Privacy Policy

ZEKKO GOLF ("we," "us," "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("ZEKKO GOLF"), website, and related services (collectively, the "Services"). By downloading, accessing, or using ZEKKO GOLF, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Services. We act as the Data Controller (GDPR) or Business (CCPA) for your personal information. For European Economic Area (EEA), UK, and Swiss users, Google acts as a Data Processor when you use Firebase services.

2.1 Information You Provide Directly Account information (name, email address, username, password) Profile details (handicap, home club, preferred tee time) Society and tournament registration details Payment information for premium subscriptions (processed securely via third-party providers; we do not store full card details) Communications you send us (e.g. support requests, feedback) 2.2 Information Collected Automatically Device identifiers (iOS IDFA / Android Advertising ID where permitted) IP address Approximate location (derived from IP, not precise GPS unless enabled) Usage data (features used, sessions, crash reports, performance data) Firebase Analytics data (aggregated, anonymised where possible) 2.3 Information from Third Parties Public profile information when you sign in with Google or Apple Referral data if invited by another player 2.4 Information We Do NOT Collect Sensitive personal data (health information, biometric data, political opinions, religious beliefs) Precise location without your explicit permission (you can enable/disable via device settings) Contacts from your phone address book (we do not access or upload your contacts) Browsing history outside our Services

We use your information for the following purposes: • Provide, operate, and maintain ZEKKO GOLF services • Create and manage your account and player profile • Process gameplay, scoring, and card mechanics • Send push notifications about your turns, card casts, and round invitations • Facilitate society and tournament management • Process payments and manage subscriptions • Provide customer support and respond to enquiries • Detect, prevent, and address fraud, abuse, and security issues • Comply with legal obligations 3.1 Firebase Services Data Processing When you use ZEKKO GOLF, Firebase processes specific end-user data to provide services, including: • Firebase Analytics: aggregated usage data to improve app features • Firebase Cloud Messaging: delivery of push notifications • Firebase Crashlytics: crash reporting and performance monitoring • Firebase Authentication: secure sign-in (where applicable) Google processes this data on our behalf as a Data Processor under Google's terms and applicable data protection laws.

4.1 Third-Party Service Providers We share your information with trusted third parties that help us operate our Services, including: • Google LLC (Firebase — analytics, push notifications, authentication, crash reporting) • Stripe (payment processing) • Resend (transactional email) • Cloud hosting and infrastructure providers Data Processing Agreements: We require all third-party service providers to maintain appropriate security measures and process personal data only for specified purposes. 4.2 Sharing with Other Users Certain information (such as your username, handicap, and society membership) is visible to other players within games and societies you join. You control what profile information is shared. 4.3 Legal Disclosures We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the security and integrity of our Services. 4.4 Business Transfers If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will notify you of any such change. 4.5 No Selling of Personal Data We do not sell your personal data to third parties for monetary or other valuable consideration.

ZEKKO GOLF operates globally. Your personal information may be transferred to and processed in countries other than your country of residence, including the United States (via Google/Firebase) and the United Kingdom. Safeguards we use: • EU-U.S. Data Privacy Framework (DPF) certification for Google LLC (and its wholly-owned US subsidiaries) • Standard Contractual Clauses (SCCs) adopted by the European Commission • UK Addendum to the SCCs for UK data transfers Google remains responsible for any of your personal information shared under the Onward Transfer Principle with third parties for external processing on their behalf.

We retain your personal information only as long as necessary for the purposes described in this Privacy Policy, or as required by law. Account Deletion: When you delete your account, we will remove your personal information from live systems within 30 days and from backup systems within 180 days, except where retained for legal or legitimate business purposes. You may request account deletion at any time via the app settings or by contacting privacy@zekkogolf.com.

7.1 Rights for EEA, UK, and Switzerland Residents (GDPR/UK GDPR) Under the General Data Protection Regulation, you have the following rights: • Right of access to your personal data • Right to rectification of inaccurate data • Right to erasure ("right to be forgotten") • Right to restrict processing • Right to data portability • Right to object to processing • Right to withdraw consent at any time Lawful Basis for Processing: We rely on contract performance (Article 6(1)(b)) for core gameplay, legitimate interest (Article 6(1)(f)) for security and analytics, and consent (Article 6(1)(a)) for optional features like push notifications. 7.2 Rights for California Residents (CCPA/CPRA) Under the California Consumer Privacy Act (as amended by the CPRA), California residents have the following rights: • Right to know what personal information is collected and how it is used • Right to delete personal information • Right to opt out of the "sale" or "sharing" of personal information (we do not sell your data) • Right to non-discrimination for exercising your rights Shine the Light (California Civil Code Section 1798.83): California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures. 7.3 Rights for All Users To exercise your rights, contact us at: privacy@zekkogolf.com We may verify your identity before processing your request.

We use cookies and similar tracking technologies on our website and within our app. 8.1 Types of Tracking Technologies • Essential cookies (required for core functionality) • Analytics cookies (to understand how the app is used) • Advertising identifiers (iOS IDFA / Android Advertising ID, where permitted) 8.2 Your Choices Website: Manage cookie preferences via our cookie banner (first visit) Mobile App: Adjust tracking permissions in device settings Advertising ID: Reset or limit ad tracking via device settings (iOS: Settings → Privacy → Apple Advertising; Android: Google Settings → Ads) 8.3 UK PECR Compliance Our use of storage and access technologies (cookies, tracking pixels, device fingerprinting) complies with the Privacy and Electronic Communications Regulations (PECR) 2003, as amended by the Data (Use and Access) Act 2025. We provide clear information about these technologies and obtain consent where required.

ZEKKO GOLF is not intended for children under the age of 13 (or 16 in certain jurisdictions). • We do not knowingly collect personal information from children under 13 • If you believe we have inadvertently collected such information, please contact us to delete it • Parental or guardian consent is required for users aged 13-18 in some jurisdictions COPPA Compliance: We comply with the Children's Online Privacy Protection Act and do not target children under 13. UK Position: Under the UK GDPR and the Age Appropriate Design Code, we apply default privacy settings that are high for all users, regardless of age.

We implement appropriate technical and organisational measures to protect your personal information, including: • Encryption in transit (TLS/SSL) and at rest • Secure authentication and access controls • Regular security assessments • Platform-native secure storage (iOS Keychain, Android Keystore) Despite these measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

11.1 Push Notifications With your consent, we send push notifications for: • Your turn to play a card • Card casts against you • Round invitations and updates • Society event reminders Opt out: Device settings → ZEKKO GOLF → Notifications → Disable 11.2 Local Storage The ZEKKO GOLF app stores certain data locally on your device, including: • Your card hand (temporary) • In-progress round data (for offline play) • Authentication tokens This data is stored securely using platform-native secure storage (iOS Keychain, Android Keystore).

Our Services may contain links to third-party websites or services (e.g., course booking partners, social media). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies. Our third-party service providers and their privacy policies: • Google Firebase: https://policies.google.com/privacy • Stripe: https://stripe.com/privacy • Resend: https://resend.com/privacy

We do not knowingly collect sensitive personal information, including: • Health information (medical conditions, disabilities) • Biometric data (fingerprints, facial recognition, excluding Face ID/Touch ID which stays on your device) • Genetic data • Precise geolocation without consent (you control this) • Trade union membership • Political opinions • Religious or philosophical beliefs • Sex life or sexual orientation • Criminal convictions If we discover we have inadvertently collected such information, we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by: • A pop-up notice within the app (for significant changes) • An email to the address associated with your account • Updating the "Last Updated" date at the top of this policy We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Continued use of the Services after changes become effective constitutes your acceptance of the revised policy.

15.1 Data Controller ZEKKO GOLF is operated by WAM Tech Ltd (Company No. 16859720), 9 Mill Close, Brandon, Durham, England, DH7 8NY. We act as the Data Controller for your personal information. 15.2 Submitting Requests To exercise your privacy rights or ask questions about this policy: Email: privacy@zekkogolf.com Subject Line: Privacy Request – [Your Name] Postal Mail: WAM Tech Ltd, 9 Mill Close, Brandon, Durham, England, DH7 8NY We aim to respond to all legitimate requests within 30 days. Complex requests may take up to 60 days. 15.3 Supervisory Authorities If you are in the EEA or UK and believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your local supervisory authority (e.g. the Information Commissioner's Office in the UK).

• Personal Data: Any information relating to an identified or identifiable natural person. • Data Controller: The entity that determines the purposes and means of processing personal data. • Data Processor: An entity that processes personal data on behalf of the controller. • GDPR: The General Data Protection Regulation (EU/UK). • CCPA/CPRA: California Consumer Privacy Act, as amended by the California Privacy Rights Act. • PECR: Privacy and Electronic Communications Regulations (UK). • Firebase: Google's mobile development platform used for analytics, notifications, and authentication.

17.1 Nevada Residents Nevada residents have the right to opt out of the sale of their personal information. We do not sell personal information. 17.2 Virginia, Colorado, Connecticut, Utah Residents Residents of states with comprehensive privacy laws (VCDPA, CPA, CTDPA, UCPA) have additional rights similar to those described in Section 7. Please contact us at privacy@zekkogolf.com to exercise your rights. 17.3 Australia (Privacy Principles) We comply with the Australian Privacy Principles (APPs). You may access or correct your personal information by contacting us.

We provide this short summary for easy reference. Please read the full Privacy Policy for complete information. • We collect account, profile, usage, and device data to operate ZEKKO GOLF. • We use Firebase (Google) for analytics, push notifications, and crash reporting. • We do not sell your personal data. • You can request access, deletion, or correction of your data at any time. • We protect your data with encryption and secure storage. Questions? privacy@zekkogolf.com