BLeachr privacy policy

Last revised: July, 2019

1. General

BLEACHR is committed to respecting your privacy and personal information. This Privacy Policy

sets out how Bleachr LLC (“BLEACHR”, “we”, “us”, “our”) collects, stores, uses, and shares your

personal information.

This Privacy Policy applies to any personal information that BLEACHR collects and processes:

+ via the BLEACHR powered TennisONE branded, tournament partner mobile application

software (“App”), which you have downloaded and installed on your device, and on which

this Privacy Policy is published; and

+ via other interactions you have with us in connection with the App including phone or online

support and online or offline correspondence.

BLEACHR has partnered with tennis tournament organizations (“Tournament Organizer”) to

provide the App to users in connection with their tournament. Accordingly, Tournament Organizer

has access to the same information as BLEACHR under this Privacy Policy. This Privacy Policy

governs BLEACHR’s use of your personal information only. We strongly encourage you to

review Tournament Organizer’s privacy policy available on its website.

We refer to the App as the “Services”. This Privacy Policy also contains additional information

which applies to European users only. “European users” are individual users based in in the

European Economic Area (“EEA”), the UK, and Switzerland. Other privacy policies, as notified to

you, may apply if you use other products or services we provide.

By using our Services, you agree to the collection, use and sharing of your personal information as set

forth in this Privacy Policy. If you do not agree to the terms of this Privacy Policy, you may not

access or use the Services.

We may update our Privacy Policy to reflect changes to our information practices. If we do this and

the changes are material, we will post a notice that we have made changes to this Privacy Policy on

the Services for a reasonable period prior to implementing the changes, and we will indicate the date

these terms were last revised at the top of the Privacy Policy. Any revisions to this Privacy Policy will

become effective on the date stated in the notice.

Additional information for European users

Bleachr LLC, a company registered at 250 Park Ave, Minneapolis, MN 55415, United States of

America is the data controller for the purposes of the EU General Data Protection Regulation (GDPR)

and any relevant local legislation. We have appointed a Privacy Officer who can be contacted using

the contact details below (Contact Us).

As explained above, BLEACHR has partnered with Tournament Organizer to provide the App to

users and Tournament Organizer has access to the same information as BLEACHR under this Privacy

Policy. Tournament Organizer is also a data controller of the personal information collected via the

App for the purposes of the GDPR and any relevant local legislation. This Privacy Policy addresses

BLEACHR’s use of your personal information only. We strongly encourage you to review

Tournament Organizer’s privacy policy available on its website.

US.123839384.02

BLEACHR and Tournament Organizer have implemented appropriate contractual terms that ensure

that your personal information is protected in accordance with the requirements of the GDPR and any

relevant local legislation. Any questions regarding Tournament Organizer’s processing of your

personal information should be directed to the Tournament Organizer.

By using the Services, you acknowledge our collection, use and sharing of your personal

information as set forth in the relevant sections of this Privacy Policy. You also acknowledge

that by providing your personal information through the Services your personal information is

transferred to and accessed by our personnel in the United States. If you do not wish for your

personal information to be used in the manner set out in this Privacy Policy or transferred to

the United States, you should not access or use the Services.

2. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Privacy Officer, Bleachr LLC, 250 Park Ave, Minneapolis, MN 55415 or by emailing to

questions@bleachr.co.

3. Information We Collect

We collect, use, store and transfer different kinds of personal information about you, which we have

summarised below:

§ Account and transaction data (to the extent that it is provided by you), including name,

email address, telephone number, order details and in-App spending/transactions, user name.

§ Content and Activity data, including if you submit content to the Services such as your

posts, comments, profile/avatar photo, video, audio, and your engagement activity with in-

App fan features, how you use the Services and which features and areas you have accessed

or engaged with, reward points earned, purchases made and the advertisements you viewed

while using the App.

§ Communications data, for example any information which you choose to provide to us

when you communicate with us or receive customer support.

§ Device and technical data, such as your browser type, operating system, and your IP address

(a unique address that identifies your computer on the Internet), the full URL clickstream (i.e.

where you have come from on the internet and where you go to, date and time) when you

enter our Website or your device type, operating system, a random ID associated with the

App release number, the App Installation ID (which is a random installation ID number

generated by your device when the App is installed) and your IP address when you use the

App.

§ Location data, i.e. the geolocation of your phone on an anonymous basis so as to know when

to provide location-based features at an event such as participation in fan-stream and fan

challenges.

§ Information from social networking sites (SNS), which includes data we receive if you

connect your account with log in via a SNS, for example, Facebook. If you log in to our

Services via Facebook, we receive certain personal information from your SNS account: full

name, e-mail address, and your Facebook login ID. You can revoke our future access to the

information you provide to us through your SNS by amending the settings within your SNS

account.

US.123839384.02

§ Marketing data, including your preferences in receiving marketing from us and our any

relevant third parties, such as the Tournament Organizer, to which you have expressly

consented, your responses to research and survey questions which we ask through the

Services or through in-booth surveys at events which we attend, and your engagement with

our marketing communications.

Aggregated or Anonymized Information

We also collect, use and share aggregated or anonymized data such as statistical or demographic data

for any purpose. Aggregated or anonymized data could be derived from your personal information but

is not considered personal information in law as this data will not directly or indirectly reveal your

identity. If we combine or connect aggregated data with your personal information so that it can

directly or indirectly identify you, we treat the combined data as personal information which will be

used in accordance with this Privacy Policy.

We do not collect any sensitive personal information about you (such as details about your race or

ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union

membership, information about your health, and genetic and biometric data).

4. How We Collect Information

We collect personal information:

(a) directly from you (for example, when you download the App and/or set-up an App account);

(b) through automated technologies and interactions (for example, as you interact with and use

our Services); and

(c) from third party marketing analytics service providers, website analysis firms, or search

information providers, such as data aggregators.

5. How We Use Information

We only use your personal information when the law allows us to do so. We use your personal

information for the following purposes:

§ To provide the Services and fulfil any orders you make using the Services.

§ To provide you with additional features on the Services based on your location, including

allowing you to interact with other users of the Services at events.

§ To respond to your enquiries.

§ To send you marketing communications (in accordance with your preferences).

§ To send you transactional and administrative messages related to the Services.

§ To keep the Services safe and secure.

§ To comply with our legal and regulatory obligations.

§ To improve the Services and develop new services.

§ To create insights and market intelligence (on an aggregated and non-personally identifiable

basis) through analysing the use of our Services and our user base.

§ To personalize the Services and provide content and features that match your interests.

§ To provide advertisements and monitor their effectiveness.

§ For any other purpose notified to you within the Services.

US.123839384.02

Advertisements on the Services

We do not use targeting or advertising cookies or similar tracking technologies on the Services to

track your browsing behaviour outside the Services. Furthermore, advertisements on the Services are

not based on online behavioural advertising techniques – i.e. techniques allowing the collection of

data on web browsing behaviours over time and across non-affiliate websites to predict user

preferences and interests to deliver advertising based on those preferences or interests – and we do not

cooperate with third party advertising networks to serve such advertisements to you. Among other

factors, advertisements are served based on your general location (e.g. Europe vs North America) or,

with any consent necessary under applicable law, your specific geolocation. Where our advertising

practices change, we will notify you and seek any necessary consents.

Additional information for European users

For European users, we rely on the following legal grounds for processing your personal information:

Processing Purpose Legal Basis to Process your Personal Information

Provide the Services and fulfil any

orders you make using the Services

To perform our contract with you to provide the Services and

fulfil your orders.

Provide you with additional features

on the Services based on your

location, including allowing you to

interact with other users of the

Services at events

Your consent.

Respond to your enquiries Where your enquiry relates to a specific aspect of the Services:

to perform our contract with you and to provide our Services.

Alternatively, our legitimate interests in providing high quality

customer service and responding to enquiries posed to us.

Send marketing communications Your consent.

Send you transactional and

administrative communications

related to the Services and/or your

orders

To comply with a legal or regulatory obligation, and/or our

legitimate interests in efficiently fulfilling our legal and

contractual duties (including in jurisdictions other than that in

which you reside), keeping you informed about important

Service updates (such as scheduled maintenance or security

updates) security, and providing high quality customer service.

To keep the Services safe and secure To comply with a legal or regulatory obligation and/or our

legitimate interests in ensuring the security of the Services,

preventing fraud, and creating and maintaining positive, safe

and friendly space for user interaction.

Comply with our legal and

regulatory obligations and protect

our legal and commercial interests

To comply with a legal or regulatory obligation and/or our

legitimate interests in efficiently fulfilling our legal and

contractual duties (including in jurisdictions other than that in

which you reside), protecting our corporate image and brand,

managing legal risk, and complying with regulations that apply

to us.

Improve the Services and develop of

new services

Our legitimate interests in providing high quality products and

services, keeping our existing user base engaged with our

US.123839384.02

Services, expanding our user base and attracting new users,

creating new and distinctive services for an identified market

niche.

To the extent this involves storing information on your device

such as cookies or other similar web technologies, your consent.

Create insights and market

intelligence (on an aggregated and

non-personally identifiable basis)

through analysing the use our

Services and our user base

Our legitimate interests in growing our business, informing

marketing strategies and defining types of customers for new

products and services.

Personalize the Services and provide

content and features that match your

interests

Our legitimate interests in developing the Services, keeping

content and features relevant, keeping users engaged with the

Services, and growing our business.

To the extent this involves storing information on your device

such as cookies or other similar web technologies, your consent.

To provide advertisements and

monitor their effectiveness

Our legitimate interests in growing our business, informing

marketing strategies and defining types of customers for new

products and services.

6. Automated interactions and web technologies

While we do not use cookies on the App, we do use App Installation IDs to recognize you. We use the

App Installation ID and mobile analytics software to allow us to better understand the functionality of

the App on your phone. The software may record information such as how often you use the App, the

activity that occurs within the App, aggregated usage, performance data, and where the App was

downloaded from.

BLEACHR also uses web beacons (also called single-pixel gifs), which are customized links or

similar technologies, when sending you messages, newsletters, or promotional emails. Web beacons

allow BLEACHR to (a) determine whether you have opened, or acted upon, a promotional email and

which links you have clicked on in order to deliver to you more focused communications and other

content, (b) allow BLEACHR to count the number of users who have visited certain web pages and

(c) enable BLEACHR to compile aggregated statistics and determine the efficacy of promotions.

7. Sharing information

BLEACHR shares your personal information only when it is necessary to offer the Services, legally

required, or permitted by you. We share personal information with third parties as follows:

§ Tournament Organizer: BLEACHR has partnered with Tournament Organizer to provide

the App to users in connection with their tennis tournament. Accordingly, Tournament

Organizer has access to the same information as BLEACHR under this Privacy Policy. As a

result, Tournament Organizer is also a data controller of the personal information collected

via the App for the purposes of the GDPR and any relevant local legislation.

§ Service providers: We share personal information to third party service providers to help us

bring you the Services. For example, we use Amazon Web Services as a hosting provider,

Heroku as a platform provider. We also use Branch.io for our text-a-ticket feature. These

parties act as our data processors. They have access to personal information for a limited

US.123839384.02

purpose and limited period of time and we implement contractual protections limiting the use

of that personal information to the provision of services to BLEACHR.

§ With linked services such as social networking sites: If you link your account with a third-

party service, we share the information you authorize with that third-party service. If you log

in to the Services using Facebook, Facebook directly collects information about your use of

the Services. We also offer social sharing features that let you share content or actions you

take on our Services with other media. Your use of these features enables the sharing of

certain information with your friends or the public, depending on the settings you establish

with the third party that provides the social sharing feature.

§ Other users of our Services or users of other platforms: When you submit content (such as

a post or comment) to the Services or decide to share a post to other, another platform, any

visitors to and users of our Services or those platforms will be able to see that content. When

other users view your profile or your posts to our fan stream, they will also be able to see

information about you, your activities on the Services, and share this information on other

media. Accordingly, you should always use your best judgement when providing and sharing

information on the Services or any other platform.

§ In connection with business transfers: If we sell, transfer or merge parts of our business or

our assets, we share information with the purchaser of that business/those assets.

Alternatively, we may seek to acquire other businesses or merge with them. If a change

happens to our business, your personal information would remain subject to this Privacy

Policy.

§ In connection with compliance with laws and the protection of our rights and the rights

of others: We will be required to access and disclose personal information in response to

lawful requests, such as subpoenas or court orders, or in compliance with applicable laws.

Additionally, we will access and share account or other personal information when we believe

it is necessary to comply with law, to protect our interests or property, to prevent fraud or

other illegal activity perpetrated through the Services, or to prevent imminent harm. This will

include accessing and sharing personal information with other companies, professional

advisors (such as lawyers, auditors and insurers), agents or government agencies, or law

enforcement authorities.

We share information about you that has been aggregated or anonymized, including activity data (see

above), such that it cannot reasonably be used to identify you in any way for any lawful business

purpose.

8. How Long We Retain Information

We only retain your personal information for as long as necessary to fulfil the purposes for which it

was collected, including for the purposes of satisfying legal, accounting, or reporting requirements.

Additional information for European users

Within no more than 60 days of the end of the tournament, we delete or anonymize your personal

information. Where you choose to terminate your account, we delete or anonymize your personal

information within no more than 60 days. We delete or anonymize marketing data when you

unsubscribe or after a maximum of 3 years where you have not engaged with our marketing

communications for this period.

US.123839384.02

In some circumstances we may anonymize your personal information (so that it can no longer be

associated with you) in which case we may use this information indefinitely without further notice to

you.

9. Securing Information

We have implemented technical and organizational measures we consider appropriate to protect the

confidentiality, integrity and availability of your personal information. However, we cannot guarantee

that our safeguards will never be defeated, and information disclosed in a manner inconsistent with

this Privacy Policy (for example, because of unauthorized acts by third parties that violate applicable

law).

10. International Transfers

We are based in the United States and so information is transferred to and accessed by our personnel

in the United States. By using the Services, you consent to the processing, transfer and storage of your

information in and to the United States and other countries, where you may not have the same rights

as you do under your local law. We will process your personal information in accordance with

applicable law and with this Privacy Policy regardless of where your personal information is stored or

accessed.

By providing your personal information through the Services you acknowledge that your personal

information is transferred to and accessed by our personnel in the United States.

Additional information for European users

Where our service providers or other third parties (identified above) based outside the European

Economic Area receive personal information, we ensure the transfer is either (a) to a country deemed

to provide an adequate level of protection by the European Commission, (b) pursuant to specific

contracts approved by the European Commission, or (c) for transfers to the US, pursuant to that third

party’s certification to the Privacy Shield. Please contact us using the contact details above (Contact

Us) if you want further information on the specific mechanism used by us when transferring your

personal information out of the EEA or Switzerland.

11. Accessing and Correcting Your Personal Information; Your Rights

We will comply with any rights provided to you under applicable law. In addition, you can review and

change your personal information by logging into the App and visiting your account profile page.

You may also send us an email at questions@bleachr.co to request access to, correct, or delete any

personal information that you have provided to us. We cannot delete your personal information except

by also deleting your user account. We may not accommodate a request to change information if

believe the change would violate any law or legal requirement or cause the information to be

incorrect.

Additional information for European users

If you are a European user, you have the following rights in relation to the personal information we

hold about you, unless provided otherwise by relevant local legislation:

• Request access to your personal information.

• Request correction of your personal information.

• Request erasure of your personal information.

• Object to processing of your personal information.

US.123839384.02

• Request restriction of processing your personal information.

• Request transfer of your personal information.

• Right to withdraw consent (where we rely on your consent as our basis for processing).

Please note that some of these rights are not absolute and we may refuse a request to exercise

particular rights, but we will keep you informed as to the actions that we can take when you make

your request. We try to respond to all legitimate requests within one month, although we will notify

you if it will take longer, or as required by applicable law.

You have the right to make a complaint at any time to your supervisory authority for data protection

issues. A list of supervisory authorities is available here: http://ec.europa.eu/justice/data-

protection/bodies/authorities/index_en.htm. If you need further assistance regarding your rights,

please contact us using the contact details above (Contact Us).

12. Marketing

In relation to marketing communications, we will provide you with an “opt in” or “opt out”

mechanism depending on where you are located when we collect your personal information. An “opt

in” mechanism will provide you the opportunity to positively indicate that you would like to receive

our marketing communications and we will not send you any unless you have “opted in”. An “opt

out” mechanism (e.g., “unsubscribe”) will provide you the opportunity to indicate that you do not

want us to send you such communications, and if you “opt out” we will not send you any.

You may opt out of marketing-related emails by clicking on a link at the bottom of each such email,

or by contacting us using the contact details above (Contact Us). You may continue to receive service-

related and other non-marketing emails.

We will get your express opt-in consent before we share your personal information with any third

party for marketing purposes.

13. Children

Our Services are not intended for or directed to children under the age of 13 and so BLEACHR does

not knowingly collect personal information from anyone under the age of 13. If you are a parent or

guardian and become aware that your child has provided us with personal information without your

consent, please contact us using the contact details above (Contact Us).

Additional information for European users

In addition, we may limit how we collect, use and store some of the information of European users

between 13 and 16. In some cases, this means we will be unable to provide certain functionality to

these users. If we need to rely on consent as a legal basis for processing your information and your

country requires consent from a parent, we will require your parent’s consent before we collect and

use that information.

14. Third party links

The Services may contain links to other websites. We are not responsible for the privacy practices of

other websites. We encourage users to read the privacy statements of other websites that collect

personal information. This Privacy Policy applies only to information collected by BLEACHR via the

Services.