PRIVACY POLICY SPORTALL TECHNOLOGIES SDN BHD Company Registration No: 202601004286 (1666383-H) Effective Date: 11 March 2026 Last Updated: 1 November 2026 1. INTERPRETATION AND DEFINITIONS This Privacy Policy ("Policy") governs the collection, use, processing, disclosure, retention, and protection of Personal Data by Sportall ("Sportall", "we", "us", or "our") in connection with the use of the Sportall mobile application and the Sportall website at sportall.my (together, the "App"). This Policy applies to all users who access or use the App. For the purposes of this Policy: • "App" refers to the Sportall mobile application and the Sportall website. • "Personal Data" means any information that identifies or can reasonably identify an individual. • "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion. • "Service Providers" means third-party entities that process Personal Data on behalf of Sportall. Sportall determines the purposes and means of Processing and acts as the data controller in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA), as amended. By accessing or using the App, you acknowledge that you have read and understood this Policy. 2. SCOPE AND APPLICATION This Policy applies to Personal Data collected through the App. It does not apply to third-party websites, services, or platforms that may be linked within the App. Sportall does not control and is not responsible for the privacy practices of such third parties. Where Sportall integrates with third-party rating or sports data providers (such as DUPR INC.), those providers operate under their own privacy policies. Users are encouraged to review third-party privacy policies independently, including the DUPR Privacy Policy available at www.mydupr.com. 3. DATA MINIMISATION AND PURPOSE LIMITATION Sportall collects and processes Personal Data only to the extent reasonably necessary to provide, maintain, secure, and improve the Service. We do not collect Personal Data unrelated to the stated purposes of the App. Personal Data is not processed in a manner incompatible with the purposes described herein. 4. ELIGIBILITY AND AGE RESTRICTION The App is intended exclusively for individuals who are 18 years of age or older. By creating an account, you represent and warrant that you are at least 18 years old. We will not knowingly collect Personal Data from individuals under 18. If we become aware that Personal Data of a person under 18 has been collected, we reserve the right to suspend or permanently delete the associated account and data. 5. CATEGORIES OF PERSONAL DATA COLLECTED We collect Personal Data that is necessary to provide, secure, and improve the App. 5.1 Account Registration Information When you create an account, we collect: • Email address and, where you verify one, mobile number • Username and display name • Date of birth, to confirm eligibility • Sports, skill levels, and interests you choose • Profile photo (if voluntarily uploaded) Authentication is facilitated through Supabase authentication services, which process authentication credentials on our behalf as a data processor. One-time passcodes sent by SMS are delivered through an SMS service provider. 5.2 User-Generated Content When you use communication features within the App, we collect: • Chat messages exchanged between users • Images uploaded within chat • Associated metadata (timestamps, user identifiers) This data is processed to enable communication, maintain service functionality, enforce community standards, and investigate abuse or violations. 5.3 Activity, Club, and Match Information When you use the App, we record: • Sessions, friendlies, and tournaments you host, join, or leave, and your attendance • Clubs you belong to, your role, and your membership status, including membership fee and paid-through dates • Match scores, results, ratings, rankings, and statistics • Points, rewards, referrals, badges, and collectibles Some of this information is visible to other users. For example, your name, profile, and participation appear on sessions you join; your ratings and results appear on your profile and rankings; and the Owners and Admins of a club can see members' membership and payment status for that club. 5.4 Location Information Location data is collected only when you actively access location-dependent features (such as discovering nearby games or receiving nearby session notifications). • Location access occurs only while the App is in use (foreground only). • Your location is resolved to city level only; precise GPS coordinates are not stored on our servers. • Your most recently detected city is stored on our servers solely to improve nearby session matching and relevant notifications. • Only your current city is retained; no location history is maintained. • Location access is not performed in the background. • You may withdraw location permission at any time via your device settings, which will disable location-dependent features. Location permissions are requested in accordance with your device's operating system controls. 5.5 Payment and Payout Information Where you make an In-App Payment, payment is handled by our licensed third-party payment gateway. Sportall does not receive or store your online banking username, password, or card number. We receive and keep: • The amount, Platform Fee, currency, and what the payment was for • The payment reference, status, date, and the bank or payment channel used • Refund details where a refund is due Where you receive payouts as a host or club owner, we collect the bank name, account holder name, and account number you provide, and keep records of each payout. This information is used only to make and reconcile payouts and is shared with our payment gateway and banks for that purpose. 5.6 Technical and Device Information We may collect limited technical information, including: • Device type • Operating system version • Application version • Push notification token • Crash logs and diagnostic data This data is used to deliver notifications and to maintain platform stability, security, and performance. 5.7 DUPR Rating Integration Data Sportall integrates with DUPR INC. ("DUPR") as the official pickleball ratings provider for the App. For pickleball sessions and matches conducted through the App, we collect and transmit the following to DUPR: • Player identifiers (name, email address, DUPR ID where linked) • Match results (scores, game outcomes, participating player IDs) • Match metadata (date, format, session reference) This data is transmitted to DUPR solely for the purpose of calculating and maintaining official DUPR player ratings. Additionally, if you expressly opt-in to receiving DUPR promotional communications within the App, your registered email address may be shared with DUPR on a quarterly basis. This opt-in is voluntary and separate from core App functionality. You may withdraw your consent at any time through the App's settings without affecting your ability to use Sportall. DUPR processes data received from Sportall in accordance with its own privacy policy. Sportall does not sell DUPR rating data to any third party. 5.8 Advertising and Sponsored Content Sportall displays advertisements through third-party advertising networks, including Google AdMob, and shows its own featured cards and sponsored content. • Advertisements from advertising networks are currently delivered on a non-personalised basis. Sportall does not access, profile, or combine advertising identifiers with user behavioural data. • We do not engage in cross-app tracking. • Advertising partners may collect limited device identifiers in accordance with their own privacy policies. • Sportall records when its own featured cards and sponsored content are viewed or clicked, so that we can count total and unique views and clicks. We share these statistics with sponsors only in aggregated form that does not identify any user. We do not control the independent data practices of advertising partners. 6. LEGAL BASIS FOR PROCESSING Where applicable under relevant data protection laws, we process Personal Data on one or more of the following bases: • Performance of a Contract – to provide core App functionality, including account management, messaging, sessions, clubs, and In-App Payments. • Legitimate Interests – to maintain platform safety, prevent abuse and fraud, ensure security, measure advertising, and improve services. • Consent – where required, including for location access, push notifications, and DUPR promotional email. • Legal Obligation – where processing is necessary to comply with applicable law, including tax and accounting law. Where Processing is based on consent, users may withdraw consent at any time by adjusting device permissions or contacting Sportall, subject to lawful retention requirements. 7. PURPOSES OF PROCESSING We process Personal Data for the following purposes: • Account creation, authentication, and mobile number verification • Enabling user-to-user communication • Displaying location-based game listings • Running sessions, clubs, friendlies, tournaments, rankings, and rewards • Processing In-App Payments, refunds, and payouts, and sending receipts • Sending service notifications by push, email, and SMS • Detecting and preventing fraud, payment abuse, and rating manipulation • Moderating content and enforcing community standards • Investigating reports of abuse or misconduct • Improving App functionality and stability • Delivering advertisements and reporting aggregated advertising statistics to sponsors • Submitting pickleball match data to DUPR INC. for official rating calculation • Sharing email addresses with DUPR INC. on a quarterly basis, solely where you have expressly opted-in to receive DUPR promotional communications • Complying with legal and regulatory obligations We do not conduct automated decision-making that produces legal or similarly significant effects. 8. DATA RETENTION Personal Data is retained only for as long as necessary to fulfil the purposes described in this Policy. • Account data is retained while the account remains active. • Chat content is retained for up to six (6) months from the date of transmission. • Payment, refund, and payout records are retained for seven (7) years, or longer where required by law, to meet tax, accounting, and anti-fraud obligations, even after an account is deleted. • Content associated with reports, disputes, or investigations may be retained for longer periods where necessary for legal compliance or platform safety. • Technical logs may be retained for security and diagnostic purposes. Where data is no longer required, it is securely deleted or irreversibly anonymised. 9. ACCOUNT DELETION Users may permanently delete their account in the App under Settings, by tapping "Delete Account". Upon deletion: • Authentication credentials are removed, and your email address and mobile number are released. • Profile data is deleted. • Associated Personal Data is deleted or anonymised, subject to legal, payment-record, or moderation-related retention requirements. 10. DISCLOSURE AND SHARING OF PERSONAL DATA We may disclose Personal Data to: • Service providers acting on our behalf, including hosting, database, and authentication providers (such as Supabase), push notification, email, and SMS delivery providers, and our payment gateway and banks for payments, refunds, and payouts • Other users, to the extent described in Section 5.3, including hosts of sessions you join and the Owners and Admins of clubs you belong to • DUPR INC.: for pickleball match data submission and official rating calculation, and for promotional email communication where you have opted-in. DUPR INC. is an independent data processor located in Delray Beach, Florida, USA, and processes data in accordance with its own privacy policy • Advertising partners for non-personalised ad delivery, and sponsors, who receive aggregated statistics only • Professional advisers, auditors, and insurers, under a duty of confidentiality • A buyer or successor in the event of a merger, acquisition, or sale of all or part of our business, subject to this Policy • Law enforcement authorities, regulators, or courts where required by law, or where reasonably necessary to protect the rights, property, or safety of Sportall, our users, or others Sportall does not sell, rent, trade, or otherwise monetise Personal Data. We do not engage in data brokerage or behavioural profiling for commercial resale. DUPR rating data received from DUPR INC. will not be sold or transferred to any other third party. 11. INTERNATIONAL DATA TRANSFERS Sportall is based in Malaysia. Personal Data may be processed in jurisdictions outside Malaysia where our service providers operate infrastructure. Where cross-border transfers occur, we take reasonable steps to ensure appropriate contractual, technical, or organisational safeguards are implemented in accordance with the PDPA and applicable data protection standards. 12. DATA SECURITY AND INCIDENT RESPONSE Sportall implements reasonable technical and organisational measures designed to safeguard Personal Data from unauthorised access, misuse, disclosure, alteration, or destruction, including access controls and encryption in transit. No method of transmission or storage is completely secure, and Sportall cannot guarantee absolute security. You are responsible for keeping your device, passcodes, and account credentials secure. In the event of a personal data breach, Sportall will notify the Personal Data Protection Commissioner and affected individuals in accordance with mandatory statutory requirements and applicable regulatory timelines. 13. USER RIGHTS Subject to applicable law, you may have the right to: • Request access to your Personal Data • Request correction of inaccurate data • Request deletion of your Personal Data • Withdraw consent where processing is based on consent • Object to certain processing activities • Request the transfer of your Personal Data in a structured, commonly used, and machine-readable format, subject to technical feasibility Requests may be submitted using the contact details below. We may need to verify your identity before acting on a request, and may charge a fee where the PDPA allows it. We will respond within the period required by law. 14. COMPLIANCE WITH MALAYSIAN PDPA Sportall processes Personal Data pursuant to the Malaysian Personal Data Protection Act 2010 (PDPA). Personal Data is collected and processed for lawful purposes directly related to the operation of the App and will not be processed in a manner incompatible with those purposes. Providing your Personal Data is voluntary, but if you do not provide the information marked as required, we may be unable to provide some or all of the Service. 15. CHANGES TO THIS POLICY We reserve the right to update this Policy at any time. Updated versions will be published within the App and on our website, with the revised "Last Updated" date indicated. Continued use of the App following updates constitutes acceptance of the revised Policy. 16. GOVERNING LAW AND JURISDICTION This Privacy Policy shall be governed by and construed in accordance with the laws of Malaysia. If there is any inconsistency between the English version of this Policy and any translation, the English version prevails. Any disputes relating to this Policy shall be resolved in accordance with the dispute resolution provisions set out in the Terms & Conditions. 17. CONTACT INFORMATION AND NOTICES Users may submit privacy-related inquiries, requests, or notices to: Sportall Technologies Sdn Bhd Company Registration No: 202601004286 (1666383-H) Registered Address: SUITE 5-3, LEVEL 5, WISMA W.I.M. NO.7, JALAN ABANG HAJI OPENG, TAMAN TUN DR. ISMAIL, 60000 W.P. KUALA LUMPUR, MALAYSIA Email: general@sportall.my Sportall may respond electronically. Users are responsible for maintaining accurate contact details associated with their accounts. In compliance with the PDPA, Sportall has appointed a Data Protection Officer (DPO) to oversee our privacy practices. You may contact our DPO regarding any personal data concerns at general@sportall.my