Privacy Policy

KLA Software Solution Co., Ltd. ("we") is committed to protecting the privacy of SportUp platform users. This privacy policy explains how we collect, use, store, and protect your personal information when you use sportup.vn and related services.

Information you provide directly: • Registration: Full name, email, phone number, date of birth • Profile: Avatar, bio, favorite sports • Tournament: Tournament name, rules, team lists, match results • Payment: Made by bank transfer — we do NOT store bank card information Automatically collected information: • Usage data: Pages visited, features used, access times • Device info: Device type, OS, browser, IP address • Cookies and similar technologies (see section 7) Device permissions (mobile app, only when you allow them): • Camera and microphone: when you livestream a match or take a photo to upload (avatar, tournament photos, documents) • Location: to suggest tournaments and venues near you; coordinates are only sent with a search, never tracked in the background • Photo library: to let you pick photos to upload • Notifications: we store a device token (push token) to send push notifications Identity verification (optional): front and back images of your national ID card when you join a tournament that requires verification Livestreaming: the video and audio of matches you broadcast are sent to SportUp's YouTube channel and shown publicly on the tournament page

• Provide and operate services: account management, tournament processing, ranking calculations • Process payments: coordinate with payment gateways • Communication: tournament notifications, result updates, support information • Improve services: usage statistics linked to a pseudonymous id (see section 7), detect and fix bugs • Security: detect fraud, prevent unauthorized access

We do NOT sell your personal information. Information is only shared in these cases: • Infrastructure providers: cloud hosting, CDN, email services (only data necessary for operation) • Usage statistics: PostHog (EU servers) receives a pseudonymous id (a random browser id, or your account id once you sign in), pages viewed, time spent, key actions (including payment amount and method), device type, OS, browser, traffic source and approximate location (country, province/city); PostHog never receives your name, email, phone number or IP address. Data passes through Cloudflare, where the IP address is removed before forwarding • Tournament Organizers: participant registration info (name, contact) for tournament operation • Legal requirements: when requested by authorized government agencies under applicable law

• Transport encryption: TLS/SSL for all connections • Storage encryption: Sensitive data encrypted at rest • Authentication: OAuth 2.0/OIDC via Keycloak with multi-factor authentication support • Access control: Role-based (RBAC) — Admin, Organizer, Participant, Referee • Monitoring: Logging and anomaly detection systems • Backup: Data backed up regularly and stored securely

You have the right to: • Access: View all personal data we store • Edit: Update personal information via your profile page • Delete: Delete your own account at any time in the app (Profile → Edit → Account). Deletion is self-service. Once accepted, your account is deactivated; removal of your login and retained personal information continues automatically, including retries after temporary service failures. Competition results stay under an anonymous name so other players' match history is not affected. Financial and transaction records are kept for the period described in Section 8 • Opt-out: Unsubscribe from marketing communications • Export: Request a copy of your personal data (processed within 30 days) To exercise the remaining rights, contact support@sportup.vn.

• Essential cookies: Login session, language, UI preferences (always on) • Usage statistics: pages viewed, time spent and key actions (search, tournament registration, payment, booking) to improve the product; for searches with no results, the search term (up to 50 characters) is recorded. No cookies: the identifiers and session are kept in your browser's storage (localStorage). Never sold or used for advertising • Turning it off: the switch below applies only to the browser and website where you use it; the Owner app (owner.sportup.vn) has no switch yet. Browsers sending Global Privacy Control are not tracked either. Registrations, tournament creation, payments and bookings are still recorded by our server against your account • No third-party advertising cookies • Push notifications: Only with user permission, can be disabled at any time

• Account and transaction data is stored on servers in Vietnam; usage statistics are stored with PostHog (EU) • Retention: for as long as your account is active • When you delete your account: it is deactivated immediately; uploaded photos, ID card images and your sign-in account are deleted and your profile is anonymized — usually within minutes, at most 30 days if a service is temporarily failing • Usage statistics linked to your account: when you delete your account we ask PostHog to delete them; PostHog may take longer to complete this • Match results are kept under an anonymous name and are no longer linked to you • Payment transaction data: stored for a minimum of 5 years per accounting regulations • System backups are deleted automatically after at most 30 days

SportUp does not target children under 16. We do not knowingly collect personal information from children under 16. If a violation is discovered, we will delete the data immediately.

This policy may be updated. Significant changes will be communicated via email or platform notification at least 7 days before taking effect.

For questions about this privacy policy, please contact: Email: support@sportup.vn Phone: +84 983 764 369 KLA Software Solution Co., Ltd., Da Nang, Vietnam

SportUp uses YouTube API Services to broadcast tournament matches live on our own YouTube channel (SportUp Live) and to show those videos in the app and on sportup.vn. By using the livestream and video features you also agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms Google Privacy Policy: https://policies.google.com/privacy SportUp does not collect or store the Google or YouTube account credentials of its users. Only SportUp's own channel connects to YouTube through Google OAuth. Match videos are stored and served by YouTube. You can review or revoke access that SportUp's channel has been granted at https://security.google.com/settings/security/permissions To ask us to remove a video that features you, contact support@sportup.vn.