Privacy Policy

Effective date: November 9, 2026 Last updated: November 9, 2026

Contents

1. About this Policy 2. Who we are and how to reach us 3. The people we collect information about 4. Information we collect 5. Sign in with Google and Sign in with Apple 6. How we use information 7. Legal bases for processing (EU, UK, and similar laws) 8. How profiles are seen, and how we share information 9. Minors and children 10. Parents and guardians 11. Coaches 12. Brands and professional athletes 13. ASM Strategic Capital 14. ASN Foundation, donors, and sponsors 15. Payments 16. Messages and how we review them 17. Cookies and similar technologies 18. How long we keep information 19. How we protect information 20. International data transfers 21. Your privacy rights 22. U.S. state privacy rights 23. EU, UK, and Swiss privacy rights 24. How to make a request, and how we verify it 25. Law enforcement, safety, and NCMEC reporting 26. We do not sell or share personal information 27. Third-party sites and services 28. Changes to this Policy 29. How this Policy relates to our Terms of Service 30. Contact us

1. About this Policy

This Privacy Policy explains how we collect, use, share, and protect personal information when you:

• visit asmsportsgroup.com (and asmsports.co, which redirects there);
• use the ASM portal at portal.asmsportsgroup.com (the "Portal"), including the athlete, parent, coach, brand, client, training, and staff areas;
• enroll in, sign, or pay for an ASM membership, program, or agreement;
• donate to or sponsor the ASN Foundation through our Services, if and when that feature is offered;
• register interest in ASM Strategic Capital; or
• contact us, attend our events, or receive our emails and messages.

Together, these are the "Services." "Personal information" means information that identifies, relates to, or could reasonably be linked to you or your household.

This Policy does not cover the websites, apps, or services of colleges, coaches, brands, Strategic Capital Partners, the ASN Foundation, or other third parties, even if we link to them. Their own privacy policies apply.

2. Who We Are and How to Reach Us

The Services are operated by Varsity Points Inc. d/b/a ASM Sports Group ("ASM," "we," "us," or "our"), 1700 Palm Beach Lakes Blvd, Suite 810, West Palm Beach, FL 33401, USA.

For the EU and UK General Data Protection Regulations ("GDPR"), ASM is the controller of the personal information described in this Policy. The exceptions are where we process information only on behalf of another organization, such as the ASN Foundation for donations (Section 14), or where a coach's institution or a Strategic Capital Partner is acting as its own controller.

Privacy contact: privacy@asmsports.co EU and UK representatives: ASM has not appointed an EU or UK Article 27 representative. If you are in the European Union or the United Kingdom, contact our privacy team at privacy@asmsports.co. Data protection officer: ASM has not appointed a data protection officer. Contact our privacy team at privacy@asmsports.co.

3. The People We Collect Information About

We collect information about:

• Athletes: student-athletes, transfer athletes, international athletes, and professional athletes, many of whom are high school students under 18.
• Parents and legal guardians of athletes under 18, and family members who help manage an athlete's account.
• Coaches: college, university, junior college, club, team, and performance coaches and athletics staff.
• Brands, sponsors, and business partners.
• Investors and prospective investors who contact ASM Strategic Capital.
• Donors and Foundation sponsors who give to the ASN Foundation through our Services.
• ASM agents and staff, including independent contractor Licensed Agents, job applicants, and people taking our training programs. Staff and contractor data is also covered by internal policies.
• Website visitors, event guests, and people who contact us.

4. Information We Collect

4.1 Information you give us

You do not have to give us all of this. Some information (such as an email address, and for athletes a date of birth) is needed to create an account. Profile details help coaches and brands evaluate you, and leaving them out may limit what we can do for you.

4.2 Information collected automatically

• Security and session data: one-time email verification codes, sign-in attempt records, session tokens, and a "trusted device" token (see Sections 17 and 19).
• Device and log data: IP address, browser type, device type, operating system, language setting, approximate location derived from IP address (city or region level), date and time of access, referring page, and error logs. Our hosting provider and content delivery network (Cloudflare) process this to deliver and secure the Services.
• Usage data: pages and profiles viewed, features used, and actions taken in the Portal. We record a random visitor identifier and usage events for our own analytics, and we count how many times an athlete's public profile is viewed.
• Precise location: we do not collect precise (GPS) location. If a future feature needs it, we will ask for permission through your device first.

4.3 Information from other sources

• Parents, guardians, and family who create or manage an athlete's account.
• ASM agents and staff, who may add information from intake calls, assessments, and recruiting work.
• Coaches, clubs, schools, and event organizers, for example results, rosters, references, or confirmation of an offer.
• Public sources, such as published results, rankings, rosters, news articles, and public social media profiles.
• Referral partners and lead sources, such as event sign-up lists, partner referrals, and records moved from our earlier customer-service and CRM systems.
• Service providers, such as Stripe (payment status) and Google or Apple (sign-in confirmation, see Section 5).
• Strategic Capital Partners and the ASN Foundation, where needed to handle a request you made.

5. Sign in with Google and Sign in with Apple

You can choose to sign in to the Portal with Sign in with Google or Sign in with Apple. You don't have to; you can use an email address and password instead.

5.1 Sign in with Google

What we ask for. We use Google's standard sign-in, which asks only for basic profile and email permission ("openid," "email," and "profile"). We do not ask for, and cannot access, your Gmail, contacts, calendar, Google Drive, YouTube account, or any other Google data.

What we keep. When you sign in, Google confirms your identity to us. We keep only two things from Google: your Google account ID (a unique number Google assigns to your account) and your email address, along with whether Google has verified that email. Google's sign-in response may also include your name and profile picture, but we do not store your Google name or profile picture. The name and photo on your ASM profile are the ones you enter in the Portal.

How we use it. We use your Google account ID and email only to sign you in, to confirm your email is verified, to find and link your existing ASM account, and to keep your account secure. We do not use it for advertising, marketing, profiling, or any other purpose.

How we share it. We do not sell Google user data or share it with advertisers. It is stored by our hosting and database provider (Base44) on our behalf, and we disclose it only if the law requires it or as part of a merger or sale of our business with notice to you.

How long we keep it, and how to remove it. We keep your Google account ID and email for as long as your ASM account exists, and delete them within 30 days after your account is deleted (Section 18). You can stop Google sign-in at any time in your Google Account (Security → Your connections to third-party apps & services). That ends Google sign-in but does not delete your ASM account. To delete your account, see Section 24.

Limited Use statement. ASM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy(https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This means we:

• use Google user data only to provide the sign-in feature you chose;
• do not transfer it to others except as needed to provide that feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you;
• do not use or transfer it to serve advertisements, including retargeting, personalized, or interest-based advertising;
• do not sell it; and
• do not allow people to read it unless you have given us permission, it is needed for security purposes (such as investigating abuse), it is needed to comply with law, or it has been aggregated and anonymized for internal operations.

5.2 Sign in with Apple

Apple shares a unique Apple account ID and an email address. On your first sign-in, Apple may also share your name. You can choose Apple's Hide My Email option, which gives us a random relay address (ending in @privaterelay.appleid.com) that forwards to your real inbox. We will use the relay address and will not try to find your real address. If you turn off forwarding in your Apple settings, you may stop receiving our emails, including sign-in codes. We store your Apple account ID and email to sign you in and keep your account secure, and use them for nothing else. When you delete your account, we delete them. We will also take steps to revoke any Apple sign-in token where we are able to do so. You should also revoke ASM's access in your Apple Account settings. You can stop using Sign in with Apple in your Apple Account settings (Sign-In & Security → Sign in with Apple).

6. How We Use Information

We use personal information to: 1. Provide the Services: create and manage accounts; build athlete profiles and Verified Profiles; show profiles to coaches, brands, and agents according to visibility settings; run search, messaging, and connection tools; and deliver Platform Subscriptions, training, and events. 2. Provide recruiting, representation, and management services under Separate Agreements: recruiting assessments, coach outreach, placement, admissions, transfer, international and visa guidance, Sports Management, NIL, brand, and professional athlete services, including assigning an ASM agent or staff member. 3. Verify users: confirm coaches' identity and school affiliation (Section 11), confirm parent or guardian consent for minors (Section 9), and confirm "Verified" profile status. 4. Handle agreements and payments: prepare and store agreements and e-signatures; process payments, subscriptions, payment plans, renewals, and refunds through Stripe; and send renewal reminders. 5. Communicate with you: send service messages (verification codes, receipts, renewal reminders, account and safety notices); answer questions; send marketing emails where the law allows (you can unsubscribe at any time); and send marketing texts only with your express consent. 6. Feature athletes, only with the separate permission described in our Terms (and a parent or guardian's permission for a minor), on our website and social media accounts, including Instagram @asmsports.co. 7. Operate ASM Strategic Capital: respond to your interest and, at your request, introduce you to Strategic Capital Partners (Section 13). 8. Support ASN Foundation giving: pass donation information to the Foundation so it can process, acknowledge, and administer your gift (Section 14). 9. Keep people safe: protect minors, review reported messages, detect and stop fraud, spam, scraping, and abuse, and enforce our Terms. 10. Use AI-assisted tools: some Portal features (such as drafting help, reading text from uploaded documents, and generated images or audio) send the content you choose to an AI service run through our platform provider, only to produce that result for you. We do not let these services use your information to train their general models,, to the extent our providers' terms allow us to control this. We do not use AI to make decisions about you that have legal or similarly significant effects. 11. Improve the Services: understand how the Services are used, fix problems, and develop new features, using aggregated or de-identified information where we can. 12. Comply with law: meet legal, tax, accounting, and regulatory obligations; respond to lawful requests; and establish, exercise, or defend legal claims.

We will not use your personal information for a purpose that is materially different from these without telling you and, where the law requires, asking for your consent.

7. Legal Bases for Processing (EU, UK, and Similar Laws)

If GDPR or a similar law applies to you, we rely on these legal bases:

Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect anything we did before.

8. How Profiles Are Seen, and How We Share Information

8.1 Profile visibility

• Adult athletes (18 and over) may choose whether their profile is public (shown on our public athlete pages and searchable by visitors and coaches) or more limited in visibility.
• Athletes under 18: It is ASM's policy that a minor's profile should not be publicly searchable without a parent or guardian's permission. Parents or guardians may contact us at privacy@asmsports.co to review, limit, or remove a minor's profile. We may verify a parent or guardian's request before acting. We may also require parental permission before a minor's profile is shown more widely to coaches or the public.
• Not intended to be shown on any public profile: date of birth, sex, phone number, personal email, home address, parent or guardian details, budget range, NCAA/NAIA ID numbers, test scores (unless the athlete, or a parent or guardian of a minor, asks us to display a test score), passwords, and account security data. If you believe any of these appear on a profile, contact privacy@asmsports.co and we will review and remove them as appropriate.
• Athletes (and parents or guardians of minors) may ask us to change visibility by emailing privacy@asmsports.co, and may also use any visibility controls available in the Portal.

8.2 Who we share information with

• Coaches and institutions, according to profile settings or at your direction, for example when ASM presents an athlete to a program, or when you share non-public fields.
• Brands and sponsors, only at your direction or as part of services under a Separate Agreement, such as an NIL opportunity you apply for.
• Your assigned ASM agent or staff, including independent contractor Licensed Agents bound by confidentiality.
• Linked parents or guardians of minors (Section 10).
• Strategic Capital Partners, only when you ask for an introduction (Section 13).
• The ASN Foundation, only for donation processing and administration (Section 14).
• Service providers that process information for us under contracts limiting their use of it (Section 8.3).
• Professional advisers, such as lawyers, accountants, auditors, and insurers, under confidentiality.
• Authorities and safety organizations, as described in Section 25.
• A buyer or successor, in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. The successor must honor this Policy for information it receives, and we will give notice where required.
• Anyone else with your consent.

We may share aggregated or de-identified information that cannot reasonably identify you, for example placement statistics.

8.3 Service providers

9. Minors and Children

The Services are built for young athletes, and we take extra care with minors' information.

9.1 Children under 13

The Services are not for children under 13. We do not knowingly collect personal information from anyone under 13, and children under 13 may not create an account. Children under 13 may not create an account or submit personal information. We may verify age. If we learn we have collected personal information from a child under 13 without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA), we will delete it promptly. If you believe a child under 13 has given us information, contact privacy@asmsports.co.

9.2 Teens aged 13 to 17

Athletes aged 13 to 17 (or under the age of majority where they live) may use the Services only with a parent or guardian's consent.

• Parent or guardian verification. Athletes aged 13 to 17 may use the Services only with a parent or guardian's permission. We may ask for a parent or guardian's email address and may verify that permission, including by asking the parent or guardian to agree to our Terms and this Policy for the teen. We may require parental permission before a teen's profile is shown to coaches. Parents or guardians may contact us at privacy@asmsports.co to review, limit, or delete a teen's information.
• Purchases and agreements. Only a parent or guardian can buy a subscription or program or sign an agreement for a minor.
• Name, image, and likeness. We feature a minor on ASM's website or social media, or include them in NIL or brand opportunities, only with the parent or guardian's written permission.

9.3 Protections for minors

• It is ASM's policy that a minor's profile should not be publicly searchable without parent or guardian permission (Section 8.1).
• Contact details are not intended to be shown on minors' profiles. Parents or guardians may contact us if they see information that should be removed.
• Parents or guardians may contact us at privacy@asmsports.co to review or request deletion of a minor's information, including messages. We may verify that the requester is the minor's parent or guardian.
• No marketing emails or texts to users we know are under 18 without parent or guardian consent.
• No targeted advertising to, and no sale or sharing of the personal information of, users we know are under 18.
• Coaches must follow recruiting contact rules, and must not ask a minor to keep communications secret (Terms Section 16).
• Safety reviews and reporting, including to NCMEC (Section 25).

9.4 Parents' rights over a minor's information

A parent or guardian of a minor can, at any time:

• review the information in the minor's account;
• correct or update it;
• download a copy of it;
• change the minor's profile visibility;
• withdraw consent to further collection or use, which will close or restrict the account; and
• ask us to delete the minor's account and information.

Make these requests by emailing privacy@asmsports.co. We will check that you are the minor's parent or guardian before acting. If a parent or guardian account is linked in the Portal, you may also use any tools available there.

9.5 Turning 18

When an athlete turns 18, they take control of their own account and settings, and parent or guardian access continues only if the athlete agrees.

10. Parents and Guardians

When a parent or guardian creates or links an account, we collect their name, relationship to the athlete, email, login details (including Google or Apple sign-in identifiers if used), and records of their consent, agreements, signatures, and payments. We use this to verify consent, give them access to the athlete's account, send them service and safety messages, process their payments, and honor their rights over the minor's information. A parent or guardian can ask us to delete their own information. If the athlete is still a minor, deleting the parent's information may mean closing the minor's account.

11. Coaches

We collect coaches' name, institution or team, coach type, sport, title, institutional email, phone, location, bio, photo, and their activity on the Services, including searches, profile views, saved athletes, and messages.

Verifying school affiliation. To protect athletes, we may verify college coaches before giving them access to non-public athlete information. This may include confirming an institutional email address (such as a.edu address) and checking the coach's name and title against the institution's published athletics staff directory. We may ask for more proof and may suspend accounts we cannot verify.

We may share coach activity with the athlete concerned where that information is available in the Services. Where the law allows, we may share coach information with the coach's institution or athletic association in response to a compliance inquiry or a safety concern. Coach profiles that a coach makes public can be seen by athletes and families.

12. Brands and Professional Athletes

Brands and sponsors. We collect business contact details, company information, and information about opportunities, budgets, campaigns, and deals, and use it to run the opportunities marketplace, match brands with athletes, deliver brand services, and process payments. Business contact details shown on opportunities you post are visible to the athletes and agents who can see that opportunity.

Professional athletes and management clients. For professional athletes and Sports Management or Commercial clients, we may handle contract, endorsement, appearance, income, and commercial information as needed to provide services under the Separate Agreement. We keep this information confidential and share it only as that agreement allows or as you direct, for example with a brand, team, or your own advisers.

13. ASM Strategic Capital

If you contact ASM Strategic Capital, register interest, use a deal room or calculator, or submit an indication of interest or allocation request, we collect your name, email, phone, any access code you use, the Opportunities and amounts you indicate, and any information you give about your investment interests or investor status.

Sharing with Strategic Capital Partners only at your request. We share your information with a Strategic Capital Partner only when you ask us to introduce you to that Partner or to an Opportunity it offers. We then share your name, contact details, and the information about your interests and investor status that you gave us, so the Partner can contact you and do its own eligibility, identity, anti-money-laundering, and suitability checks. Once shared, the Partner's own privacy policy and Offering Documents govern its use of your information, and ASM does not control what the Partner does. We do not sell investor information, and we do not share it with Partners for their own marketing without your request.

ASM does not collect bank account details, investment funds, or tax identification numbers for any Opportunity. Never send these to ASM (see Terms Section 12).

14. ASN Foundation, Donors, and Sponsors

What we collect. If and when you donate to, or sponsor, the ASN Foundation through our Services, ASM collects your name, email, billing details, donation amount, any message you include, the athlete or Campaign you choose to support, and your display and anonymity choices. Card details are handled by Stripe and are not stored by ASM.

Why we share it with the Foundation. We share donor and sponsor information with the ASN Foundation only so the Foundation can process, acknowledge, receipt, administer, and report on your gift, and keep the records the law requires. When ASM handles donation information, it does so for these purposes on the Foundation's behalf.

What we don't do. We do not sell donor information. We do not use it to market ASM's own commercial services unless you separately opt in, and we do not share it with brands or Strategic Capital Partners.

Campaign pages. If you choose at checkout, your name (and message) may appear on the Campaign page and be shared with the athlete. If we offer an option to give anonymously and you choose it, your name is hidden from the public and the athlete, but the Foundation still keeps it for its records and tax acknowledgments.

Athletes running Campaigns. If an athlete (with parent or guardian consent if under 18) creates a fundraising page, the information on it, such as name, photo, sport, story, and goals, is public. The Foundation receives the information it needs to decide on and administer support.

Foundation partners. The Foundation may share information with its own partners, such as programs, camps, schools, or vendors it pays for approved athlete expenses, only as needed to provide that support.

The Foundation's use of your information is governed by any privacy policy the Foundation publishes, and otherwise by this Policy to the extent ASM collects the information. Contact the Foundation through support@asmsports.co.

15. Payments

Payments, subscriptions, payment plans, and refunds are processed by Stripe, Inc., which is certified as a PCI DSS Level 1 service provider. ASM does not receive or store your full card number or security code. Stripe gives us limited details (such as name, email, billing postal code, card brand, last four digits, and payment and subscription status) so we can confirm payments, manage your plan, send renewal reminders, and handle refunds. Stripe uses your information under its own privacy policy, including for fraud prevention. You can manage saved payment methods and subscriptions through the Stripe billing portal link in your receipts.

16. Messages and How We Review Them

Messages you send through the Portal are stored on our systems. Messages are not private from ASM. We may review, keep, and disclose them:

• when a user reports a message or account;
• when automated or manual checks flag possible harassment, grooming, exploitation, spam, scraping, fraud, or rule-breaking;
• to protect minors and other users;
• to provide support you ask for;
• to enforce our Terms, including the coach rules in Terms Section 16;
• to respond, where the law allows, to a compliance inquiry from an institution or athletic association; and
• as required by law (Section 25).

Only authorized ASM staff with a need to know can review messages. For minors, parents or guardians may contact us to review or request deletion of messages as described in Section 9.3. You can report a message or user by emailing support@asmsports.co.

17. Cookies and Similar Technologies

We use cookies and browser storage (local storage) mainly to keep you signed in and secure. In short:

• Strictly necessary: session tokens for each Portal area (athlete, parent, coach, brand, client, training, and staff), a "trusted device" cookie that lets you skip repeat verification codes on your own device for up to 30 days, sign-in tokens used by our platform provider, and security cookies set by Cloudflare.
• Preferences: your language, theme (light or dark), and layout choices.
• Our own analytics: a random visitor ID and page and feature usage events, stored in our own systems and not shared with advertising networks.
• Embedded content: YouTube videos may set YouTube cookies.

We do not currently use advertising cookies, social media pixels, or third-party advertising or analytics trackers. Because we do not sell or share personal information for targeted advertising, no advertising opt-out is needed today (see Section 26). If we ever add non-essential cookies, we will update this Policy first and will ask for your consent where the law requires. Questions about cookies may be sent to privacy@asmsports.co.

18. How Long We Keep Information

We keep personal information only as long as we need it for the purposes in this Policy, then delete it or de-identify it. Typical periods:

We may keep information longer if needed to comply with law, resolve disputes, prevent fraud or abuse, or enforce our agreements. If we do, we restrict its use to that purpose.

19. How We Protect Information

We use administrative, technical, and physical safeguards, including:

• encryption in transit (HTTPS/TLS) across the website and Portal;
• passwords stored only as salted, one-way hashes (PBKDF2-SHA256), and a minimum password length;
• email two-step verification, with codes that expire after 10 minutes, limited attempts, and temporary lockout after repeated failures;
• trusted-device tokens limited to 30 days, and sessions that expire;
• password reset tokens that are single-use, time-limited, and stored as hashes;
• role-based access, so staff and agents see only what their role requires, and server-side controls that block direct anonymous access to our database;
• network protection through Cloudflare;
• payment card handling outsourced to Stripe; and
• confidentiality obligations for staff and contractors.

No system is completely secure. Protect your password, use trusted devices only if they are yours, and tell us right away at support@asmsports.co if you suspect unauthorized access. If a breach affects your personal information, we will notify you and the authorities as required by law, including Florida's Information Protection Act (Fla. Stat. § 501.171) and GDPR where it applies.

20. International Data Transfers

ASM is based in the United States and works with athletes, families, and partners around the world. Our service providers store and process information in the United States and other countries. If you use the Services from outside the U.S., your information will be transferred to, stored in, and processed in the U.S. and other countries, whose privacy laws may differ from yours.

When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that is not considered to have adequate protection, we use a lawful transfer mechanism, such as:

• the European Commission's Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs;
• the Swiss-approved form of the SCCs;
• where a recipient is certified, the EU-U.S. Data Privacy Framework, the UK Extension, or the Swiss-U.S. Data Privacy Framework; or
• where none of these apply and the law allows, transfers necessary to perform a contract you asked for (for example, presenting you to U.S. colleges).

ASM is not currently certified under the EU-U.S. Data Privacy Framework. We rely on appropriate transfer mechanisms used by our service providers, which may include Standard Contractual Clauses, where required.

You can ask us for more information about these safeguards, including a copy of the relevant clauses, at privacy@asmsports.co.

21. Your Privacy Rights

Everyone, wherever they live, can:

• access and update most profile and account information in the Portal, or by emailing privacy@asmsports.co;
• ask for a copy of their personal information;
• ask us to correct inaccurate information;
• ask us to delete their account and personal information (Section 24);
• ask us to change profile visibility, including asking us to limit who can see a profile;
• unsubscribe from marketing emails using the link in any email (we will still send service and security messages), and reply STOP to any marketing text;
• withdraw consent they have given, such as permission to feature them on social media; and
• disconnect Google or Apple sign-in.

We will not discriminate against you for using your rights. Depending on where you live, you may have more rights, described in Sections 22 and 23.

22. U.S. State Privacy Rights

22.1 Which laws apply

Several U.S. states have comprehensive privacy laws, including California (the CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Each law applies only to businesses that meet its thresholds, for example annual revenue, the number of state residents whose data is processed, or revenue from selling data. Some laws, such as Texas and Nebraska, apply more broadly to businesses that are not small businesses. Whether or not a particular law applies, we offer the rights below to residents of these states.

22.2 Your rights

Subject to the exceptions in each law, you may have the right to:

• Know and access: the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of recipients;
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Portability: receive your information in a usable format;
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects. We do not do any of these (Section 26);
• Limit the use of sensitive personal information. We use sensitive information only for purposes the law permits without offering this right, such as providing the Services and security;
• Appeal our decision on your request (see Section 24); and
• Not be discriminated against for exercising your rights.

22.3 What we collect (California-style disclosure)

In the last 12 months we have collected these categories of personal information:

We collect this information from the sources in Section 4, for the purposes in Section 6, and keep it for the periods in Section 18. We have not sold or shared personal information in the last 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

22.4 Other California notices

• Shine the Light: we do not disclose personal information to third parties for their own direct marketing.
• Minors' content (Cal. Bus. & Prof. Code § 22581): California users under 18 can ask us to remove content they posted by emailing privacy@asmsports.co. This may not remove content someone else copied or reposted.
• Notice of financial incentive: we do not offer financial incentives in exchange for personal information.

22.5 Nevada

We do not sell covered information as defined under Nevada law. Nevada residents can still send a request to privacy@asmsports.co.

23. EU, UK, and Swiss Privacy Rights

If GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to you, you have the right to:

• Access: get a copy of your personal information and details about how we use it;
• Rectification: have inaccurate or incomplete information corrected;
• Erasure: have your information deleted in certain cases;
• Restriction: ask us to limit how we use your information in certain cases, for example while we check its accuracy;
• Portability: receive information you gave us in a structured, machine-readable format, or have it sent to another organization, where processing is based on consent or contract;
• Objection: object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent at any time, without affecting earlier processing;
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make such decisions); and
• Complain to your local data protection authority. In the EU, this is the supervisory authority in your country of residence, work, or the place of the alleged infringement. In the UK it is the Information Commissioner's Office (ico.org.uk), and in Switzerland the Federal Data Protection and Information Commissioner. We would appreciate the chance to resolve your concern first.

Children's information: in some EU countries the age at which a child can consent to online services is higher than 13, up to 16. For users in those countries we require a parent or guardian's consent below that age.

24. How to Make a Request, and How We Verify It

How to ask.

• Email privacy@asmsports.co with the subject "Privacy Request," saying what you are asking for (including a request to access, correct, download, or delete your information).
• By mail to the address in Section 30.

Deleting your account. You can delete your account by emailing us from your account email with the subject "Delete My Account." After we verify the request, we will delete or de-identify your information within 30 days, except what we must keep (Section 18). Deleting your account removes your Google or Apple sign-in link. We will also take steps to revoke any Apple sign-in token where we are able to do so, and you should revoke ASM's access in your Apple Account settings. Deleting your account does not cancel a Platform Subscription, Verified Profile membership, payment plan, or Separate Agreement on its own. Cancel those as described in our Terms, or say in your deletion request that you also want them cancelled. Information already shared with coaches, institutions, brands, Strategic Capital Partners, or the Foundation at your direction stays in their records and is governed by their policies.

Verification. To protect you, we verify your identity before acting. Usually we confirm that you control the email address on the account (for example, with a verification code). For sensitive requests, such as copies of specific information or deleting a minor's account, we may ask for more information, and we use it only to verify you.

Authorized agents. You may use an authorized agent. We may ask for your signed permission and confirm your identity directly with you, unless the agent holds a valid power of attorney.

Parents and guardians can make requests for a minor as described in Section 9.4.

Timing.

• We confirm receipt of U.S. state requests within 10 business days.
• We respond within 45 days under U.S. state laws, and within one month under GDPR. We may extend this where the law allows (by 45 more days under U.S. laws, or two more months under GDPR) and will tell you why.
• We act on opt-out requests as soon as possible, and within 15 business days.

Fees. Requests are free, unless they are clearly unfounded or excessive. In that case, where the law allows, we may charge a reasonable fee or decline.

Appeals. If we deny your request, we will explain why. You can appeal by replying to our decision with the subject "Privacy Appeal." We will respond within the time the law requires (generally 45 to 60 days). If you are not satisfied, you can contact your state attorney general or data protection authority.

25. Law Enforcement, Safety, and NCMEC Reporting

We may access, keep, and disclose personal information, including messages, if we believe in good faith that doing so is reasonably necessary to:

• comply with a law, regulation, subpoena, court order, or other lawful request;
• protect anyone, especially a minor, from death, serious harm, exploitation, or abuse;
• detect, investigate, and stop fraud, security incidents, or illegal activity; or
• protect the rights, property, or safety of ASM, our users, or the public.

Child safety. If we become aware of apparent child sexual exploitation, we report it to the National Center for Missing & Exploited Children (NCMEC) as required by federal law (18 U.S.C. § 2258A) and preserve the related information as the law requires. We may also notify law enforcement, a coach's institution, or the athlete's parent or guardian.

We review government requests for legal validity, disclose only what is required, and where the law allows, tell affected users unless that would put someone at risk.

26. We Do Not Sell or Share Personal Information

ASM does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not use personal information for targeted advertising. This includes Google and Apple sign-in data, donor information, investor information, and minors' information. We never sell or share the personal information of users we know are under 18, and we do not show them targeted advertising.

Because we do not sell or share personal information for targeted advertising, no opt-out is needed today. You may still send an opt-out request to privacy@asmsports.co. If we receive a Global Privacy Control (GPC) or similar browser signal, we will treat it as an opt-out request where the law requires. If we ever change our practices, we will update this Policy before doing so, ask for consent where required, and provide any opt-out method the law then requires.

27. Third-Party Sites and Services

The Services link to and embed third-party services, such as college and athletics websites, social media platforms, YouTube, Stripe checkout, Google and Apple sign-in, scheduling tools, Strategic Capital Partner websites and deal rooms, and the ASN Foundation. When you use them, their own privacy policies apply. We are not responsible for their practices.

28. Changes to This Policy

We may update this Policy from time to time. We will post the new version here with a new "Last updated" date. If we make a material change, we will tell you in advance by email or in the Portal and, where the law requires, ask for your consent. In particular, we will ask for your consent before using Google or Apple sign-in data in a new way, or using minors' information in a new way. Earlier versions are available on request.

29. How This Policy Relates to Our Terms of Service

This Policy is part of, and governs together with, our Terms of Service. If the Terms and this Policy conflict about how personal information is handled, this Policy controls. To the extent permitted by law, any dispute about this Policy or our handling of personal information is subject to the dispute resolution provisions of the Terms of Service, including individual arbitration, the class action and jury trial waiver, and the Florida governing law and exclusive Palm Beach County, Florida venue provisions. Nothing in this Section limits any right you have under mandatory law, including any right to complain to a data protection authority or a state attorney general, or any privacy right that cannot be waived by contract.

30. Contact Us

Varsity Points Inc. d/b/a ASM Sports Group Attn: Privacy 1700 Palm Beach Lakes Blvd, Suite 810 West Palm Beach, FL 33401, USA

• Privacy requests: privacy@asmsports.co
• Safety and abuse reports: support@asmsports.co
• General support: support@asmsports.co
• EU and UK inquiries: privacy@asmsports.co (ASM has not appointed a local Article 27 representative)