This privacy policy (“Privacy Policy”) describes how Pixellot Ltd. (collectively with its affiliated companies shall be referred to herein as the “Company”, “we”, “us” or “our”) collects, uses and discloses certain information, including Personal Data (as defined below) and the choices you can make about such information.

This Privacy Policy governs the processing and transfer of Personal Data, directly or indirectly, when using the Company’s AI-automated sports camera, streaming, broadcasting and analytic services, video analysis platform, video editing platform, etc. (“Services”), visiting the Company website or other landing pages and the content therein (“Website”), or when applying for an open position published on the Website (“Applicant”). Unless otherwise stated herein, customers, prospects, visitors and Applicants shall be separately and collectively referred to as “you” or “your”.

The Website, hardware (i.e., cameras), software and platforms shall all collectively be referred to as “Company Properties”.

This Privacy Policy is an integral part of the terms and conditions governing any use of the Website, apps or hardware, as well as any agreement executed between us governing the use of the Services or interaction with the Company’s Properties (“Terms”). Capitalised terms not defined herein shall have the meaning ascribed to them in the Terms.

Note you are not required by law to provide us with any Personal Data. Sharing Personal Data with us is entirely voluntary, save where provision of certain information (e.g. team or player registration data) is a condition of participating in a competition or program administered by one of our customers.

This Privacy Policy applies to all individuals in applicable territories; however, certain territories require certain disclosures to be provided in a certain way and format — meaning we do not process information differently, but there may be differences in the disclosures, as follows:

Additional Information to California Residents: In the event you are a California resident, please also review our Privacy Notice to learn more about our privacy practices with respect to the California Consumer Privacy Act.

Additional Notice to Colorado, Virginia, Connecticut or Utah Residents: In the event you are a resident of one of these US states, please also review Section 12 below “Jurisdiction-Specific Notices” to learn more about our privacy practices and your rights under the privacy and data protection legislation which applies in these states.

Additional Notice to Australian Residents: In the event you are located in Australia, please also review Section 12(E) below “Additional Information for Australian Residents” to learn about our privacy practices and your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

1. AMENDMENTS

We reserve the right to amend this Privacy Policy from time to time, at our sole discretion. The most recent version of this Privacy Policy will always be posted on the Website and the update date will be reflected in the “Last Amended” heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Privacy Policy will become effective immediately, unless we notify otherwise. We recommend you review this Privacy Policy periodically to ensure that you understand our most updated privacy practices.

2. CONTACT INFORMATION AND DATA CONTROLLER INFORMATION

Pixellot Ltd., incorporated under the laws of the State of Israel, is the Controller (as defined under applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”)) of the Personal Data it collects in its own right. Where Services are provided in Australia, they are delivered by our local affiliate, Pixellot AU Pty Ltd (ABN 81 694 314 326), which contracts directly with Australian customers under its standard licence terms; Pixellot Ltd remains the ultimate parent company and may process Personal Data on a group-wide basis as described in this Privacy Policy. References to the “Company” include Pixellot AU Pty Ltd where the context relates to Services delivered in Australia.

Where the Company processes Content, Athlete Data or Video Footage on behalf of a customer for the purpose of providing the Services, it does so as a processor / service provider, acting on that customer’s instructions, and subject to the usage rights described in Section 3 and Section 13 that the Company retains under its standard licence terms with customers.

For any question, inquiry or concern related to this Privacy Policy or the processing of your Personal Data, you may contact:

The Company’s Data Protection Officer (“DPO”): Mr. Eran Gutman By email: [DPO email] By mail: Granit 11 St. Petach-Tikva, Israel.

For privacy enquiries from Australia, you may also contact the Company’s designated Australian privacy contact at [ANZ Privacy Contact email].

3. DATA PROCESSED BY THE COMPANY

We may collect two types of information from you, depending on your interaction with us.

The first type is non-identifiable and anonymous information (“Non-Personal Data”). We are not aware of the identity of the individual from whom we have collected Non-Personal Data. Non-Personal Data gathered consists of technical information and may include the type of operating system, type of device, time and date accessed the Service, language preference, screen resolution, or aggregated data and insights that do not personally identify an individual.

The second type is individually identifiable information — information that identifies an individual or may with reasonable effort identify an individual (“Personal Data” or “Personal Information” as defined under applicable data protection law).

For the avoidance of doubt, any Non-Personal Data connected or linked to Personal Data shall be deemed Personal Data for as long as such connection or linkage exists.

Player identification and video content: Our Services capture video footage that may include Personal Data or Sensitive Data, such as players’ and spectators’ faces (including children), movement and physical shape, and, where provided, names and Contact Information. The Company does not use facial recognition or other biometric identification technology to identify individuals within this footage. Instead, where player-level identification is required for features such as highlights, clipping, tagging or statistics, this is performed using non-biometric methods — principally matching an on-court jersey or squad number against team or competition registration data supplied by the customer or its designated registration/competition-management system. No biometric templates are created, stored, or matched against any individual’s likeness.

We will not sell, lease, trade or otherwise profit from Personal Data that constitutes Special Categories of Personal Data (such as data revealing health, biometric or similar sensitive attributes), nor will any of our vendors, service providers or partners who have access to such data be permitted to do so.

Aggregated and de-identified data: In the course of providing the Services, information and data relating to a customer’s use of the Services (including layout, functions and processes carried out on the platform, referred to in our customer agreements as “Content”) may be transmitted to us. We may derive aggregated, statistical information and insights from Content, including data that does not identify a customer, individual or organisation and cannot reasonably be traced back to them (“Crowdsourced Data”). We may use Crowdsourced Data, together with any feedback, suggestions or feature requests you provide us (“Feedback”), for any purpose, including to operate, maintain, improve and develop the Services and other products, for research and testing, and for commercial purposes, consistent with our standard customer agreements. Because this data does not identify you, no separate remuneration is payable to you or the customer for this use.

Promotional clips: Under our standard customer agreements, we retain a limited, non-exclusive right to extract a small number of short-form video clips (in each case, no more than two clips per event, of no more than 20 seconds each) from footage captured through the Services, for the purpose of promoting the relevant sport, the customer, or the Company (for example, on our website, apps, social media or marketing materials). We will exclude any individual from such clips who has been identified, through privacy settings enabled on or in connection with the Services, as a participant whose image or data is not to be used, shared or published — using the same non-biometric matching described above, not facial recognition. Customers and participants can find out how to configure these settings by contacting us or their organisation.

The table below details the types of Personal Data we process, the purpose, lawful basis, and our processing operations:

Please note that the actual processing operation per purpose and lawful basis in the table above may differ. Such processing usually includes a set of operations by automated means, such as collection, storage, use, disclosure by transmission, erasure or destruction. Transfer of Personal Data to third-party countries, as detailed in Section 10 below, is based on the same lawful basis stipulated above.

We may also use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity theft and other misuse of the Services, to enforce the Terms, to protect the security and integrity of our databases and Services, and to take precautions against legal liability, based on our legitimate interests.

4. HOW WE COLLECT INFORMATION

Depending on the nature of your interaction with us, we may collect the above information as follows:

• Information you provide us directly — e.g. when you register, create an account, or correspond with us.
• Information we receive from third parties — e.g. Contact or registration data received directly from our customers, or from a registration/competition-management platform on their instruction.
• Information we receive automatically — Online Identifiers and Usage Data, including analytics, collected automatically or via third-party measurement and marketing tools. See Section 5 “Cookies & Tracking Technologies”.

5. COOKIES & TRACKING TECHNOLOGIES

We use “cookies”, Software Developer Kits (“SDKs”) and similar tracking technologies when you access the Company’s Properties or interact with the Services. A “cookie” is a small piece of information a website assigns and stores on your device while you view a website. Cookies can be used for various purposes, including efficient page navigation, statistical purposes and advertising.

You can find more information about our use of cookies under our Cookie Policy, and change your settings and preferences at any time via the Cookie Settings tool available on the Company’s Properties footer.

6. SHARING DATA WITH THIRD PARTIES

We share your Personal Data with third parties, including service providers that help us provide the Services. The table below describes categories of recipients:

7. YOUR RIGHTS

We acknowledge that different people have different privacy concerns and preferences. Our goal is to be clear about what information we collect so you can make meaningful choices. Depending on your relationship with us, your jurisdiction and applicable law, you may have the following rights:

If you wish to exercise any of your rights, contact us via our Data Subject Request form. If your data was captured through a customer’s program (e.g. a club, league, association or venue), you may also raise your request with that customer, who can coordinate with us directly.

8. DATA RETENTION

We retain Personal Data for as long as necessary for the purposes set out above, in accordance with applicable law, or until you opt out. We may retain data for longer where required for legal, regulatory, tax or accounting purposes, to maintain accurate records in the event of complaints, or where we reasonably believe there is a prospect of litigation. Except as required by law, we may delete or amend information at our sole discretion once it is no longer necessary.

Video footage and highlights are retained in line with the retention period agreed with the relevant customer, and are deleted or de-identified once no longer required for the applicable season or program, or upon a valid removal request.

9. SECURITY

We design our Services with your security and privacy in mind, and have implemented physical, technical and administrative security measures compliant with applicable laws and industry standards.

Please contact us if you feel your privacy was not properly handled, in breach of this Privacy Policy, or if you become aware of unauthorised third-party access attempts. We will make reasonable efforts to notify you and the appropriate authorities, where required by applicable law, in the event of a security incident affecting your Personal Data — including, where the Privacy Act 1988 (Cth) applies, notification to the OAIC and affected individuals under the Notifiable Data Breaches scheme.

10. DATA TRANSFER

Your Personal Data is processed and stored by the Company and other entities, service providers and legal authorities as detailed above, and may therefore be transferred to jurisdictions other than the one from which you accessed our Services, where it may be accessed by courts, law enforcement and national security authorities. We take appropriate measures to ensure adequate protection on transfer. Where Personal Data collected within the EEA is transferred outside the EEA, we do so under the Standard Contractual Clauses approved by the European Union (“SCCs”); following Brexit, transfers from the EEA to the UK are also subject to SCCs or equivalent contractual protections (pending an adequacy decision).

Australian data residency: For video footage, highlights and associated Personal Data captured in Australia, the Company hosts and stores such data on Australian-based infrastructure by default. To the extent any component of the Service involves processing or storage on overseas infrastructure (e.g. back-office systems, disaster recovery, or specific processing not available in Australia), the Company will, on request: (a) disclose the specific country/countries involved; (b) ensure the overseas recipient is bound by contractual obligations equivalent to the Australian Privacy Principles (APP 8.1), or that another APP 8.2 exception applies; and (c) apply appropriate technical and organisational safeguards (encryption in transit and at rest, access controls, and data minimisation).

11. CHILDREN

The Company’s general Website is intended for a general audience and is not directed to individuals under 18. Where a customer’s data subjects (e.g. athletes) are minors, the customer must obtain any consent required by applicable law prior to use of the Services, and the Company will not knowingly contact or engage with children under 18 without such consent.

Recognising that a substantial proportion of participants captured by the Services in community and junior sport are minors, the Company applies the following measures across its Services:

• No facial recognition or biometric identification is applied to any participant, adult or child (see Section 3);
• Player attribution uses non-biometric jersey- or squad-number matching linked to registration data supplied by the customer, not independent identification of a child’s face or likeness;
• Consent and notice to parents/guardians of minors is coordinated through the customer’s own registration and member protection processes, rather than being collected directly by the Company;
• Requests to remove footage or images of a minor are treated as priority requests and actioned promptly on notice from the customer or the parent/guardian; and
• The Company maintains escalation and incident-management processes to respond to any child-safety concern involving captured footage, and will cooperate with a customer’s own safeguarding processes where relevant.

If you have reason to believe a child has provided us with Personal Data other than as described above, please contact us and we will endeavour to delete that Personal Data from our databases.

12. JURISDICTION-SPECIFIC NOTICES

1. Additional Information for Colorado Residents

(unchanged from the original Privacy Policy — see Section 12(A))

1. Additional Information for Connecticut Residents

(unchanged from the original Privacy Policy — see Section 12(B))

1. Additional Information for Virginia Residents

(unchanged from the original Privacy Policy — see Section 12(C))

1. Additional Information for Utah Residents

(unchanged from the original Privacy Policy — see Section 12(D))

1. Additional Information for Australian Residents (New)

This section applies to individuals located in Australia.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), we:

• Collect only the Personal Data reasonably necessary for the Services (APP 3), and do not collect facial recognition or biometric identifiers (see Section 3 and Section 11);
• Do not use or disclose Personal Data for a purpose other than the primary purpose for which it was collected, unless an APP 6 exception applies or you consent;
• Will disclose to you, on request, the countries in which overseas recipients of your Personal Data are likely to be located (APP 8), and store data captured in Australia on Australian infrastructure by default, as described in Section 10;
• Take reasonable steps to keep Personal Data accurate, complete and up to date (APP 10), and secure against misuse, interference, loss, and unauthorised access, modification or disclosure (APP 11);
• Provide access to, and allow correction of, your Personal Data on request (APPs 12–13), free of charge in most circumstances; and
• Will notify affected individuals and the OAIC of an eligible data breach in accordance with the Notifiable Data Breaches scheme.

Making a request or complaint: You may contact the Company’s Australian privacy contact (Section 2) to make an access, correction or deletion request, or to raise a concern. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

We will acknowledge requests promptly and aim to respond within 30 days, consistent with OAIC guidance, and will explain the reasons if we are unable to comply with a request in full.

13. CONTENT, LICENSING AND COMMERCIALISATION

This section explains how footage and other content captured through the Services is used, and how that interacts with your organisation’s own rights.

• Role of the Company: The Company provides the Services under licence to each customer. The Company does not sell any hardware, software or platform to the customer, and no transfer of ownership in the System, Software or underlying technology occurs. Where a customer’s agreement addresses ownership of the video footage and content it generates, that arrangement governs as between the Company and that customer.
• Distribution: Content is distributed to the platforms the customer designates (which may include competition-management, officiating, coaching, case-management or fan-facing platforms), as instructed by the customer, and in accordance with the distribution arrangements set out in the applicable agreement.
• Rights the Company retains: Regardless of how content ownership is allocated between the Company and a customer, the Company retains, under its standard customer agreements: (i) the right to derive and use Crowdsourced Data and Feedback as described in Section 3; and (ii) a limited right to extract and publish short-form promotional clips as described in Section 3, subject to individual opt-outs. These retained rights do not extend to selling, leasing or otherwise commercialising identifiable Personal Data, and any use of Crowdsourced Data does not identify a customer, individual or organisation.
• Broadcasting and consents: Except for the rights described above, the Company does not grant or hold any broadcasting rights in content generated through the Services. Each customer is responsible for obtaining and maintaining all consents, releases and permissions from participants (including in relation to broadcasting, publicity, and personal data rights) needed to lawfully capture, retain, edit and distribute their content, including any content shared with the Company.
• Privacy and data requests: Requests concerning PII or content removal (including under Section 7 and Section 11) will be handled in coordination with the relevant customer to ensure removal is reflected consistently across all integrated platforms, subject to the Company’s retained rights described above.