California Civil Code such as a name, address, telephone number, credit card number, physical characteristics or description of an athlete
  1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data processors, and payment processors), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: Third party advertising partners.
• Protected Classifications under the Law such as height, weight, gender, and age
  1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data processors, and payment processors), other members of our corporate group, and/or other parties (e.g., litigants and government entities).

• Internet/network activity such as browsing history and search history
  1. Recipients: Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data analytics providers, data processors, and marketing companies), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: Third party advertising partners.
• Geolocation data including geographic coordinates/physical location/travel plans when participating in tournaments or other sporting events
  1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data analytics providers, data processors, and marketing companies), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: N/A
• Biometric data including exercise data, metrics related to on-field performance, and daily mood reports
  1. Recipients: Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, premises security vendors, and call center providers), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: N/A.
• Professional or employment related data related to Coaches
  1. Recipients: Players and Parents, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, and data processors), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: N/A.
• Non-public education information of athletes such as GPA and testing scores
  1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data processors, and payment processors), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  2. Sale/Share: N/A.
• Inferences drawn from the foregoing to create a profile about a consumer reflecting the athlete’s preferences, predispositions, behavior, and attitudes.
1. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, data analytics providers, data processors, and marketing companies), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
2. Sale/Share: N/A.

• Sensitive Personal Information, including:
  1. to create a profile about a consumer reflecting the an individual's commercial preferences, predispositions, behavior, and attitudes.
  2. Birth certificate or passport for age verification and eligibility determinations.
  3. log-in information (e.g., username and password to online account with Athlete One)
  4. Recipients: Clubs and Organizations, Coaches, Service Providers (e.g., general IT, cloud computing, software, and other business vendors, and data processors), other members of our corporate group, and/or other parties (e.g., litigants and government entities).
  5. Sale/Share: N/A.

Because there are numerous types of Personal Data in each category, and various uses for each Personal Data type, actual retention periods vary. We retain specific Personal Data pieces based on how long we have a legitimate purpose for the retention. Generally, we process your Personal Data to provide you services and as otherwise related to the operation of our business, including for one or more of the following business purposes: performing services; registering athletes for tournaments and other sporting events; coordinating coaching and training sessions; managing interactions and transactions; security; debugging; advertising and marketing; quality assurance; processing interactions and transactions; and research and development. We may also use Personal Data for other business purposes in a context that is not a sale or share under applicable U.S. Privacy Laws, such as disclosing it to our service providers, contractors, or processors that perform services for us (“Service Providers”), to you or to other parties at your direction or through your action; for the additional purposes explained at the time of collection (such as in the applicable privacy policy or notice); as required or permitted by applicable law; to the government or private parties to comply with law or legal process or protect or enforce legal rights or obligations or prevent harm; and to assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Additional Business Purposes”). Subject to restrictions and obligations under applicable U.S. Privacy Laws, our Service Providers may also use your Personal Data for Business Purposes and Additional Business Purposes, and may engage subcontractors to enable them to perform services for us.

As described more below, subject to meeting the requirements for a Verifiable Consumer Request (defined below) and limitations permitted by applicable U.S. Privacy Law, we provide individuals the privacy rights described in this section, as may be required by applicable U.S. Privacy Law. If you exercise these rights, we will not discriminate against you by treating you differently from other individuals who use our Online and Mobile Resources or purchase our services but did not exercise their rights.

data, our use of it and, if the data was disclosed or sold to third parties, the categories so disclosed or sold as well as the categories of third parties who received or purchased it. You may also have a right to request that we provide a list of third parties to which we have disclosed Personal Data.

• Access – You may have the right to receive a copy of the categories and specific elements of Personal Data we collected about you.
• Correct – You may have the right to request the correction of inaccurate information collected. You can also make changes to your online account in the account settings section of the account. That

will not, however, change your information that exists in other places.

Data.

• Opt Out –You may have the right to opt out of any sale or sharing for targeted advertising of Personal Data (as defined in applicable laws) if such sale / sharing / targeted advertising occurs.
• Transfer/Data Portability –You may have the right to request the transfer of specific pieces of Personal Data we have collected about you to another entity.
• Sensitive Personal Information –With regard to Personal Data that qualifies as sensitive Personal Data under applicable U.S. Privacy Law, if you elect to provide us with that sensitive

Personal Data you will have consented to such processing. We do not process sensitive personal information that is subject to the right to limitation under applicable law. Note, you can terminate your account with us at any time.

• Automated Decision Making / Profiling – We do not engage in Automated Decision Making or Profiling as defined by U.S. Privacy Laws.
• Appeal – You may have a right to appeal a refusal to take action on a request by contacting us by email at privacy@athleteone.com.

Exercising Your Rights

To submit a request to exercise your consumer privacy rights, or to submit a request as an authorized agent, contact us at privacy@athleteone.com or via U.S. post to Athlete One, Inc., 202 Fashion Lane, Suite 101 Tustin, California 92780, Attn: Data Privacy Officer. We have the ability to charge a reasonable fee for administrative costs of providing the Personal Data to you in situations where the request is unfounded or excessive (e.g., due to its repeated nature), or in the alternative, we may refuse to act on the request in those situations. We will notify you in such cases.

Opt Out of Sale / Sharing / Targeted Advertising:

If you want to limit our processing of your cookie-related Personal Data for targeted advertising, or opt-out of the Sale/Sharing of such Personal Data, you may utilize our cookie management tool which enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our Online and Mobile Resources you visit, from each browser you use, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective, and you will need to enable them again via our cookie management tool. Beware that if you use ad blocking software, our cookie banner may not appear when you visit our services, and you may have to use the link above (the Do Not Sell or Share My Personal Information link at the bottom of our Online and Mobile Resources) to access the tool.

Opt-Out Preference Signals: You may also opt out of cookie-related sales / sharing / targeted advertising by using an opt-out preference signal or Global Privacy Control (“GPC”). To use a GPC, you can

download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We have configured the settings of our consent management platform to receive and process GPC signals on our Online and Mobile Resources. If you opt-out using the GPC functionality available in some browsers while you are logged in to one of our Online and Mobile Resources, we will use that signal to opt you out of all online and offline marketing and sharing. If your browser functionality supports GPC but you are not logged into one of our Online and Mobile Resources we will use that signal to opt you out of online tracking only. If your browser does not support GPC you can click on the [LINK] at the bottom of our Online and Mobile Resources to activate our cookie manager where you can select your opt out choices for browser activity.

We do not knowingly sell or share the Personal Data of consumers under 16. If you think we may have unknowingly collected Personal Data of a consumer under 16 years old, please email us at privacy@athleteone.com.

As permitted or required by applicable U.S. Privacy Laws, any request you submit to us must be a Verifiable Consumer Request, meaning when you make a request, we may ask you to provide verifying information, such as your name, e-mail, phone number and/or account information. We will review the information provided and may request additional information (e.g., transaction history) via e-mail or other means to ensure we are interacting with the correct individual. We will not fulfill your Right to Know, Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected Personal Data. To protect individuals’ privacy, if we are unable to verify you sufficiently, we will be unable to honor your request.

We will use Personal Data provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you. To designate an authorized agent to make a request on your behalf, please provide us with a power of attorney or other legally binding written document signed by you and identifying your agent. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable U.S. Privacy Laws.

You are not required to create a password-protected account with us to make a Verifiable Consumer Request, but you may use your password-protected account to do so. If we suspect fraudulent or malicious activity on or from the password-protected account, we may decline a request or request that you provide further verifying information.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Site that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@athleteone.com.

We reserve the right to change or update this Policy from time to time. Please check our Online and Mobile Resources periodically for such changes since all data collected is subject to the Policy in place at the time of collection. We will indicate the effective/amendment date at the beginning of this Policy.

If you have any questions about our privacy and data security policies, procedures, and practices, including anything we say in this Policy, please contact us at:

Attn: Data Privacy Officer 202 Fashion Lane, Suite 101

Tustin, California 92780

• Portals:
• Email: privacy@athleteone.com