Privacy Policy

Introduction

Welcome to GameDay, a web-based software toolset for athletes, parents, coaches, managers, volunteers, club presidents, tournament directors, and state and national bodies operated by GameDay (“GameDay,” “we,” “our,” or “us”). GameDay owns and operates the following websites, applications, services and tools (collectively, our “Service” or “Services”).

GameDay (Stack Sports Australia Pty Limited trading as GameDay) is a wholly owned subsidiary of Stack Sports. We provide products throughout Australia/APAC and UK/EMEA under the following brands:

GameDay™, GameDay powered by Stack Sports™, GameDay Passport™ and GameDay Classic™

GameDay is committed to protecting your privacy and to treating your personal information as you would want it to be treated. This Privacy Policy explains how we collect, use, disclose and protect your personal information. GameDay complies with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and, where applicable, the EU General Data Protection Regulation (GDPR).

GameDay as a Data Controller and Data Processor

The scope of GameDay’s responsibilities for protection of personal data depends on whether we are acting as a “data controller” or a “data processor” with respect to a particular set of processing operations. Data controllers determine what personal data is collected, the purpose of that data collection, and the means, while data processors assist them to complete these tasks efficiently. Under the laws of many countries, including Australia’s Privacy Act 1988 (Cth) and the EU GDPR, data controllers bear primary responsibility for compliance with data protection laws and for respecting the privacy rights of individuals.

In providing our Services, GameDay acts variously as a data controller, a data processor, or both.

Institutional Users, End Users or Direct Users

Some of our Services are intended for use by organisations such as national governing bodies, sports clubs, and teams (“Institutional Users”). For those Services, it is the Institutional User which, as the data controller, collects and determines the purpose(s) for processing of personal data of athletes, coaches, fans, or other individuals (“End Users”). GameDay’s role as data processor is to provide Institutional Users with the functionalities of the particular Service using the personal data made available or shared by the Institutional User.

Every Institutional User will process and store personal information in different ways, and this Privacy Policy cannot and is not intended to cover each of them. End Users with questions or wishing to exercise their privacy rights with respect to personal data processed by GameDay on behalf of Institutional Users should review the privacy policies Institutional Users have prepared and address inquiries to them. Nevertheless, in order to provide End Users with supplementary information and transparency, this Privacy Policy describes in general terms our data processing practices across all of our Services, regardless of whether or not we act as data controller.

GameDay also makes some of its Services available directly to individual athletes, parents, coaches, and team managers (“Direct Users”). For example, Direct Users may create personal accounts with one or more of our Services which require them to disclose personal information in order to function properly. Finally, GameDay may use personal data provided by Institutional Users for purposes other than those determined by the Institutional Users. In these contexts, GameDay acts as a data controller and the terms of this Privacy Policy, including with respect to the exercise of data privacy rights, are fully applicable.

GameDay Use of Information

What information does GameDay collect?

We collect or are provided access to a variety of personal information about our End Users and Direct Users so that we can provide our Services. Personal information means any information about an individual from which that person can be identified. It does not include data where the identifying information has been removed (anonymous data).

We do our best to be as transparent as possible about our data practices and how we may collect, use, store, and transfer your personal information.

The categories of information we collect can include:

Identity information: Collected for registration and profile information when Direct Users join a Service, or provided by Institutional Users. Identity information may include username, first and last name, birthdate, phone number, email address, and other contact information required to register for a GameDay account, participate in a GameDay promotion or contest, or to correspond with us.

Financial information: We may collect billing information to provide our premium Services, or process billing information on behalf of our Institutional Users.

Profile information: Data collected through the use of our Service. For Direct Users, after you set up your account, you may be able to provide additional information which may be shared through your profile, such as your height, weight, photograph and/or video and other biographical or personal information (“Profile Information”), and information about your athletic performance or information relating to your team, league, or organisation. This information may be provided by a third party, such as a parent, association administrator, league administrator, team administrator, coach, or tournament director (subject to your consent), or it may be provided by you directly (collectively, “Persons with Authority”). Persons with Authority may provide information about the club, league or team you play on as well as biographical and contact information, notes and commentary related to your activities. We also collect information about how you use our Service and the data you input.

Contact information: GameDay may collect information from an address book or stored contact list that a Direct User uploads or otherwise provides access to GameDay.

Information from third parties: GameDay may collect information about Direct Users and End Users from publicly available sources or other third parties, including Institutional Users, such as your tournament schedule, team name, ranking, player statistics, etc. GameDay may also receive information about you when you interact with our sites through various social media. The data we receive is dependent upon your privacy settings with the social network. You should always review, and if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to the GameDay Service.

User activity: GameDay may at our discretion, but are not obligated to, monitor the communications that take place on our Service, such as messaging, in order to protect our Direct Users and monitor the effectiveness of our Service. You acknowledge that you have no expectation of privacy with respect to any such communications or postings, and you expressly consent to such monitoring.

Online tracking information: GameDay automatically collects certain types of usage information when you visit our website or use our Service. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites. Please see our cookie policy below for further details.

How does GameDay use your personal information?

We use your personal information to operate, maintain, and provide to you the features of our Service, including to communicate with you. The use of your personal information is fully in accordance with:

• The contract we are about to enter into or have entered into with you;

• Our necessary and legitimate interests (or those of a third party) in the provision of our Service, provided that your interests and fundamental rights do not override those interests;

• Our effort to comply with applicable laws and regulations.

Please contact us at [email protected] to find out more about the types of lawful basis that we will rely on to process your personal data.

What are the purposes for GameDay’s applications’ use of your personal information?

Service and intended user

Purpose / Activity

Personal Information

Lawful basis for processing

GameDay Australia brands for Institutional Users

Club and league membership registration tools;

Event management tools;

Communication tools;

Ecommerce tools;

Invoicing and payment;

Marketing to End Users;

Tools to store, index and organise video footage from athletic events for distribution to End Users.

Identity information;

Profile information;

Contact information;

Payment information;

Health information.

Varies for each Institutional User.

Personal Information is only shared with third parties subject to End Users’ affirmative consent.

Does GameDay share and disclose information to third parties?

We may share your personal information in the instances described below. For further information on your choices regarding your information, see the “Your Privacy Rights” section below.

Remember, some of our Services allow Direct Users to connect with others and share information about themselves with other individuals and organisations. In some instances, your Profile Information, including your name, photo, and other personal information, will be available publicly to other members of our Service by default and may be searchable by search engines which may display a certain amount of your information publicly. You may be able to adjust your profile settings to entirely prevent the general public from viewing your profile, though it will remain visible to other Direct Users of our Service. Also, remember that Institutional Users and other third parties that use GameDay Services may have their own data collection and use policies that GameDay does not control, even in situations where GameDay acts as a data processor on their behalf. Please review the privacy policies of any third-party organisation before sharing your personal information with that organisation.

We may also share Personal Information of End Users provided by Institutional Users for marketing purposes, subject to the End Users’ affirmative consent. As described above, in such cases GameDay acts as a data controller and End Users may contact us directly in order to exercise their privacy rights.

We may share your personal information with:

• Other companies owned by or under common ownership with GameDay. These companies will use your personal information in the same way as we can under this policy;
• Third-party vendors and other service providers that perform services on our behalf, as needed to carry out their work for us, which may include identifying and serving targeted advertisements, billing, payment processing, content or service fulfilment, or providing analytic services;
• Trusted business partners who may use your information to contact you about opportunities that may be of interest to you (subject to your affirmative consent);
• Other Direct Users of the GameDay Service. Your information, including both information you provide and information we have collected about you from other Direct and/or Institutional Users, may be searchable by or made available to other Direct and/or Institutional Users of our Service. These users may contact you via email or via text messages (subject to your affirmative consent);
• Persons with Authority. Certain GameDay Services connect to colleges and universities. As such, GameDay may disclose your personal information directly or via a third party to colleges and universities that you have indicated you are interested in attending, as well as to other accredited colleges and universities that GameDay and/or our business partners believe may be of interest to you (subject to your affirmative consent);
• The public. Any information that you voluntarily disclose for posting to our Service is viewable by other Users and the public. As one example, a tournament director may print a list of athletes at an event and distribute that list to tournament attendees who may or may not be members of our Service;
• Other parties in connection with a company transaction, such as a merger, sale of company assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business by another company or third party, or in the event of a bankruptcy or related or similar proceedings; and
• Third parties as required by law or subpoena or otherwise if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Use or protect the security or integrity of our Service; and/or (c) exercise or protect the rights, property, or personal safety of GameDay, our Users, or others.

We may also aggregate or otherwise strip data of all personally identifying characteristics and may share that aggregated, anonymised data with third parties.

If GameDay receives your Personal Information in the European Union and subsequently transfers that information to a third party agent or service provider for processing, GameDay remains responsible for ensuring that such third party agent or service provider processes your Personal Information to the standard required by our Model Contract Clause commitments (see the sections below headed “Additional Information for Users in the European Economic Area (EEA)” and “International Data Transfers”).

Data Retention

We will retain your Personal Information for as long as your account is active or as needed to provide our Direct and Institutional Users with our Services; to maintain a record of your transactions for financial reporting, audit, and compliance purposes; and to comply with our legal obligations, resolve disputes, enforce agreements, and as otherwise permitted by applicable law. Upon your request, GameDay will deactivate your account or delete your Personal Information.

Compliance with the Australian Privacy Principles

GameDay is bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs), which govern the collection, use, disclosure, quality, security, and correction of personal information. Where GameDay acts as a data processor on behalf of an Institutional User, some obligations (such as notification of collection, direct marketing preferences, and correction of records) are fulfilled by that Institutional User as data controller, including where individuals register and manage their information through the Institutional User’s own registration platform. The table below summarises how GameDay meets each principle.

Principle

Requirement

GameDay compliance

APP 1: Open and transparent management of personal information

Maintain a clearly expressed, up-to-date privacy policy and practices for handling personal information.

This privacy policy is published and publicly available at mygameday.app/privacy-policy, covering collection, use, disclosure, retention and data subject rights.

APP 2: Anonymity and pseudonymity

Give individuals the option of not identifying themselves where lawful and practicable.

Public-facing content (fixtures, results, ladders) is accessible without identification; identification is required only where inherent to the service (e.g. registration, eligibility, discipline).

APP 3: Collection of solicited personal information

Collect only what is reasonably necessary, by lawful and fair means.

Where GameDay acts as data processor, the Institutional User (as data controller) defines the data fields collected; data is captured at source with no extraneous collection by GameDay.

APP 4: Dealing with unsolicited personal information

Determine whether unsolicited information could have been collected lawfully; destroy or de-identify if not.

Unsolicited personal information is assessed on receipt and destroyed or de-identified where it could not have been lawfully solicited.

APP 5: Notification of collection

Notify individuals of collection, purpose, and disclosure at or before the time of collection.

Registration flows include declarations and privacy policy acknowledgements at the point of collection. Where registration is managed through an Institutional User’s own platform, notification is provided by that controller.

APP 6: Use and disclosure

Use or disclose personal information only for the purpose collected, or as permitted.

Controller and processor roles are contractually defined. Where GameDay acts as processor only, marketing consents are not used by GameDay to market to an Institutional User’s members.

APP 7: Direct marketing

Only use personal information for direct marketing with consent and opt-out mechanisms.

Explicit opt-in functionality during registration, plus ongoing self-management of communication preferences via member profiles. Where registration is managed through an Institutional User’s own platform, preferences are managed by that controller.

APP 8: Cross-border disclosure

Take reasonable steps to ensure overseas recipients comply with the APPs.

Production data is hosted onshore — AWS Sydney across triple-redundancy availability zones with geo-redundant backups; no offshore disclosure of production data.

APP 9: Adoption of government identifiers

Do not adopt, use or disclose government identifiers as an organisation’s own identifier.

Government identifiers are never used as member IDs — all member IDs are system-generated. Working with Children (WWC) numbers are stored solely for compliance verification, with restricted access.

APP 10: Quality of personal information

Take reasonable steps to ensure information is accurate, up-to-date and complete.

Member self-service updates; the registration platform acts as the single source of truth; real-time validation of eligibility and age; duplicate prevention and management. Where registration is managed through an Institutional User’s own platform, data quality is maintained by that controller.

APP 11: Security of personal information

Protect information from misuse, interference, loss, unauthorised access, modification or disclosure.

AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control with MFA and least-privilege access, PII masking, continuous monitoring and DDoS protection, annual external penetration testing, production/non-production segregation, 30-day backup retention, and a documented incident response plan.

APP 12: Access to personal information

Provide individuals access to their personal information on request.

MyRequests facility providing data access requests and full export; self-service member profile access.

APP 13: Correction of personal information

Take reasonable steps to correct information; respond to correction requests.

Self-service profile edits, administrator correction tools, and audit logging of all changes. Where registration is managed through an Institutional User’s own platform, corrections are handled by that controller.

Your Privacy Rights

What choices do I have?

If you are a Direct User, you can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of most of the features of our Services.

Cookies

Like many companies, GameDay uses cookies and other common tracking technologies to help us better understand your use and needs of our Services, guide development of future products, and learn how we can improve. For example:

• Based on your cookie settings, we may track information indicating, among other things, which pages of the website were visited, the order in which they were visited, when they were visited, and which hyperlinks and other user interface controls were used;
• We may log the IP address, operating system, and browser software you used when accessing our Service, and we may be able to determine from an IP address your Internet Service Provider and the geographic location of your point of connectivity; and
• We may track and collect information from emails that we send to you, for example whether you opened the email or clicked on any links from the email.

GameDay also partners with third parties to help us track and understand your activity on our Services, how you interact with our social media, and how you find or may be referred to our Services.

GameDay uses cookies and other tracking technologies for the following purposes:

• When necessary for system administration, security, and integrity to ensure our Services work properly for you. Without these technologies, our Service may not function correctly; and
• To enable analytics, performance and functionality, to help us gather information about how visitors use our Service, monitor our Service’s performance, and to enhance your experience by recognising and remembering whether you have used our Service before and may have any personal preferences.

Marketing Communications

You can opt out of receiving certain promotional or marketing communications from us at any time, by using the unsubscribe link in the email communications we send, or by managing your communication preferences via your member profile.

If you have an account for our Services, we will still send you non-promotional communications, like service-related emails.

How Can I Exercise My Data Subject Rights?

If you would like to access, review, update, rectify, or delete any Personal Information we hold about you, or exercise any other data subject right available to you under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, or under the EU General Data Protection Regulation (GDPR), please contact our privacy team at [email protected]. Our privacy team will examine your request and respond to you as quickly as possible.

If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Please note we may still use any aggregated and de-identified Personal Information that does not identify any individual; and may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. GameDay may also be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

International Data Transfers

Personal Information you submit on the Websites or through our Services is sent to Australia and will be primarily processed by us in Australia. Production data is hosted onshore in Australia (AWS Sydney) across triple-redundancy availability zones with geo-redundant backups, and there is no offshore disclosure of production data. Where any Personal Information is processed in other countries, we will always protect your information, as agreed upon with Processing Model Contract Clauses executed with each respective Data Processor and/or Data Controller, in accordance with this Privacy Policy wherever it is processed.

Additional Information for Users in the European Economic Area (EEA)

This section sets out the privacy principles we follow with respect to transfers of Personal Information from the EEA to Australia, including Personal Information we receive from individuals residing in the EEA who visit our Websites and/or who may use our Services or otherwise interact with us. Please note that for users located in the EEA, the term Personal Information used in this Policy is equivalent to the term “personal data” under applicable European data protection laws.

GameDay complies with the EU GDPR through Data Processing Model Contract Clauses executed with each respective Data Controller and Data Processor regarding the collection, use, and retention of Personal Information from European Union member countries. These Model Clauses follow the principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability.

We commit to resolving complaints about your privacy and our collection or use of your Personal Information. GameDay website visitors located within the EEA with inquiries or complaints regarding this Privacy Policy should first contact us at [email protected].

Children

Unless explicitly stated otherwise when Direct Users create an account with one of our Services, we do not knowingly collect or solicit personal information from anyone under the age of 13. Our Services which do collect Personal Information from children under the age of 13 comply with applicable privacy laws, including the Privacy Act 1988 (Cth) and the GDPR, meaning that:

• We will provide parents with direct notice of our information practices and obtain their verifiable consent before collecting their children’s Personal Information; and
• We will respect parents’ right to delete or restrict GameDay’s use of that Personal Information.

Changes to the Privacy Policy

We’re constantly trying to improve our websites and Services, so we may need to change this Privacy Policy from time to time as well. We will alert you to material changes by, for example, placing a notice on our websites and/or by sending you a notification where we are required to do so by applicable law. You can see when this Privacy Policy was last updated by checking the date at the top of this page. You are responsible for periodically reviewing this Privacy Policy.

Data Protection Management

Data Protection Officer

GameDay Australia

132 Cremorne Street

Richmond VIC 3121

Email Address: [email protected]

If you have any questions or concerns regarding our Privacy Policy, please send a detailed message to us at [email protected] or by mail to the address listed above.