PRIVACY POLICY SPORTALL TECHNOLOGIES SDN BHD Company Registration No: 202601004286 (1666383-H) Effective Date: 11 March 2026 Last Updated: 11 March 2026 1. INTERPRETATION AND DEFINITIONS This Privacy Policy ("Policy") governs the collection, use, processing, disclosure, retention, and protection of Personal Data by Sportall ("Sportall", "we", "us", or "our") in connection with the use of the Sportall mobile application (the "App"). This Policy applies to all users who access or use the App. For the purposes of this Policy: • "App" refers to the Sportall mobile application. • "Personal Data" means any information that identifies or can reasonably identify an individual. • "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion. • "Service Providers" means third-party entities that process Personal Data on behalf of Sportall. Sportall determines the purposes and means of Processing and acts as the data user in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA). By accessing or using the App, you acknowledge that you have read and understood this Policy. 2. SCOPE AND APPLICATION This Policy applies exclusively to Personal Data collected through the App. It does not apply to third-party websites, services, or platforms that may be linked within the App. Sportall does not control and is not responsible for the privacy practices of such third parties. Users are encouraged to review third-party privacy policies independently. 3. DATA MINIMISATION AND PURPOSE LIMITATION Sportall collects and processes Personal Data only to the extent reasonably necessary to provide, maintain, secure, and improve the Service. We do not collect Personal Data unrelated to the stated purposes of the App. Personal Data is not processed in a manner incompatible with the purposes described herein. 4. ELIGIBILITY AND AGE RESTRICTION The App is intended exclusively for individuals who are 18 years of age or older. By creating an account, you represent and warrant that you are at least 18 years old. We will not knowingly collect Personal Data from individuals under 18. If we become aware that Personal Data of a person under 18 has been collected, we reserve the right to suspend or permanently delete the associated account and data. 5. CATEGORIES OF PERSONAL DATA COLLECTED We collect Personal Data that is necessary to provide, secure, and improve the App. 5.1 Account Registration Information When you create an account, we collect: • Email address • Display name (optional) • Profile photo (if voluntarily uploaded) Authentication is facilitated through Supabase authentication services, which process authentication credentials on our behalf as a data processor. 5.2 User-Generated Content When you use communication features within the App, we collect: • Chat messages exchanged between users • Images uploaded within chat • Associated metadata (timestamps, user identifiers) This data is processed to enable communication, maintain service functionality, enforce community standards, and investigate abuse or violations. 5.3 Location Information Location data is collected only when you actively access location-dependent features (such as discovering nearby games or receiving nearby session notifications). • Location access occurs only while the App is in use (foreground only). • Your location is resolved to city level only — precise GPS coordinates are not stored on our servers. • Your most recently detected city is stored on our servers solely to improve nearby session matching and relevant notifications. • Only your current city is retained — no location history is maintained. • Location access is not performed in the background. • You may withdraw location permission at any time via your device settings, which will disable location-dependent features. • Location permissions are requested in accordance with your device's operating system controls. 5.4 Technical and Device Information We may collect limited technical information, including: • Device type • Operating system version • Application version • Crash logs and diagnostic data This data is used to maintain platform stability, security, and performance. 5.5 Advertising-Related Information Sportall displays advertisements through third-party advertising networks, including Google AdMob. • Advertisements are currently delivered on a non-personalised basis. Sportall does not access, profile, or combine advertising identifiers with user behavioural data. • We do not engage in cross-app tracking. • Advertising partners may collect limited device identifiers in accordance with their own privacy policies. We do not control the independent data practices of advertising partners. 6. LEGAL BASIS FOR PROCESSING Where applicable under relevant data protection laws, we process Personal Data on one or more of the following bases: • Performance of a Contract – to provide core App functionality, including account management and messaging. • Legitimate Interests – to maintain platform safety, prevent abuse, ensure security, and improve services. • Consent – where required, including for location access and device permissions. • Legal Obligation – where processing is necessary to comply with applicable law. Where Processing is based on consent, users may withdraw consent at any time by adjusting device permissions or contacting Sportall, subject to lawful retention requirements. 7. PURPOSES OF PROCESSING We process Personal Data for the following purposes: • Account creation and authentication • Enabling user-to-user communication • Displaying location-based game listings • Moderating content and enforcing community standards • Investigating reports of abuse or misconduct • Improving App functionality and stability • Delivering advertisements • Complying with legal and regulatory obligations We do not conduct automated decision-making that produces legal or similarly significant effects. 8. DATA RETENTION Personal Data is retained only for as long as necessary to fulfil the purposes described in this Policy. • Account data is retained while the account remains active. • Chat content is retained for up to six (6) months from the date of transmission. • Content associated with reports, disputes, or investigations may be retained for longer periods where necessary for legal compliance or platform safety. • Technical logs may be retained for security and diagnostic purposes. Where data is no longer required, it is securely deleted or irreversibly anonymised. 9. ACCOUNT DELETION Users may permanently delete their account through the App's account settings. Upon deletion: • Authentication credentials are removed. • Profile data is deleted. • Associated Personal Data is deleted or anonymised, subject to legal or moderation-related retention requirements. To request account deletion, you may send a request to general@sportall.my. 10. DISCLOSURE AND SHARING OF PERSONAL DATA We may disclose Personal Data to: • Service providers acting on our behalf (including hosting, authentication, and infrastructure providers such as Supabase) • Advertising partners for non-personalised ad delivery • Law enforcement authorities or regulators where required by law Sportall does not sell, rent, trade, or otherwise monetise Personal Data. We do not engage in data brokerage or behavioural profiling for commercial resale. 11. INTERNATIONAL DATA TRANSFERS Sportall is based in Malaysia. Personal Data may be processed in jurisdictions outside Malaysia where our service providers operate infrastructure. Where cross-border transfers occur, we take reasonable steps to ensure appropriate contractual, technical, or organisational safeguards are implemented in accordance with applicable data protection standards. 12. DATA SECURITY AND INCIDENT RESPONSE Sportall implements reasonable technical and organisational measures designed to safeguard Personal Data from unauthorised access, misuse, disclosure, alteration, or destruction. In the event of a personal data breach, Sportall will notify the Personal Data Protection Commissioner and affected individuals in accordance with mandatory statutory requirements and applicable regulatory timelines. 13. USER RIGHTS Subject to applicable law, you may have the right to: • Request access to your Personal Data • Request correction of inaccurate data • Request deletion of your Personal Data • Withdraw consent where processing is based on consent • Object to certain processing activities • Request the transfer of your Personal Data in a structured, commonly used, and machine-readable format, subject to technical feasibility Requests may be submitted using the contact details below. 14. COMPLIANCE WITH MALAYSIAN PDPA Sportall processes Personal Data pursuant to the Malaysian Personal Data Protection Act 2010 (PDPA). Personal Data is collected and processed for lawful purposes directly related to the operation of the App and will not be processed in a manner incompatible with those purposes. 15. CHANGES TO THIS POLICY We reserve the right to update this Policy at any time. Updated versions will be published within the App and on our website, with the revised "Last Updated" date indicated. Continued use of the App following updates constitutes acceptance of the revised Policy. 16. GOVERNING LAW AND JURISDICTION This Privacy Policy shall be governed by and construed in accordance with the laws of Malaysia. Any disputes relating to this Policy shall be resolved in accordance with the dispute resolution provisions set out in the Terms & Conditions. 17. CONTACT INFORMATION AND NOTICES Users may submit privacy-related inquiries, requests, or notices to: Sportall Technologies Sdn Bhd Company Registration No: 202601004286 (1666383-H) Registered Address: SUITE 5-3, LEVEL 5, WISMA W.I.M. NO.7, JALAN ABANG HAJI OPENG, TAMAN TUN DR. ISMAIL, 60000 W.P. KUALA LUMPUR, MALAYSIA Email: general@sportall.my Sportall may respond electronically. Users are responsible for maintaining accurate contact details associated with their accounts. In compliance with the PDPA, Sportall has appointed a Data Protection Officer (DPO) to oversee our privacy practices. You may contact our DPO regarding any personal data concerns at general@sportall.my